Windows Analysis Report
IdeaShareKeyInstaller.exe

Overview

General Information

Sample Name: IdeaShareKeyInstaller.exe
Analysis ID: 876179
MD5: c7dfff14e887613a25cec2e1ee87f5a9
SHA1: 5dc3cbf93f7981ab7198e6769749f021cd01c062
SHA256: d08117db56fe4550a2c35a3ab3140a515e2a2e9ebbfc2ab8b89d2ab12e0a5786
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Compliance

Score: 16
Range: 0 - 100

Signatures

DLL side loading technique detected
Uses schtasks.exe or at.exe to add and modify task schedules
Uses 32bit PE files
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Queries device information via Setup API
Contains functionality to query CPU information (cpuid)
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to communicate with device drivers
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
EXE planting / hijacking vulnerabilities found
PE file does not import any functions
DLL planting / hijacking vulnerabilities found
Sample file is different than original file name gathered from version info
Extensive use of GetProcAddress (often used to hide API calls)
Drops PE files
Binary contains a suspicious time stamp
Contains functionality to read device registry values (via SetupAPI)
Uses taskkill to terminate processes
Creates a process in suspended mode (likely to inject code)

Classification

Source: IdeaShareKeyInstaller.exe, 00000000.00000003.403541817.00000000030FC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: -----BEGIN PUBLIC KEY-----
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe EXE: C:\Users\user\AppData\Local\IdeaShareKey\FaultReport.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe EXE: schtasks.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe EXE: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe EXE: C:\Users\user\AppData\Local\IdeaShareKey\uninst.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe EXE: taskkill.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe EXE: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareKey.exe Jump to behavior
DLL planting / hijacking vulnerabilities found
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe DLL: WINSTA.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H264D.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-handle-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-multibyte-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-libraryloader-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-profile-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-file-l2-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-io-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: WININET.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\QtSingleApp.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-interlocked-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-sysinfo-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\ecsframework.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-processthreads-l1-1-1.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-conio-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\zlib.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_login.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\mfc110u.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-localization-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_msg.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-debug-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\vccorlib140.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_call_mediaservice.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: SHFOLDER.DLL Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_xml.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_dns.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-security-base-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_pse.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-localization-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-eventing-provider-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-runtime-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-timezone-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\ctk.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-processenvironment-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_os_adapter.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\ecsdata.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_air_client.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-process-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\HW_H265dec_Win32D.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_publiclib.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H263D.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\hwuc.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-file-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\dbghelp.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H264E.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\securec.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\mfcm140.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video.dll Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe DLL: UxTheme.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Core.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_ssl.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_commonlib.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_call_video.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\concrt140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe DLL: WTSAPI32.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_Srtp_ALG.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Gui.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_crypto.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\msvcp110.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\msvcr110.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\ecscommon.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Network.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-synch-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-filesystem-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H263E.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\mfc110.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-localregistry-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\rtp.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-math-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-environment-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-file-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-time-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-convert-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-util-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\fr_plugin.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-processthreads-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_osal.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_httptrans.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\mfcm140u.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-locale-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\libssl-1_1.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-string-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\h265EncDll.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\dbgcore.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\platforms\qwindows.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-memory-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-errorhandling-l1-1-0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe DLL: VERSION.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\mfc140.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\ideasharesdk.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_exception.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\mfc140u.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-private-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_rtp.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-stdio-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Widgets.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-heap-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\ucrtbase.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-utility-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\ACE.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-downlevel-kernel32-l2-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_https_clt.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-string-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-heap-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\msvcr100.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-misc-l1-1-0.dll Jump to behavior

Compliance
barindex
Uses 32bit PE files
Source: IdeaShareKeyInstaller.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
EXE planting / hijacking vulnerabilities found
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe EXE: C:\Users\user\AppData\Local\IdeaShareKey\FaultReport.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe EXE: schtasks.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe EXE: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe EXE: C:\Users\user\AppData\Local\IdeaShareKey\uninst.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe EXE: taskkill.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe EXE: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareKey.exe Jump to behavior
DLL planting / hijacking vulnerabilities found
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe DLL: WINSTA.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H264D.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-handle-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-multibyte-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-libraryloader-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-profile-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-file-l2-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-io-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: WININET.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\QtSingleApp.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-interlocked-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-sysinfo-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\ecsframework.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-processthreads-l1-1-1.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-conio-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\zlib.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_login.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\mfc110u.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-localization-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_msg.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-debug-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\vccorlib140.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_call_mediaservice.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: SHFOLDER.DLL Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\libcrypto-1_1.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_xml.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_dns.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-security-base-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_pse.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-localization-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-eventing-provider-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-runtime-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-timezone-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\ctk.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-processenvironment-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_os_adapter.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\ecsdata.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_air_client.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-process-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\HW_H265dec_Win32D.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_publiclib.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H263D.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\hwuc.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-file-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\dbghelp.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H264E.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\securec.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\mfcm140.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video.dll Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe DLL: UxTheme.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Core.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_ssl.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_commonlib.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_call_video.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\concrt140.dll Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe DLL: WTSAPI32.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_Srtp_ALG.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Gui.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_crypto.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\msvcp110.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\msvcr110.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\ecscommon.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Network.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-synch-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-filesystem-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H263E.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\mfc110.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-localregistry-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\rtp.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-math-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-environment-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-file-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-time-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-convert-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-util-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\fr_plugin.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-processthreads-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_osal.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_httptrans.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\mfcm140u.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-locale-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\libssl-1_1.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-string-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\msvcp140.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\h265EncDll.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\dbgcore.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\platforms\qwindows.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-memory-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-synch-l1-2-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-errorhandling-l1-1-0.dll Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe DLL: VERSION.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\mfc140.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\ideasharesdk.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_exception.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\mfc140u.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-private-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_rtp.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-stdio-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Widgets.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-heap-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\ucrtbase.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-utility-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\ACE.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-downlevel-kernel32-l2-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\tup_https_clt.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-string-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-heap-l1-1-0.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\msvcr100.dll Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe DLL: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-misc-l1-1-0.dll Jump to behavior
Source: IdeaShareKeyInstaller.exe Static PE information: certificate valid
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\ecscommon.pdb44$GCTL source: IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382694885.00000000028D9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Work\Projects\Protocol_SpeedDown_AntiPulseLosePacket\src\service\build-win32\out\Release\rtp.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\service\build-win32\out\Release\tup_httptrans.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.403541817.00000000030FC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.377107158.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.379193800.00000000028D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.378812758.00000000028D7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Network.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.363946159.00000000028D3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\TSDK_CodeHub\202109011027\src\service\build-win32\out\Release\tup_call_video.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\code\trunk\platform\securec\make\windows\securec\Release\securec.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.400816502.00000000030F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.381835390.00000000028DC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dbgcore.pdbGCTL source: IdeaShareKeyInstaller.exe, 00000000.00000003.378611056.00000000028DB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\ecsdata.pdb--#GCTL source: IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.380699809.00000000028D4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.362279958.00000000028D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp140.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.375307380.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\ecscommon.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\component\build-win32\out\Release\tup_dns.pdb--" source: IdeaShareKeyInstaller.exe, 00000000.00000003.402634591.00000000030F7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.380850018.00000000028D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\build\LOG_2_2_0_SCCEnc_CMC\code\current\publish\build\VS2017\Release\h265EncDll.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.392537309.0000000003288000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\component\build-win32\out\Release\tup_xml.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.404832548.00000000030F5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.383000586.00000000028DC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\TSDK_CodeHub\202109011027\src\service\build-win32\out\Release\tup_call_mediaservice.pdb88! source: IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\build\V2R8_H263Enc_WIN32_Vs2015\code\current\publish\Demo\Build\Vs2015\Release\HME_Video_H263E.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.394946980.00000000030FB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.379470944.00000000028DE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\component\build-win32\out\Release\tup_commonlib.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.402422954.00000000030FC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.360183579.0000000002D18000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\mfc140.i386.pdbGCTL source: IdeaShareKeyInstaller.exe, 00000000.00000003.370656624.00000000028D9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: f:\binaries.x86ret\bin\i386\mfc110u.i386.pdbWT& source: IdeaShareKeyInstaller.exe, 00000000.00000003.368820894.00000000028DE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.380591258.00000000028DA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\BaseFrame\lib_vc9\ctk.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.391032334.00000000030FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mfc110.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.367217273.00000000028D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.380163936.00000000028D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\hwuc.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.397323334.00000000030FB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\component\build-win32\out\Release\tup_commonlib.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.402422954.00000000030FC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.380766046.00000000028DD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382332768.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\TSDK_CodeHub\202109011027\src\service\build-win32\out\Release\tup_call_video.pdb&& source: IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vccorlib140.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.377544846.00000000028D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp140.i386.pdbGCTL source: IdeaShareKeyInstaller.exe, 00000000.00000003.375307380.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\ecsframework.pdb**# source: IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382578796.00000000028D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\component\build-win32\out\Release\tup_dns.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.402634591.00000000030F7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp110.i386.pdb0 source: IdeaShareKeyInstaller.exe, 00000000.00000003.374933296.00000000028D6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vccorlib140.i386.pdbGCTL source: IdeaShareKeyInstaller.exe, 00000000.00000003.377544846.00000000028D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\build\TUP_Trunk_VersionCompile\code\current\tupci\service\faultreport\bin\release\fr_plugin.pdb$0 source: IdeaShareKeyInstaller.exe, 00000000.00000003.392115844.00000000030F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.379719123.00000000028D1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\build\V2R8_H263Dec_WIN32_Vs2015\code\current\publish\Demo\Build\Vs2015\Release\HME_Video_H263D.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: f:\binaries.x86ret\bin\i386\mfc110u.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.368820894.00000000028DE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.383926836.00000000028D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\ecsframework.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382053407.00000000028D3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382907422.00000000028DE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382151499.00000000028D1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\service\build-win32\out\Release\tup_login.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.404028040.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -O2 -DL_ENDIAN -DOPENSSL_PIC -D_FORTIFY_SOURCE=2 source: IdeaShareKeyInstaller.exe, 00000000.00000003.398238612.000000000325A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382799277.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\target\ideasharekey\bin\Release\IdeaShareKey.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.385688768.0000000003261000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\build\LOG_1_2_0_SCCDec_CMC\code\current\publish\Build\VS2015\HW_H265dec_Win32D.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.396995984.00000000030F0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-downlevel-kernel32-l2-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.383264544.00000000028DA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\tr6Bugfix_nico\service\build-win32\out\Release\tup_exception.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.402876050.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.381196191.00000000028D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcr100.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.375798038.00000000028DA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\AirPresence\desktop\Windows\AirPresenceMonitor\Release\IdeaShareService.pdb source: IdeaShareService.exe, 00000019.00000000.447529528.00000000011CD000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.378928716.00000000028D7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: API-MS-Win-Eventing-Provider-L1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.383352636.00000000028DD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\hwuc.pdbVV)GCTL source: IdeaShareKeyInstaller.exe, 00000000.00000003.397323334.00000000030FB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -O2 -DL_ENDIAN -DOPENSSL_PIC -D_FORTIFY_SOURCE=2OpenSSL 1.1.1f 31 Mar 2020in order to bep, build date is removeplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "D:\share_lin\030606_codehub_win32\open_src_build\openssl\release\lib\engines-1_1"not available source: IdeaShareKeyInstaller.exe, 00000000.00000003.398238612.000000000325A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbQ source: IdeaShareKeyInstaller.exe, 00000000.00000003.360183579.0000000002D18000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\030606_codehub_win32\open_src_build\openssl\libssl-1_1.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.400345936.00000000030F6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-security-base-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.383493651.00000000028D5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.381757085.00000000028DC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdbUGP source: IdeaShareKeyInstaller.exe, 00000000.00000003.377107158.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\MFCM140U.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.374720041.00000000028DC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\build\TUP_Trunk_VersionCompile\code\current\tupci\service\faultreport\bin\release\fr_plugin.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.392115844.00000000030F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\build\LOG_iMedia_Video1_2_0_H264Dec\code\current\publish\Build\Vs2015\HME_Video_H264D\Release\HME_Video_H264D.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.395560847.00000000030F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\MFCM140.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.374567471.00000000028DB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\app code\airpresence_2\desktop\SDK\OpenSourceCode\ACE\include\lib\ACE.pdb^ source: IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp110.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.374933296.00000000028D6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\ecsdata.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\code\windows-bainyi\0927\HMEV2012\build\vc2015\Release\HME_Video.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.393786681.000000000342D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\mfc140u.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.373146232.00000000028D6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\service\build-win32\out\Release\tup_login.pdb==" source: IdeaShareKeyInstaller.exe, 00000000.00000003.404028040.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcr110.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.376314713.00000000028D4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\code\windows-bainyi\0927\HMEV2012\build\vc2015\Release\HME_Video.pdbD source: IdeaShareKeyInstaller.exe, 00000000.00000003.393786681.000000000342D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\target\ideasharekey\bin\Release\IdeaShareKey.pdbII." source: IdeaShareKeyInstaller.exe, 00000000.00000003.385688768.0000000003261000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\app code\airpresence_2\desktop\SDK\OpenSourceCode\ACE\include\lib\ACE.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382220665.00000000028DD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dbgcore.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.378611056.00000000028DB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\030606_codehub_win32\open_src_build\openssl\libssl-1_1.pdbAA source: IdeaShareKeyInstaller.exe, 00000000.00000003.400345936.00000000030F6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.381444648.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.381116835.00000000028D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.379308667.00000000028DC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.379938356.00000000028D7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\TSDK_CodeHub\202109011027\src\service\build-win32\out\Release\tup_call_mediaservice.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\tr6Bugfix_nico\service\build-win32\out\Release\tup_exception.pdb,," source: IdeaShareKeyInstaller.exe, 00000000.00000003.402876050.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\AirPresence\desktop\Windows\AirPresenceMonitor\Release\IdeaShareService.pdb991GCTL source: IdeaShareService.exe, 00000019.00000000.447529528.00000000011CD000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: mfc110.i386.pdbP) source: IdeaShareKeyInstaller.exe, 00000000.00000003.367217273.00000000028D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\mfc140.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.370656624.00000000028D9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\030606_codehub_win32\open_src_build\openssl\libcrypto-1_1.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.398238612.00000000032A7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\BaseFrame\lib_vc9\ctk.pdbaa# source: IdeaShareKeyInstaller.exe, 00000000.00000003.391032334.00000000030FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.365225488.00000000028DE000.00000004.00000020.00020000.00000000.sdmp
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.363946159.00000000028D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: d04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1email.google.comf5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06www.google.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3login.yahoo.com39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:293e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47login.skype.com92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43addons.mozilla.orgb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0login.live.comd8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0global trustee05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56*.google.com0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4cDigiNotar Root CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Services CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services 1024 CA0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Root CA G2a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21CertiID Enterprise Certificate Authority5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41DigiNotar Qualified CA46:9c:2c:b007:27:10:0dDigiNotar Cyber CA07:27:0f:f907:27:10:0301:31:69:b0DigiNotar PKIoverheid CA Overheid en Bedrijven01:31:34:bfDigiNotar PKIoverheid CA Organisatie - G2d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar Extended Validation CA1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Public CA 202546:9c:2c:af46:9c:3c:c907:27:14:a9Digisign Server ID (Enrich)4c:0e:63:6aDigisign Server ID - (Enrich)72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0UTN-USERFirst-Hardware41MD5 Collisions Inc. (http://www.phreedom.org/md5)08:27*.EGO.GOV.TR08:64e-islem.kktcmerkezbankasi.org03:1d:a7AC DG Tr equals www.yahoo.com (Yahoo)
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.404028040.00000000030F2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://%s/Ws/SmcExternal2.asmx
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.363946159.00000000028D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://bugreports.qt.io/
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.363946159.00000000028D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://bugreports.qt.io/_q_receiveReplyMicrosoft-IIS/4.Microsoft-IIS/5.Netscape-Enterprise/3.WebLogi
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394946980.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400816502.00000000030F1000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402422954.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.406551623.000000000310C000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.403541817.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.397323334.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404832548.00000000030F5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.392537309.0000000003288000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.396995984.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.398238612.00000000032FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400345936.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.392115844.00000000030F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382053407.00000000028D3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.378812758.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.377107158.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.383493651.00000000028D5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.373146232.0000000002D45000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.380591258.00000000028DA000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402876050.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.367217273.0000000002D05000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.381757085.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.399892875.00000000030FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379308667.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379938356.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.382694885.00000000028D9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382053407.00000000028D3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.378812758.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.377107158.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.383493651.00000000028D5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.373146232.0000000002D45000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.380591258.00000000028DA000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402876050.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.367217273.0000000002D05000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.381757085.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.399892875.00000000030FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379308667.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379938356.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.382694885.00000000028D9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382053407.00000000028D3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.378812758.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.377107158.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.383493651.00000000028D5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.373146232.0000000002D45000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.380591258.00000000028DA000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402876050.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.367217273.0000000002D05000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.381757085.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.399892875.00000000030FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379308667.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379938356.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.382694885.00000000028D9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394946980.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400816502.00000000030F1000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402422954.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.406551623.000000000310C000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.403541817.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.397323334.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404832548.00000000030F5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.392537309.0000000003288000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.396995984.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.398238612.00000000032FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400345936.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.392115844.00000000030F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.406551623.00000000030F1000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000000.355313023.0000000000409000.00000002.00000001.01000000.00000003.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000002.412809253.0000000000409000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394946980.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400816502.00000000030F1000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402422954.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.406551623.000000000310C000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.403541817.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.397323334.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404832548.00000000030F5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.392537309.0000000003288000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.396995984.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.398238612.00000000032FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400345936.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.392115844.00000000030F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382053407.00000000028D3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.378812758.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.377107158.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.383493651.00000000028D5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.373146232.0000000002D45000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.380591258.00000000028DA000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402876050.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.367217273.0000000002D05000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.381757085.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.399892875.00000000030FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379308667.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379938356.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.382694885.00000000028D9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382053407.00000000028D3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.378812758.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.377107158.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.383493651.00000000028D5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.373146232.0000000002D45000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.380591258.00000000028DA000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402876050.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.367217273.0000000002D05000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.381757085.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.399892875.00000000030FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379308667.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379938356.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.382694885.00000000028D9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382053407.00000000028D3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.378812758.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.377107158.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.383493651.00000000028D5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.373146232.0000000002D45000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.380591258.00000000028DA000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402876050.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.367217273.0000000002D05000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.381757085.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.399892875.00000000030FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379308667.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379938356.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.382694885.00000000028D9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.globalsign.com/rootr30;
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394946980.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400816502.00000000030F1000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402422954.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.406551623.000000000310C000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.403541817.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.397323334.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404832548.00000000030F5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.392537309.0000000003288000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.396995984.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.398238612.00000000032FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400345936.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.392115844.00000000030F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394946980.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400816502.00000000030F1000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402422954.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.406551623.000000000310C000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.403541817.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.397323334.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404832548.00000000030F5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.392537309.0000000003288000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.396995984.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.398238612.00000000032FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400345936.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.392115844.00000000030F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382053407.00000000028D3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.378812758.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.377107158.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.383493651.00000000028D5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.373146232.0000000002D45000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.380591258.00000000028DA000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402876050.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.367217273.0000000002D05000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.381757085.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.399892875.00000000030FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379308667.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379938356.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.382694885.00000000028D9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382053407.00000000028D3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.378812758.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.377107158.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.383493651.00000000028D5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.373146232.0000000002D45000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.380591258.00000000028DA000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402876050.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.367217273.0000000002D05000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.381757085.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.399892875.00000000030FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379308667.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379938356.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.382694885.00000000028D9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394946980.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400816502.00000000030F1000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402422954.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.406551623.000000000310C000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.403541817.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.397323334.00000000030FB000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404832548.00000000030F5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.392537309.0000000003288000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.396995984.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.398238612.00000000032FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400345936.00000000030F6000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.392115844.00000000030F4000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382053407.00000000028D3000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.378812758.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.377107158.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.404252393.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.383493651.00000000028D5000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.373146232.0000000002D45000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.380591258.00000000028DA000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.402876050.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.367217273.0000000002D05000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.381757085.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.399892875.00000000030FE000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379308667.00000000028DC000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.379938356.00000000028D7000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.382694885.00000000028D9000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://secure.globalsign.com/cacert/root-r3.crt06
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.362279958.00000000028D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.362279958.00000000028D0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.color.org)
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.363946159.00000000028D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.phreedom.org/md5)
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.363946159.00000000028D3000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.phreedom.org/md5)08:27
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.404028040.00000000030F2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://%s/Ws/SmcExternal2.asmx
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.404028040.00000000030F2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://%s/getClientParam.action?client=%s&registe=%u
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.404028040.00000000030F2000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://%u.%u.%u.%u:%u%s
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.397323334.00000000030FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://curCA.zipcurCA.tgz/newCA.tgz:8544/eua/rest/cert/downloadstup_http_download_file
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.403541817.00000000030FC000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.391032334.00000000030FA000.00000004.00000020.00020000.00000000.sdmp, IdeaShareKeyInstaller.exe, 00000000.00000003.377544846.00000000028D8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.globalsign.com/repository/0
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.400345936.00000000030F6000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.openssl.org/H
Creates a DirectInput object (often for capturing keystrokes)
Source: IdeaShareKeyInstaller.exe, 00000000.00000002.412942145.00000000006BA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Uses 32bit PE files
Source: IdeaShareKeyInstaller.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Contains functionality to communicate with device drivers
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011C1A30: hid_get_feature_report,DeviceIoControl,GetLastError,GetOverlappedResult, 11_2_011C1A30
PE file does not import any functions
Source: api-ms-win-core-interlocked-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-io-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-security-base-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-downlevel-kernel32-l2-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-eventing-provider-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-localregistry-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-misc-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.0.dr Static PE information: No import functions for PE file found
Sample file is different than original file name gathered from version info
Source: IdeaShareKeyInstaller.exe Binary or memory string: OriginalFilename vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382053407.00000000028D3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.378812758.00000000028D7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.385688768.00000000032E0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameIdeaShare Key.exe< vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.377107158.00000000030FF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameucrtbase.dllj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.383493651.00000000028D5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameACE.DLL( vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.373146232.0000000002D45000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMFC140U.DLL^ vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.380591258.00000000028DA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.381757085.00000000028DC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.379308667.00000000028DC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.379938356.00000000028D7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382694885.00000000028D9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.367217273.0000000002CA9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMFC110.DLL^ vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameHME_Video_H263D.dllN vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.383000586.00000000028DC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.370656624.0000000002D00000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMFC140.DLL^ vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.394946980.00000000030FB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameHME_Video_H263E.dllN vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.400816502.00000000030F1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamesecurec.dll( vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.378611056.00000000028DB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Triage dumps cannot contain PII. 0x%xDump type requires streaming but output provider does not support streamingWrite.Start failed, 0x%08xkernel32.dllQueryDosDeviceWOpenThreadThread32FirstThread32NextModule32FirstModule32NextModule32FirstWModule32NextWCreateToolhelp32SnapshotGetLongPathNameAGetLongPathNameWGetProcessTimesGetTimeZoneInformationGetThreadSelectorEntryGetThreadTimesIsProcessorFeaturePresentFindResourceAGetCachedSigningLevelSetCachedSigningLevelGetEnabledXStateFeaturesInitializeContextkernelbase.dllapi-ms-win-core-processthreads-l1-1-0.dllapi-ms-win-core-file-l1-1-0api-ms-win-core-timezone-l1-1-0.dllapi-ms-win-core-kernel32-legacy-l1-1-0.dllapi-ms-win-security-base-l1-2-0.dllapi-ms-win-security-base-l1-1-0.dllapi-ms-win-core-processsecurity-l1.dllapi-ms-win-core-versionansi-l1-1-0.dllapi-ms-win-core-version-l1-1-0.dllapi-ms-win-core-xstate-l2-1-0.dllapi-ms-win-core-toolhelp-l1-1-0.dllapi-ms-win-core-kernel32-private-l1-1-0.dllBaseSetLastNTErrorapi-ms-win-downlevel-kernel32-l2-1-0.dllapi-ms-win-core-processthreads-l1-1-2.dllSoftware\Microsoft\Windows NT\CurrentVersionBuildLabExSoftware\Microsoft\Windows NT\CurrentVersionCurrentTypechecked\NtQuerySystemInformation failed, 0x%08xLoadNtDeviceMapCache failed, 0x%08xTrackDiscoveredModule failed, 0x%08xEnumModulesUsingNt failed, 0x%08xA:\\\Device\Mup\Device\LanmanRedirector\Device\WinDfs\\TSCLIENT\Device\RdpDr\TSCLIENT\\?\MINIDUMP_AUXILIARY_PROVIDERwintrust.dllWinVerifyTrustWTHelperProvDataFromStateDataWTHelperGetProvSignerFromChaincrypt32.dllCertVerifyCertificateChainPolicy\StringFileInfo\040904b0\OriginalFilenameSoftware\Microsoft\Windows NT\CurrentVersion\MiniDumpAuxiliaryDllsSoftware\Microsoft\Windows NT\CurrentVersion\KnownManagedDebuggingDllsCLRDataCreateInstancepowrprof.dllCallNtPowerInformationverifier.dllVerifierEnumerateResourcepsapi.dllapi-ms-win-core-psapi-obsolete-l1-1-0.dllK32EnumProcessModulesK32GetModuleFileNameExWK32GetProcessMemoryInfoEnumProcessModulesGetModuleFileNameExWGetProcessMemoryInfoversion.dllGetFileVersionInfoSizeExAGetFileVersionInfoExAVerQueryValueAGetFileVersionInfoSizeAGetFileVersionInfoSizeWGetFileVersionInfoAGetFileVersionInfoW vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.378611056.00000000028DB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDBGCORE.DLLj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.374933296.00000000028D6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp110.dll^ vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.376314713.00000000028D4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcr110.dll^ vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.374720041.00000000028DC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMFCM140U.DLL^ vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.360183579.0000000002D18000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameQt5Core.dll( vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.381835390.00000000028DC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.363946159.00000000028D3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameQt5Network.dll( vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382332768.00000000030FF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.375798038.00000000028DA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcr100_clr0400.dll^ vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.368820894.0000000002CC4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMFC110U.DLL^ vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.378928716.00000000028D7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.362279958.00000000028D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameQt5Gui.dll( vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.374567471.00000000028DB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameMFCM140.DLL^ vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.380766046.00000000028DD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382578796.00000000028D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.365225488.00000000028DE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameQt5Widgets.dll( vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.380850018.00000000028D2000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.380163936.00000000028D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.410733793.0000000003165000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameIdeaShareServiceB vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.379193800.00000000028D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.383264544.00000000028DA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.396995984.00000000030F0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameHW_H265dec6 vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.383926836.00000000028D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameqwindows.dll( vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.378196120.0000000002A2C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameDBGHELP.DLLj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382151499.00000000028D1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382220665.00000000028DD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.400345936.00000000030F6000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamelibsslH vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.381196191.00000000028D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.392115844.00000000030F4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamefr_plugin.dll( vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.379470944.00000000028DE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.383352636.00000000028DD000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.380699809.00000000028D4000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.381116835.00000000028D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.393786681.000000000342D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameHME_Vide.dllH vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.381444648.00000000030FF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382799277.00000000030FF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.382907422.00000000028DE000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.395560847.00000000030F1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameHME_Video_H264D.dllN vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.379719123.00000000028D1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameapisetstubj% vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.377544846.00000000028D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamevccorlib140.DLL^ vs IdeaShareKeyInstaller.exe
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.375307380.00000000030FF000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamemsvcp140.dll^ vs IdeaShareKeyInstaller.exe
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File read: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Jump to behavior
Source: IdeaShareKeyInstaller.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe C:\Users\user\Desktop\IdeaShareKeyInstaller.exe
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM FaultReport.exe
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM IdeaShareKey.exe
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill" /F /IM IdeaShareService.exe /FI "STATUS eq running
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM FaultReport.exe
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM IdeaShareKey.exe
Source: C:\Windows\SysWOW64\taskkill.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /delete /tn /f
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /xml C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.xml /tn IdeaShareServiceAt20230526130440
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe C:\Windows\system32\config\systemprofile\AppData\Local\IdeaShareKey\IdeaShareService.exe
Source: unknown Process created: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe "C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe" service
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Source: unknown Process created: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe "C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe" service
Source: unknown Process created: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe "C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe" service
Source: unknown Process created: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe "C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe" service
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM FaultReport.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM IdeaShareKey.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill" /F /IM IdeaShareService.exe /FI "STATUS eq running Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM FaultReport.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM IdeaShareKey.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /delete /tn /f Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /xml C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.xml /tn IdeaShareServiceAt20230526130440 Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = &quot;IdeaShareService.exe&quot;)
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\dllhost.exe WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\Temp\nsf94EB.tmp Jump to behavior
Source: classification engine Classification label: mal48.evad.winEXE@30/122@0/0
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011C34B0 CoCreateInstance, 11_2_011C34B0
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File read: C:\Users\desktop.ini Jump to behavior
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS DBVersionTab( VERSION_KEY VARCHAR(20) NOT NULL PRIMARY KEY, VERSION_VALUE VARCHAR(20));
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS ConnectRecordTab( IPADDRESS VARCHAR(64) NOT NULL PRIMARY KEY ON CONFLICT REPLACE, NAME VARCHAR(50) NOT NULL, RESERVED_INT1 INTEGER NOT NULL DEFAULT(0), RESERVED_INT2 INTEGER NOT NULL DEFAULT(0), RESERVED_INT3 INTEGER NOT NULL DEFAULT(0), RESERVED_STR1 VARCHAR(1024), RESERVED_STR2 VARCHAR(1024), RESERVED_STR3 VARCHAR(1024));INSERT OR REPLACE INTO ConnectRecordTab( IPADDRESS , NAME , RESERVED_INT1, RESERVED_INT2, RESERVED_INT3, RESERVED_STR1, RESERVED_STR2, RESERVED_STR3) VALUES ( ?, ?, ?, ?, ?, ?, ?, ? );UPDATE ConnectRecordTab SET NAME = ? ecs::ecsdata::UpdateConnectRecordCommand::ComposeSQLunknown type : WHERE IPADDRESS = ?ecs::ecsdata::UpdateConnectRecordCommand::BindDELETE FROM ConnectRecordTab WHERE IPADDRESS = ?ecs::ecsdata::RemoveConnectRecordCommand::ComposeSQL;ecs::ecsdata::RemoveConnectRecordCommand::Bindecs::ecsdata::RemoveConnectRecordCommand::RemoveByIPAddresscmd.changedSELECT * FROM ConnectRecordTabecs::ecsdata::ConnectRecordQuery::ComposeSQL ORDER BY rowid DESC;ecs::ecsdata::ConnectRecordQuery::BindT
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS ConnectRecordTab( IPADDRESS VARCHAR(64) NOT NULL PRIMARY KEY ON CONFLICT REPLACE, NAME VARCHAR(50) NOT NULL, RESERVED_INT1 INTEGER NOT NULL DEFAULT(0), RESERVED_INT2 INTEGER NOT NULL DEFAULT(0), RESERVED_INT3 INTEGER NOT NULL DEFAULT(0), RESERVED_STR1 VARCHAR(1024), RESERVED_STR2 VARCHAR(1024), RESERVED_STR3 VARCHAR(1024));
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT OR REPLACE INTO ConnectRecordTab( IPADDRESS , NAME , RESERVED_INT1, RESERVED_INT2, RESERVED_INT3, RESERVED_STR1, RESERVED_STR2, RESERVED_STR3) VALUES ( ?, ?, ?, ?, ?, ?, ?, ? );
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: INSERT OR REPLACE INTO DBVersionTab( VERSION_KEY, VERSION_VALUE) VALUES ( ?, ? );
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011C26B0 GetLastError,FormatMessageW,LocalFree, 11_2_011C26B0
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011C9D50 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,#316,#4815,#280,#1506, 11_2_011C9D50
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1840:120:WilError_01
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Mutant created: \Sessions\1\BaseNamedObjects\I
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1768:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:912:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4404:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6904:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5816:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5324:120:WilError_01
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File written: C:\Users\user\AppData\Local\IdeaShareKey\APConfig.ini Jump to behavior
Source: IdeaShareKeyInstaller.exe Static file information: File size 23716040 > 1048576
Source: IdeaShareKeyInstaller.exe Static PE information: certificate valid
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\ecscommon.pdb44$GCTL source: IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382694885.00000000028D9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\Work\Projects\Protocol_SpeedDown_AntiPulseLosePacket\src\service\build-win32\out\Release\rtp.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.400600363.00000000030F9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\service\build-win32\out\Release\tup_httptrans.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.403541817.00000000030FC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.377107158.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l1-2-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.379193800.00000000028D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-debug-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.378812758.00000000028D7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Network.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.363946159.00000000028D3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\TSDK_CodeHub\202109011027\src\service\build-win32\out\Release\tup_call_video.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\code\trunk\platform\securec\make\windows\securec\Release\securec.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.400816502.00000000030F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.381835390.00000000028DC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dbgcore.pdbGCTL source: IdeaShareKeyInstaller.exe, 00000000.00000003.378611056.00000000028DB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\ecsdata.pdb--#GCTL source: IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.380699809.00000000028D4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.362279958.00000000028D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp140.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.375307380.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\ecscommon.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.391603952.00000000030FD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\component\build-win32\out\Release\tup_dns.pdb--" source: IdeaShareKeyInstaller.exe, 00000000.00000003.402634591.00000000030F7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-profile-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.380850018.00000000028D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: E:\build\LOG_2_2_0_SCCEnc_CMC\code\current\publish\build\VS2017\Release\h265EncDll.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.392537309.0000000003288000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\component\build-win32\out\Release\tup_xml.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.404832548.00000000030F5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-time-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.383000586.00000000028DC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\TSDK_CodeHub\202109011027\src\service\build-win32\out\Release\tup_call_mediaservice.pdb88! source: IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\build\V2R8_H263Enc_WIN32_Vs2015\code\current\publish\Demo\Build\Vs2015\Release\HME_Video_H263E.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.394946980.00000000030FB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-handle-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.379470944.00000000028DE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\component\build-win32\out\Release\tup_commonlib.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.402422954.00000000030FC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.360183579.0000000002D18000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\mfc140.i386.pdbGCTL source: IdeaShareKeyInstaller.exe, 00000000.00000003.370656624.00000000028D9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: f:\binaries.x86ret\bin\i386\mfc110u.i386.pdbWT& source: IdeaShareKeyInstaller.exe, 00000000.00000003.368820894.00000000028DE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.380591258.00000000028DA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\BaseFrame\lib_vc9\ctk.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.391032334.00000000030FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mfc110.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.367217273.00000000028D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-localization-l1-2-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.380163936.00000000028D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\hwuc.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.397323334.00000000030FB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\component\build-win32\out\Release\tup_commonlib.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.402422954.00000000030FC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.380766046.00000000028DD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382332768.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\TSDK_CodeHub\202109011027\src\service\build-win32\out\Release\tup_call_video.pdb&& source: IdeaShareKeyInstaller.exe, 00000000.00000003.402141513.00000000030FC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vccorlib140.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.377544846.00000000028D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp140.i386.pdbGCTL source: IdeaShareKeyInstaller.exe, 00000000.00000003.375307380.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\ecsframework.pdb**# source: IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-process-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382578796.00000000028D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\component\build-win32\out\Release\tup_dns.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.402634591.00000000030F7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp110.i386.pdb0 source: IdeaShareKeyInstaller.exe, 00000000.00000003.374933296.00000000028D6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: vccorlib140.i386.pdbGCTL source: IdeaShareKeyInstaller.exe, 00000000.00000003.377544846.00000000028D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\build\TUP_Trunk_VersionCompile\code\current\tupci\service\faultreport\bin\release\fr_plugin.pdb$0 source: IdeaShareKeyInstaller.exe, 00000000.00000003.392115844.00000000030F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.379719123.00000000028D1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\build\V2R8_H263Dec_WIN32_Vs2015\code\current\publish\Demo\Build\Vs2015\Release\HME_Video_H263D.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.394690833.00000000030F8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: f:\binaries.x86ret\bin\i386\mfc110u.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.368820894.00000000028DE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.383926836.00000000028D8000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\ecsframework.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.391910127.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382053407.00000000028D3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-string-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382907422.00000000028DE000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382151499.00000000028D1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\service\build-win32\out\Release\tup_login.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.404028040.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -O2 -DL_ENDIAN -DOPENSSL_PIC -D_FORTIFY_SOURCE=2 source: IdeaShareKeyInstaller.exe, 00000000.00000003.398238612.000000000325A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382799277.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\target\ideasharekey\bin\Release\IdeaShareKey.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.385688768.0000000003261000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\build\LOG_1_2_0_SCCDec_CMC\code\current\publish\Build\VS2015\HW_H265dec_Win32D.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.396995984.00000000030F0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-downlevel-kernel32-l2-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.383264544.00000000028DA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\tr6Bugfix_nico\service\build-win32\out\Release\tup_exception.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.402876050.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-synch-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.381196191.00000000028D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcr100.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.375798038.00000000028DA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\AirPresence\desktop\Windows\AirPresenceMonitor\Release\IdeaShareService.pdb source: IdeaShareService.exe, 00000019.00000000.447529528.00000000011CD000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.378928716.00000000028D7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: API-MS-Win-Eventing-Provider-L1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.383352636.00000000028DD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\hwuc.pdbVV)GCTL source: IdeaShareKeyInstaller.exe, 00000000.00000003.397323334.00000000030FB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: @ compiler: cl /Zi /Fdossl_static.pdb /Gs0 /GF /Gy /MD /W3 /wd4090 /nologo /O2 -O2 -DL_ENDIAN -DOPENSSL_PIC -D_FORTIFY_SOURCE=2OpenSSL 1.1.1f 31 Mar 2020in order to bep, build date is removeplatform: VC-WIN32OPENSSLDIR: "C:\Program Files (x86)\Common Files\SSL"ENGINESDIR: "D:\share_lin\030606_codehub_win32\open_src_build\openssl\release\lib\engines-1_1"not available source: IdeaShareKeyInstaller.exe, 00000000.00000003.398238612.000000000325A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbQ source: IdeaShareKeyInstaller.exe, 00000000.00000003.360183579.0000000002D18000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\030606_codehub_win32\open_src_build\openssl\libssl-1_1.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.400345936.00000000030F6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-security-base-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.383493651.00000000028D5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.381757085.00000000028DC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ucrtbase.pdbUGP source: IdeaShareKeyInstaller.exe, 00000000.00000003.377107158.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\MFCM140U.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.374720041.00000000028DC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\build\TUP_Trunk_VersionCompile\code\current\tupci\service\faultreport\bin\release\fr_plugin.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.392115844.00000000030F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\build\LOG_iMedia_Video1_2_0_H264Dec\code\current\publish\Build\Vs2015\HME_Video_H264D\Release\HME_Video_H264D.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.395560847.00000000030F1000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\MFCM140.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.374567471.00000000028DB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\app code\airpresence_2\desktop\SDK\OpenSourceCode\ACE\include\lib\ACE.pdb^ source: IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcp110.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.374933296.00000000028D6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\ServiceComponent\lib_vc9\Release\ecsdata.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.391757771.00000000030F3000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\code\windows-bainyi\0927\HMEV2012\build\vc2015\Release\HME_Video.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.393786681.000000000342D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\mfc140u.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.373146232.00000000028D6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\0306_codehub\src\service\build-win32\out\Release\tup_login.pdb==" source: IdeaShareKeyInstaller.exe, 00000000.00000003.404028040.00000000030F2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: msvcr110.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.376314713.00000000028D4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\code\windows-bainyi\0927\HMEV2012\build\vc2015\Release\HME_Video.pdbD source: IdeaShareKeyInstaller.exe, 00000000.00000003.393786681.000000000342D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\target\ideasharekey\bin\Release\IdeaShareKey.pdbII." source: IdeaShareKeyInstaller.exe, 00000000.00000003.385688768.0000000003261000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\app code\airpresence_2\desktop\SDK\OpenSourceCode\ACE\include\lib\ACE.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.388827825.00000000030F9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-crt-math-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.382220665.00000000028DD000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: dbgcore.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.378611056.00000000028DB000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\030606_codehub_win32\open_src_build\openssl\libssl-1_1.pdbAA source: IdeaShareKeyInstaller.exe, 00000000.00000003.400345936.00000000030F6000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.381444648.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-string-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.381116835.00000000028D0000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-file-l2-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.379308667.00000000028DC000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.379938356.00000000028D7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\TSDK_CodeHub\202109011027\src\service\build-win32\out\Release\tup_call_mediaservice.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.401492865.00000000030F4000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\tr6Bugfix_nico\service\build-win32\out\Release\tup_exception.pdb,," source: IdeaShareKeyInstaller.exe, 00000000.00000003.402876050.00000000030FF000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\AirPresence\desktop\Windows\AirPresenceMonitor\Release\IdeaShareService.pdb991GCTL source: IdeaShareService.exe, 00000019.00000000.447529528.00000000011CD000.00000002.00000001.01000000.00000008.sdmp
Source: Binary string: mfc110.i386.pdbP) source: IdeaShareKeyInstaller.exe, 00000000.00000003.367217273.00000000028D2000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\mfc140.i386.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.370656624.00000000028D9000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\share_lin\030606_codehub_win32\open_src_build\openssl\libcrypto-1_1.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.398238612.00000000032A7000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\jenkins\component\workspace\IdeaHub_Component_IdeaShare\AirPresence\desktop\SDK\BaseFrame\lib_vc9\ctk.pdbaa# source: IdeaShareKeyInstaller.exe, 00000000.00000003.391032334.00000000030FA000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: IdeaShareKeyInstaller.exe, 00000000.00000003.365225488.00000000028DE000.00000004.00000020.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011CB8A6 push ecx; ret 11_2_011CB8B9
PE file contains sections with non-standard names
Source: HME_Video_H264D.dll.0.dr Static PE information: section name: .rodata
Source: HME_Video_H264E.dll.0.dr Static PE information: section name: .rodata
Source: zlib.dll.0.dr Static PE information: section name: .00cfg
Source: HME_Video_Srtp_ALG.dll.0.dr Static PE information: section name: .00cfg
Source: ideasharesdk.dll.0.dr Static PE information: section name: .00cfg
Source: libcrypto-1_1.dll.0.dr Static PE information: section name: .00cfg
Source: mfc140.dll.0.dr Static PE information: section name: .didat
Source: mfc140u.dll.0.dr Static PE information: section name: .didat
Source: libssl-1_1.dll.0.dr Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr Static PE information: section name: .didat
Source: vccorlib140.dll.0.dr Static PE information: section name: minATL
Source: vcruntime140.dll.0.dr Static PE information: section name: _RDATA
Source: dbghelp.dll.0.dr Static PE information: section name: .didat
Source: dbghelp.dll.0.dr Static PE information: section name: .mrdata
Source: dbgcore.dll.0.dr Static PE information: section name: .mrdata
Source: qwindows.dll.0.dr Static PE information: section name: .qtmetad
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011C22D0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 11_2_011C22D0
Binary contains a suspicious time stamp
Source: ucrtbase.dll.0.dr Static PE information: 0x9E3394C7 [Sun Feb 8 16:22:31 2054 UTC]
Source: initial sample Static PE information: section name: .text entropy: 6.823101947927201
Source: initial sample Static PE information: section name: .text entropy: 6.9169969425576285
Source: initial sample Static PE information: section name: .text entropy: 6.9113720938783825
Drops PE files
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H264D.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\Temp\nsv954A.tmp\nsExec.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-io-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\QtSingleApp.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\ecsframework.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\zlib.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareKey.exe Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\tup_login.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\mfc110u.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-localization-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\tup_msg.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\vccorlib140.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\tup_call_mediaservice.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\libcrypto-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\uninst.exe Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\tup_xml.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\Temp\nsv954A.tmp\UserInfo.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\tup_dns.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-security-base-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_pse.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-eventing-provider-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\ctk.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\tup_os_adapter.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\ecsdata.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\tup_air_client.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\tup_publiclib.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\HW_H265dec_Win32D.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\hwuc.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H263D.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\dbghelp.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H264E.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\securec.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\mfcm140.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Core.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\vcruntime140.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_ssl.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\tup_commonlib.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\FaultReport.exe Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\tup_call_video.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\concrt140.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_Srtp_ALG.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Gui.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_crypto.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\msvcr110.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\msvcp110.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\Temp\nsv954A.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\ecscommon.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Network.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H263E.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\mfc110.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-localregistry-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\rtp.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\fr_plugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_osal.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\tup_httptrans.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\mfcm140u.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\Temp\nsv954A.tmp\FindProcDLL.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\msvcp140.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\h265EncDll.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\dbgcore.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\mfc140.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\ideasharesdk.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\tup_exception.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\tup_rtp.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\mfc140u.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Widgets.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\ucrtbase.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\ACE.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-downlevel-kernel32-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\tup_https_clt.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\msvcr100.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe File created: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-misc-l1-1-0.dll Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /delete /tn /f
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run IdeaShareKey Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run IdeaShareKey Jump to behavior
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011C5D60 IsIconic, 11_2_011C5D60
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011C22D0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 11_2_011C22D0
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\conhost.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H264D.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-handle-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-multibyte-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-libraryloader-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-profile-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-file-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-io-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\QtSingleApp.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-interlocked-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\ecsframework.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-sysinfo-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-processthreads-l1-1-1.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-conio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\zlib.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareKey.exe Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\tup_login.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\mfc110u.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-localization-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\tup_msg.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-debug-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\vccorlib140.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\tup_call_mediaservice.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\libcrypto-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\uninst.exe Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\tup_xml.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\tup_dns.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-security-base-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_pse.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-eventing-provider-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-localization-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-runtime-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\ctk.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-timezone-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-processenvironment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\tup_os_adapter.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\ecsdata.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-rtlsupport-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\tup_air_client.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\HW_H265dec_Win32D.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\tup_publiclib.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-process-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H263D.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\hwuc.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-file-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H264E.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\securec.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\mfcm140.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Core.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_ssl.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\tup_commonlib.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\FaultReport.exe Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\tup_call_video.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\concrt140.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_Srtp_ALG.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Gui.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_crypto.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\msvcp110.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\msvcr110.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\ecscommon.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-synch-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Network.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-filesystem-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\HME_Video_H263E.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\mfc110.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-localregistry-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\rtp.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-math-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-environment-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-file-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-time-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-convert-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\fr_plugin.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-util-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-processthreads-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\libipsi_osal.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\tup_httptrans.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\mfcm140u.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-locale-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\libssl-1_1.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\h265EncDll.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\platforms\qwindows.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-memory-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-synch-l1-2-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-errorhandling-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\mfc140.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\ideasharesdk.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\tup_exception.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-private-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\tup_rtp.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-stdio-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\Qt5Widgets.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\ACE.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-utility-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\tup_https_clt.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-downlevel-kernel32-l2-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-string-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-crt-heap-l1-1-0.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\msvcr100.dll Jump to dropped file
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\IdeaShareKey\api-ms-win-core-misc-l1-1-0.dll Jump to dropped file
Contains functionality to read device registry values (via SetupAPI)
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011C11B0 hid_enumerate,hid_init,SetupDiGetClassDevsA,SetupDiEnumDeviceInterfaces,SetupDiGetDeviceInterfaceDetailA,malloc,SetupDiGetDeviceInterfaceDetailA,SetupDiEnumDeviceInfo,SetupDiGetDeviceRegistryPropertyA,SetupDiGetDeviceRegistryPropertyA,calloc,calloc,strncpy_s,_wcsdup,_wcsdup,_wcsdup,strstr,strtol,CloseHandle,free,SetupDiDestroyDeviceInfoList, 11_2_011C11B0
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process information queried: ProcessInformation Jump to behavior
Source: IdeaShareKeyInstaller.exe, 00000000.00000002.412809253.0000000000409000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: %d,%d,%d,%d,%d,%dkernel32.dllGetProductInfovmware%u,%u,%uc:\%d,%d,%d,%u~MHzHARDWARE\DESCRIPTION\System\CentralProcessor\0\%u,%u,%u,%u,%s
Source: IdeaShareKeyInstaller.exe, 00000000.00000002.412809253.0000000000409000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: vmware
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.362279958.00000000028D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .?AVQEmulationPaintEngine@@L
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.362279958.00000000028D0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: .?AVQEmulationPaintEngine@@
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011CBFCB IsDebuggerPresent,OutputDebugStringW, 11_2_011CBFCB
Contains functionality to dynamically determine API calls
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011C22D0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 11_2_011C22D0
Enables debug privileges
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011C62D0 SetUnhandledExceptionFilter,#286,#10472,WTSRegisterSessionNotification,#286, 11_2_011C62D0
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011CB7AD SetUnhandledExceptionFilter, 11_2_011CB7AD
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011CB61A IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 11_2_011CB61A
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011CAE8E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 11_2_011CAE8E

HIPS / PFW / Operating System Protection Evasion
barindex
DLL side loading technique detected
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: C:\Windows\SysWOW64\dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: C:\Windows\SysWOW64\dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: C:\Windows\SysWOW64\dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: C:\Windows\SysWOW64\dbghelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe Section loaded: C:\Windows\SysWOW64\dbghelp.dll Jump to behavior
Uses taskkill to terminate processes
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM FaultReport.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM IdeaShareKey.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill" /F /IM IdeaShareService.exe /FI "STATUS eq running Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM FaultReport.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM IdeaShareKey.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM FaultReport.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM IdeaShareKey.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe taskkill" /F /IM IdeaShareService.exe /FI "STATUS eq running Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM FaultReport.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\taskkill.exe "taskkill" /F /T /IM IdeaShareKey.exe Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /delete /tn /f Jump to behavior
Source: C:\Users\user\Desktop\IdeaShareKeyInstaller.exe Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /xml C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.xml /tn IdeaShareServiceAt20230526130440 Jump to behavior
Source: IdeaShareKeyInstaller.exe, 00000000.00000003.393786681.000000000342D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Shell_TrayWndplayCWmpProgmanPlayWndBaseQiyiWMPXLUEFramehme_engine::H265E_log..\..\open_src\src\video_coding\codecs\h265\h265_soft_coenc\h265_soft_encoder.ccBDUIDialogH265 SoftEnc_LogH265EncodingThreadhme_engine::H265SoftEncoder::Releasevsprintf_s failedH265 SoftEnc_Log : %s H265E_Create Failedhme_engine::H265SoftEncoder::InitEncodeH265E_Delete Failed! Return Code:0x%xhme_engine::H265SoftEncoder::ResetH265E_GetVersion Failed! Return Code:0x%xHME_H265E_SetParams Failed! Return Code:0x%xinst->maxBitrate:%d,inst->startBitrate:%dh265 enc release failed!EncodingProcesshme_engine::H265SoftEncoder::EncodingProcess_bTransformSkipOn %d,_bSkipStaticFrameOn %d,_iTemporallayerNum:%dhme_engine::H265SoftEncoder::EncodeH265E_SetParams fail! iImgWidth[%d] > iImgHeight[%d]iInitQP %d iMaxQP %dsame frame HME_H265E_CreatestInArgs.stforegroundWindow
Queries device information via Setup API
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011C11B0 hid_enumerate,hid_init,SetupDiGetClassDevsA,SetupDiEnumDeviceInterfaces,SetupDiGetDeviceInterfaceDetailA,malloc,SetupDiGetDeviceInterfaceDetailA,SetupDiEnumDeviceInfo,SetupDiGetDeviceRegistryPropertyA,SetupDiGetDeviceRegistryPropertyA,calloc,calloc,strncpy_s,_wcsdup,_wcsdup,_wcsdup,strstr,strtol,CloseHandle,free,SetupDiDestroyDeviceInfoList, 11_2_011C11B0
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011CB9BC cpuid 11_2_011CB9BC
Source: C:\Users\user\AppData\Local\IdeaShareKey\IdeaShareService.exe Code function: 11_2_011CB509 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 11_2_011CB509
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 876179 Sample: IdeaShareKeyInstaller.exe Startdate: 26/05/2023 Architecture: WINDOWS Score: 48 6 IdeaShareKeyInstaller.exe 4 147 2->6         started        10 IdeaShareService.exe 2->10         started        12 IdeaShareService.exe 2->12         started        14 2 other processes 2->14 file3 39 C:\Users\user\AppData\Local\...\nsExec.dll, PE32 6->39 dropped 41 C:\Users\user\AppData\Local\...\UserInfo.dll, PE32 6->41 dropped 43 C:\Users\user\AppData\Local\...\System.dll, PE32 6->43 dropped 45 110 other files (none is malicious) 6->45 dropped 49 Uses schtasks.exe or at.exe to add and modify task schedules 6->49 16 taskkill.exe 1 6->16         started        19 taskkill.exe 1 6->19         started        21 taskkill.exe 1 6->21         started        23 7 other processes 6->23 signatures4 process5 signatures6 47 DLL side loading technique detected 16->47 25 conhost.exe 16->25         started        27 conhost.exe 19->27         started        29 conhost.exe 21->29         started        31 conhost.exe 23->31         started        33 conhost.exe 23->33         started        35 conhost.exe 23->35         started        37 conhost.exe 23->37         started        process7
⊘No contacted IP infos