Edit tour

Windows Analysis Report
X18flXFlh9.html

Overview

General Information

Sample Name:	X18flXFlh9.html
Analysis ID:	673556
MD5:	5cb20a0bfc5e3e2ae8398b1840adf7ae
SHA1:	fdae22f8af65bb0af48d3f4413e9ed4d6e815f9c
SHA256:	f5c16248418a4f1fd8dff438b26b8da7f587b77db9e180a82493bae140893687
Infos:

Detection

CryptOne, Qbot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Html Dropper

Phishing site detected (based on favicon image match)

Yara detected Qbot

Multi AV Scanner detection for submitted file

Yara detected CryptOne packer

Antivirus / Scanner detection for submitted sample

Maps a DLL or memory area into another process

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses 7zip to decompress a password protected archive

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

PE file contains sections with non-standard names

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Found inlined nop instructions (likely shell or obfuscated code)

Drops PE files

Tries to load missing DLLs

Found evasive API chain checking for process token information

Contains capabilities to detect virtual machines

Registers a DLL

Spawns drivers

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5812 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 2300 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,3277957915204753751,12551285156102164536,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

chrome.exe (PID: 6228 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1536,3277957915204753751,12551285156102164536,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5360 /prefetch:8 MD5: C139654B5C1438A95B321BB01AD63EF6)

unarchiver.exe (PID: 6464 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\TXRTN_2636021.zip MD5: 9DE2E060A2985A232D8B96F9EC847A19)

7za.exe (PID: 6692 cmdline: C:\Windows\System32\7za.exe" x -pabc321 -y -o"C:\Users\user\AppData\Local\Temp\3lluphv4.sov" "C:\Users\user\Downloads\TXRTN_2636021.zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6544 cmdline: cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 5772 cmdline: powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso" MD5: DBA3E6449E97D4E3DF64527EF7012A10)

cmd.exe (PID: 1016 cmdline: "C:\Windows\System32\cmd.exe" /q /c calc.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

calc.exe (PID: 5940 cmdline: calc.exe MD5: 60B7C0FEAD45F2066E5B805A91F4F0FC)

regsvr32.exe (PID: 7140 cmdline: C:\Windows\SysWOW64\regsvr32.exe 102755.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

svchost.exe (PID: 6792 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

explorer.exe (PID: 6792 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 166AB1B9462E5C1D6D18EC5EC0B6A5F7)

chrome.exe (PID: 920 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\X18flXFlh9.html MD5: C139654B5C1438A95B321BB01AD63EF6)

udfs.sys (PID: 4 cmdline: MD5: 6A442723D4D05D9F15D24C9942CDA00D)

cleanup

Malware Configuration

Threatname: Qbot

{"Bot id": "obama200", "Campaign": "1657548298", "Version": "403.780", "C2 list": ["172.115.177.204:2222", "89.101.97.139:443", "186.90.153.162:2222", "38.70.253.226:2222", "120.150.218.241:995", "72.252.157.93:995", "72.252.157.93:993", "94.36.193.176:2222", "47.23.89.60:993", "89.211.209.234:2222", "76.25.142.196:443", "46.100.25.239:61202", "24.158.23.166:995", "69.14.172.24:443", "92.132.132.81:2222", "37.34.253.233:443", "93.48.80.198:995", "174.80.15.101:2083", "24.178.196.158:2222", "197.89.20.137:443", "66.230.104.103:443", "177.94.65.26:32101", "208.107.221.224:443", "100.38.242.113:995", "24.55.67.176:443", "40.134.246.185:995", "24.139.72.117:443", "74.14.5.179:2222", "67.209.195.198:443", "148.64.96.100:443", "217.128.122.65:2222", "196.203.37.215:80", "47.180.172.159:443", "32.221.224.140:995", "117.248.109.38:21", "70.46.220.114:443", "176.45.218.138:995", "94.59.15.180:2222", "84.241.8.23:32103", "81.158.239.251:2078", "179.158.105.44:443", "104.34.212.7:32103", "41.228.22.180:443", "217.165.157.202:995", "109.12.111.14:443", "67.165.206.193:993", "111.125.245.116:995", "1.161.79.116:443", "1.161.79.116:995", "81.193.30.90:443", "103.133.11.10:995", "174.69.215.101:443", "173.21.10.71:2222", "197.94.75.223:443", "45.46.53.140:2222", "96.37.113.36:993", "120.61.3.142:443", "182.52.159.24:443", "190.252.242.69:443", "187.172.164.12:443", "201.172.23.72:2222", "70.51.137.244:2222", "37.208.131.49:50010", "173.174.216.62:443", "103.246.242.202:443", "72.252.157.93:990", "63.143.92.99:995", "106.51.48.188:50001", "182.191.92.203:995", "86.97.246.166:1194", "121.7.223.45:2222", "67.69.166.79:2222", "47.156.129.52:443", "82.41.63.217:443", "37.186.58.99:995", "45.241.254.69:993", "39.49.41.221:995", "88.240.59.52:443", "39.44.60.200:995", "86.97.10.37:443", "86.98.157.114:993", "39.52.59.221:995", "39.41.16.210:995", "86.97.246.166:2222", "86.213.75.30:2078", "39.57.56.11:995", "24.43.99.75:443", "101.50.67.155:995", "108.56.213.219:995", "189.253.167.141:443", "5.32.41.45:443", "177.189.180.214:32101", "39.53.124.57:995", "80.11.74.81:2222", "41.84.224.109:443", "103.116.178.85:995", "209.15.76.228:443", "184.97.29.26:443", "102.65.60.92:443", "39.52.221.9:995"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
X18flXFlh9.html	JoeSecurity_HtmlDropper	Yara detected Html Dropper	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000025.00000000.512646528.0000000002590000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
0000001D.00000002.514585055.0000000002C90000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
0000001D.00000002.514467624.0000000002C40000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
0000001D.00000002.514983912.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
0000001D.00000002.514983912.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
37.0.explorer.exe.2590000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
29.2.regsvr32.exe.2c40000.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
29.2.regsvr32.exe.2c90000.2.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
29.2.regsvr32.exe.2c90000.2.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
37.0.explorer.exe.2590000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
29.2.regsvr32.exe.2c40000.1.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
29.2.regsvr32.exe.4bc0184.3.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
37.2.explorer.exe.2590000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
29.2.regsvr32.exe.4bc0184.3.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
37.2.explorer.exe.2590000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 5 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: X18flXFlh9.html

Virustotal: Detection: 40%

Perma Link

Antivirus / Scanner detection for submitted sample

Source: X18flXFlh9.html

Avira: detected

Source: 37.0.explorer.exe.2590000.0.unpack

Malware Configuration Extractor: Qbot {"Bot id": "obama200", "Campaign": "1657548298", "Version": "403.780", "C2 list": ["172.115.177.204:2222", "89.101.97.139:443", "186.90.153.162:2222", "38.70.253.226:2222", "120.150.218.241:995", "72.252.157.93:995", "72.252.157.93:993", "94.36.193.176:2222", "47.23.89.60:993", "89.211.209.234:2222", "76.25.142.196:443", "46.100.25.239:61202", "24.158.23.166:995", "69.14.172.24:443", "92.132.132.81:2222", "37.34.253.233:443", "93.48.80.198:995", "174.80.15.101:2083", "24.178.196.158:2222", "197.89.20.137:443", "66.230.104.103:443", "177.94.65.26:32101", "208.107.221.224:443", "100.38.242.113:995", "24.55.67.176:443", "40.134.246.185:995", "24.139.72.117:443", "74.14.5.179:2222", "67.209.195.198:443", "148.64.96.100:443", "217.128.122.65:2222", "196.203.37.215:80", "47.180.172.159:443", "32.221.224.140:995", "117.248.109.38:21", "70.46.220.114:443", "176.45.218.138:995", "94.59.15.180:2222", "84.241.8.23:32103", "81.158.239.251:2078", "179.158.105.44:443", "104.34.212.7:32103", "41.228.22.180:443", "217.165.157.202:995", "109.12.111.14:443", "67.165.206.193:993", "111.125.245.116:995", "1.161.79.116:443", "1.161.79.116:995", "81.193.30.90:443", "103.133.11.10:995", "174.69.215.101:443", "173.21.10.71:2222", "197.94.75.223:443", "45.46.53.140:2222", "96.37.113.36:993", "120.61.3.142:443", "182.52.159.24:443", "190.252.242.69:443", "187.172.164.12:443", "201.172.23.72:2222", "70.51.137.244:2222", "37.208.131.49:50010", "173.174.216.62:443", "103.246.242.202:443", "72.252.157.93:990", "63.143.92.99:995", "106.51.48.188:50001", "182.191.92.203:995", "86.97.246.166:1194", "121.7.223.45:2222", "67.69.166.79:2222", "47.156.129.52:443", "82.41.63.217:443", "37.186.58.99:995", "45.241.254.69:993", "39.49.41.221:995", "88.240.59.52:443", "39.44.60.200:995", "86.97.10.37:443", "86.98.157.114:993", "39.52.59.221:995", "39.41.16.210:995", "86.97.246.166:2222", "86.213.75.30:2078", "39.57.56.11:995", "24.43.99.75:443", "101.50.67.155:995", "108.56.213.219:995", "189.253.167.141:443", "5.32.41.45:443", "177.189.180.214:32101", "39.53.124.57:995", "80.11.74.81:2222", "41.84.224.109:443", "103.116.178.85:995", "209.15.76.228:443", "184.97.29.26:443", "102.65.60.92:443", "39.52.221.9:995"]}

Phishing

Phishing site detected (based on favicon image match)

Source: file:///C:/Users/user/Desktop/X18flXFlh9.html

Matcher: Template: adobe matched with high similarity

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\5812_1385192279\LICENSE.txt

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source:	Binary string: amstream.pdb source: explorer.exe, 00000025.00000003.593399582.00000000044B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: widevinecdm.dll.pdb source: widevinecdm.dll.0.dr
Source:	Binary string: calc.pdb source: TXRTN_2636021.iso.8.dr
Source:	Binary string: widevinecdm.dll.pdb@ source: widevinecdm.dll.0.dr
Source:	Binary string: amstream.pdbGCTL source: explorer.exe, 00000025.00000003.593399582.00000000044B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: calc.pdb6/ source: TXRTN_2636021.iso.8.dr

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 37_2_0259C053 FindFirstFileW,FindNextFileW,

37_2_0259C053

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01800B1Ch	6_2_018002C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 018011B7h	6_2_018002C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01801969h	6_2_0180172F
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01800B1Ch	6_2_01800AB7
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01800B1Ch	6_2_018002B9
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 4x nop then jmp 01800B1Ch	6_2_01800A7C

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757

Source: Ruleset Data.0.dr	String found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr, Ruleset Data.0.dr	String found in binary or memory: www.facebook.com/ajax/ads/ equals www.facebook.com (Facebook)
Source: Filtering Rules.0.dr	String found in binary or memory: www.facebook.com0 equals www.facebook.com (Facebook)

Source: widevinecdm.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	String found in binary or memory: http://llvm.org/):
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: widevinecdm.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://accounts.google.com
Source: craw_window.js.0.dr	String found in binary or memory: https://accounts.google.com/MergeSession
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://apis.google.com
Source: pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-clang.git
Source: pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://chromium.googlesource.com/a/native_client/pnacl-llvm.git
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.0.dr, manifest.json.0.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry
Source: pnacl_public_x86_64_ld_nexe.0.dr	String found in binary or memory: https://code.google.com/p/nativeclient/issues/entry%s:
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/.
Source: LICENSE.txt.0.dr	String found in binary or memory: https://creativecommons.org/compatiblelicenses
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 795fee26-e9c4-4fce-9494-bb4d678dd337.tmp.2.dr, d7026b31-c03f-44a6-9299-7ef70cac7f56.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://dns.google
Source: LICENSE.txt.0.dr	String found in binary or memory: https://easylist.to/)
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://fonts.googleapis.com
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://fonts.gstatic.com
Source: X18flXFlh9.html	String found in binary or memory: https://getbootstrap.com/)
Source: LICENSE.txt.0.dr	String found in binary or memory: https://github.com/easylist)
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p
Source: X18flXFlh9.html	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://ogs.google.com
Source: craw_window.js.0.dr, manifest.json0.0.dr	String found in binary or memory: https://payments.google.com/payments/v4/js/integrator.js
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://play.google.com
Source: 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://r5---sn-h0jeln7l.gvt1.com
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://redirector.gvt1.com
Source: craw_window.js.0.dr, manifest.json0.0.dr	String found in binary or memory: https://sandbox.google.com/payments/v4/js/integrator.js
Source: explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://ssl.gstatic.com
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/a?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/d?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/l?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/4b3e87/000000000000000000017706/27/a?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/4b3e87/000000000000000000017706/27/d?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/4b3e87/000000000000000000017706/27/l?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/a?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/d?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/l?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/a2527e/000000000000000000017704/27/a?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/a2527e/000000000000000000017704/27/d?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/a2527e/000000000000000000017704/27/l?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/a?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/d?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/l?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/a?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/d?primer=0635fba006f1437d962ae878ad04a
Source: X18flXFlh9.html	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/l?primer=0635fba006f1437d962ae878ad04a
Source: craw_window.js.0.dr, craw_background.js.0.dr	String found in binary or memory: https://www-googleapis-staging.sandbox.google.com
Source: widevinecdm.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://www.google.com
Source: manifest.json0.0.dr	String found in binary or memory: https://www.google.com/
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/accounts/OAuthLogin?issueuberauth=1
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/cleardot.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/dot2.gif
Source: craw_window.js.0.dr	String found in binary or memory: https://www.google.com/images/x2.gif
Source: craw_background.js.0.dr	String found in binary or memory: https://www.google.com/intl/en-US/chrome/blank.html
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, craw_window.js.0.dr, craw_background.js.0.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://www.googleapis.com
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/chromewebstore.readonly
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierra
Source: manifest.json0.0.dr	String found in binary or memory: https://www.googleapis.com/auth/sierrasandbox
Source: e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	String found in binary or memory: https://www.gstatic.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: global traffic

HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfmX-Goog-Update-Updater: chromecrx-85.0.4183.121Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en-US;q=0.9,en;q=0.8

Source: calc.exe, 0000001C.00000002.362050585.000000000160A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Uses 7zip to decompress a password protected archive

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pabc321 -y -o"C:\Users\user\AppData\Local\Temp\3lluphv4.sov" "C:\Users\user\Downloads\TXRTN_2636021.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pabc321 -y -o"C:\Users\user\AppData\Local\Temp\3lluphv4.sov" "C:\Users\user\Downloads\TXRTN_2636021.zip			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 6_2_018002C8	6_2_018002C8
Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 6_2_018002B9	6_2_018002B9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BD2D49	29_2_04BD2D49
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BD2144	29_2_04BD2144
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BD7A04	29_2_04BD7A04
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BD5B14	29_2_04BD5B14
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BD5B0A	29_2_04BD5B0A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025A2BC0	37_2_025A2BC0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025A37C5	37_2_025A37C5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025A8480	37_2_025A8480
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025A694F	37_2_025A694F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025A6590	37_2_025A6590

Source: C:\Windows\SysWOW64\regsvr32.exe

Process Stats: CPU usage > 98%

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll

Source: unknown

Driver loaded: C:\Windows\System32\drivers\udfs.sys

Source: X18flXFlh9.html

Virustotal: Detection: 40%

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,3277957915204753751,12551285156102164536,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\X18flXFlh9.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1536,3277957915204753751,12551285156102164536,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5360 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\TXRTN_2636021.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pabc321 -y -o"C:\Users\user\AppData\Local\Temp\3lluphv4.sov" "C:\Users\user\Downloads\TXRTN_2636021.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso"
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /q /c calc.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: \Device\CdRom1\calc.exe calc.exe
Source: \Device\CdRom1\calc.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe 102755.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,3277957915204753751,12551285156102164536,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1536,3277957915204753751,12551285156102164536,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5360 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\TXRTN_2636021.zip	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pabc321 -y -o"C:\Users\user\AppData\Local\Temp\3lluphv4.sov" "C:\Users\user\Downloads\TXRTN_2636021.zip	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /q /c calc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: \Device\CdRom1\calc.exe calc.exe
Source: \Device\CdRom1\calc.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe 102755.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-62DFE4D6-16B4.pma

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\36993d0a-d052-46f9-8c4f-49e73b36ae2f.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.phis.troj.evad.winHTML@58/155@5/5

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 37_2_0259E6BA CoInitializeEx,CoInitializeSecurity,CoCreateInstance,SysAllocString,CoSetProxyBlanket,

37_2_0259E6BA

Source: C:\Windows\SysWOW64\unarchiver.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 37_2_0259BBFE CreateToolhelp32Snapshot,GetLastError,Module32First,FindCloseChangeNotification,

37_2_0259BBFE

Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\{40BD53C5-F1C2-4E4A-A5FA-ED026CBE0097}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6780:120:WilError_01
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{0654D8EC-547D-4BE4-8AE5-B3F73A085762}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5244:120:WilError_01
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\{0654D8EC-547D-4BE4-8AE5-B3F73A085762}

Source: C:\Windows\SysWOW64\regsvr32.exe

Process created: C:\Windows\SysWOW64\explorer.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: X18flXFlh9.html

Static file information: File size 1174226 > 1048576

Source:	Binary string: amstream.pdb source: explorer.exe, 00000025.00000003.593399582.00000000044B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: widevinecdm.dll.pdb source: widevinecdm.dll.0.dr
Source:	Binary string: calc.pdb source: TXRTN_2636021.iso.8.dr
Source:	Binary string: widevinecdm.dll.pdb@ source: widevinecdm.dll.0.dr
Source:	Binary string: amstream.pdbGCTL source: explorer.exe, 00000025.00000003.593399582.00000000044B6000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: calc.pdb6/ source: TXRTN_2636021.iso.8.dr

Data Obfuscation

Yara detected Html Dropper

Source: Yara match

File source: X18flXFlh9.html, type: SAMPLE

Source: C:\Windows\SysWOW64\unarchiver.exe	Code function: 6_2_02F300CC push esp; ret	6_2_02F300CD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BE0990 push edx; ret	29_2_04BE1450
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BDBEE1 push esi; iretd	29_2_04BDBEE6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BDA100 push cs; iretd	29_2_04BDA1D6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BDA202 push cs; iretd	29_2_04BDA1D6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BDEA5C push eax; iretd	29_2_04BDEA5D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 29_2_04BDA3B2 push ebx; ret	29_2_04BDA3B3
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025AAE7E push cs; iretd	37_2_025AAE52
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025ACB5D push esi; iretd	37_2_025ACB62
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025AB02E push ebx; ret	37_2_025AB02F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 37_2_025AAD7C push cs; iretd	37_2_025AAE52

Source: widevinecdm.dll.0.dr	Static PE information: section name: .00cfg
Source: widevinecdm.dll.0.dr	Static PE information: section name: .rodata
Source: widevinecdm.dll.0.dr	Static PE information: section name: _RDATA

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 37_2_0259F175 LoadLibraryA,GetProcAddress,

37_2_0259F175

Source: \Device\CdRom1\calc.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe 102755.dll

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\5812_1451044779\_platform_specific\win_x64\widevinecdm.dll

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Temp\5812_1385192279\LICENSE.txt

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\SysWOW64\regsvr32.exe

Memory written: PID: 6792 base: 1CF380 value: E9 63 6E 3C 02

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMPORTREC.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE%
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: explorer.exe, 00000025.00000003.595290107.00000000046CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6876	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6484	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1404	Thread sleep count: 8503 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6808	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_37-12809

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8503			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 9998

Source: C:\Windows\SysWOW64\explorer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_37-11389

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\1.1\Hyper-V.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\Hyper-V.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\Hyper-V.psm1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\Hyper-V.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\2.0.0.0\Hyper-V.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\Hyper-V.cdxml	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\Hyper-V.xaml	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened / queried: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Hyper-V\Hyper-V.psd1	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 6_2_0117B29A GetSystemInfo,

6_2_0117B29A

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 37_2_0259C053 FindFirstFileW,FindNextFileW,

37_2_0259C053

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 37_2_0259F175 LoadLibraryA,GetProcAddress,

37_2_0259F175

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 37_2_02596015 RtlAddVectoredExceptionHandler,

37_2_02596015

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Windows\SysWOW64\regsvr32.exe

Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pabc321 -y -o"C:\Users\user\AppData\Local\Temp\3lluphv4.sov" "C:\Users\user\Downloads\TXRTN_2636021.zip	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /q /c calc.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: \Device\CdRom1\calc.exe calc.exe
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00114~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 37_2_025936B2 CreateNamedPipeA,

37_2_025936B2

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 37_2_0259A3BC GetSystemTimeAsFileTime,

37_2_0259A3BC

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 37_2_0259E03B GetVersionExA,GetCurrentProcessId,

37_2_0259E03B

Source: regsvr32.exe, 0000001D.00000003.507416527.0000000004CCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: regsvr32.exe, 0000001D.00000003.507416527.0000000004CCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: regsvr32.exe, 0000001D.00000003.507416527.0000000004CCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: regsvr32.exe, 0000001D.00000003.507416527.0000000004CCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgcsrvx.exe
Source: regsvr32.exe, 0000001D.00000003.507416527.0000000004CCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: regsvr32.exe, 0000001D.00000003.507416527.0000000004CCF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Qbot

Source: Yara match	File source: 37.0.explorer.exe.2590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.2c40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.2c90000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.2c90000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.explorer.exe.2590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.2c40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.4bc0184.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.explorer.exe.2590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.4bc0184.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.explorer.exe.2590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000000.512646528.0000000002590000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.514585055.0000000002C90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.514467624.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.514983912.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected CryptOne packer

Source: Yara match

File source: 0000001D.00000002.514983912.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Qbot

Source: Yara match	File source: 37.0.explorer.exe.2590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.2c40000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.2c90000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.2c90000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.0.explorer.exe.2590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.2c40000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.4bc0184.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.explorer.exe.2590000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 29.2.regsvr32.exe.4bc0184.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 37.2.explorer.exe.2590000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000025.00000000.512646528.0000000002590000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.514585055.0000000002C90000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.514467624.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.514983912.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected CryptOne packer

Source: Yara match

File source: 0000001D.00000002.514983912.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Native API	1 LSASS Driver	112 Process Injection	1 Masquerading	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 LSASS Driver	1 Disable or Modify Tools	1 Input Capture	12 Security Software Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	112 Process Injection	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Regsvr32	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	15 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
X18flXFlh9.html	41%	Virustotal		Browse
X18flXFlh9.html	0%	Metadefender		Browse
X18flXFlh9.html	0%	ReversingLabs
X18flXFlh9.html	100%	Avira	JS/Dropper.G33

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\5812_1451044779\_platform_specific\win_x64\widevinecdm.dll	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\5812_1451044779\_platform_specific\win_x64\widevinecdm.dll	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5812_1451044779\_platform_specific\win_x64\widevinecdm.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	Metadefender	Browse
C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
37.0.explorer.exe.2590000.0.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
37.2.explorer.exe.2590000.0.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
29.2.regsvr32.exe.2c90000.2.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
29.2.regsvr32.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1249972	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://ocsp.sectigo.com0	0%	URL Reputation	safe
https://dns.google	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
accounts.google.com	142.250.185.205	true	false	high
clients.l.google.com	142.250.186.110	true	false	high
use.typekit.net	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
time.windows.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
file:///C:/Users/user/Desktop/X18flXFlh9.html	true	low
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://use.typekit.net/af/a2527e/000000000000000000017704/27/l?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://use.typekit.net/af/4b3e87/000000000000000000017706/27/d?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
http://ocsp.sectigo.com0	explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/cleardot.gif	craw_window.js.0.dr	false		high
https://play.google.com	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false		high
https://easylist.to/)	LICENSE.txt.0.dr	false		high
https://sandbox.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json0.0.dr	false		high
https://use.typekit.net/af/cb695f/000000000000000000017701/27/l?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/a?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://accounts.google.com/MergeSession	craw_window.js.0.dr	false		high
https://creativecommons.org/compatiblelicenses	LICENSE.txt.0.dr	false		high
https://use.typekit.net/af/a2527e/000000000000000000017704/27/d?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://use.typekit.net/af/4b3e87/000000000000000000017706/27/a?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://www.google.com	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false		high
https://github.com/easylist)	LICENSE.txt.0.dr	false		high
https://creativecommons.org/.	LICENSE.txt.0.dr	false		high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/a?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://accounts.google.com	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false		high
https://apis.google.com	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false		high
https://www.google.com/accounts/OAuthLogin?issueuberauth=1	craw_window.js.0.dr	false		high
https://www-googleapis-staging.sandbox.google.com	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://clients2.google.com	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false		high
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/a?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://dns.google	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 795fee26-e9c4-4fce-9494-bb4d678dd337.tmp.2.dr, d7026b31-c03f-44a6-9299-7ef70cac7f56.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false	URL Reputation: safe	unknown
https://github.com/google/closure-library/wiki/goog.module:-an-ES6-module-like-alternative-to-goog.p	craw_window.js.0.dr, craw_background.js.0.dr	false		high
https://www.google.com/intl/en-US/chrome/blank.html	craw_background.js.0.dr	false		high
https://ogs.google.com	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false		high
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/d?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://sectigo.com/CPS0	explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	false	URL Reputation: safe	unknown
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/l?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://use.typekit.net/af/a2527e/000000000000000000017704/27/a?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://github.com/twbs/bootstrap/blob/main/LICENSE)	X18flXFlh9.html	false		high
https://use.typekit.net/af/cb695f/000000000000000000017701/27/d?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://payments.google.com/payments/v4/js/integrator.js	craw_window.js.0.dr, manifest.json0.0.dr	false		high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/d?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://chromium.googlesource.com/a/native_client/pnacl-llvm.git	pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://getbootstrap.com/)	X18flXFlh9.html	false		high
https://www.google.com/images/x2.gif	craw_window.js.0.dr	false		high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/l?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
http://llvm.org/):	pnacl_public_x86_64_pnacl_sz_nexe.0.dr, pnacl_public_x86_64_pnacl_llc_nexe.0.dr	false		high
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/l?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/d?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	false	URL Reputation: safe	unknown
https://www.google.com/images/dot2.gif	craw_window.js.0.dr	false		high
https://code.google.com/p/nativeclient/issues/entry%s:	pnacl_public_x86_64_ld_nexe.0.dr	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	explorer.exe, 00000025.00000003.594354112.00000000044B9000.00000004.00000800.00020000.00000000.sdmp, TXRTN_2636021.iso.8.dr	false	URL Reputation: safe	unknown
https://code.google.com/p/nativeclient/issues/entry	pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://use.typekit.net/af/cb695f/000000000000000000017701/27/a?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://clients2.googleusercontent.com	e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp.2.dr, 9ab813e6-8392-43e6-b148-805af9f68674.tmp.2.dr	false		high
https://use.typekit.net/af/4b3e87/000000000000000000017706/27/l?primer=0635fba006f1437d962ae878ad04a	X18flXFlh9.html	false		high
https://www.google.com/	manifest.json0.0.dr	false		high
https://chromium.googlesource.com/a/native_client/pnacl-clang.git	pnacl_public_x86_64_crtend_o.0.dr, pnacl_public_x86_64_ld_nexe.0.dr	false		high
https://clients2.google.com/service/update2/crx	manifest.json0.0.dr, manifest.json.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.110	clients.l.google.com	United States	15169	GOOGLEUS	false
142.250.185.205	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	673556
Start date and time: 26/07/202214:56:54	2022-07-26 14:56:54 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	X18flXFlh9.html
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	3
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.evad.winHTML@58/155@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 96 Number of non-executed functions: 20
Cookbook Comments:	Found application associated with file extension: .html Adjust boot time Enable AMSI Browse: https://www.adobe.com/

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, vhdmp.sys, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, fsdepends.sys, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 23.211.6.115, 173.222.108.216, 173.222.108.232, 142.250.186.142, 173.194.188.168, 142.250.186.131, 80.67.82.200, 80.67.82.194, 142.250.185.195, 40.119.148.38
Excluded domains from analysis (whitelisted): r5---sn-4g5edn6y.gvt1.com, twc.trafficmanager.net, r3---sn-4g5ednld.gvt1.com, store-images.s-microsoft.com-c.edgekey.net, clientservices.googleapis.com, r5---sn-4g5lznl7.gvt1.com, arc.msn.com, r4---sn-4g5edn6r.gvt1.com, e12564.dspb.akamaiedge.net, r4---sn-4g5lznl6.gvt1.com, use-stls.adobe.com.edgesuite.net, redirector.gvt1.com, login.live.com, sls.update.microsoft.com, update.googleapis.com, displaycatalog.mp.microsoft.com, r1---sn-4g5lznes.gvt1.com, img-prod-cms-rt-microsoft-com.akamaized.net, www.gstatic.com, r2---sn-4g5e6ns7.gvt1.com, www.bing.com, fs.microsoft.com, stls.adobe.com-cn.edgesuite.net.globalredir.akadns.net, ctldl.windowsupdate.com, stls.adobe.com-cn.edgesuite.net, r3---sn-4g5edns6.gvt1.com, ris.api.iris.microsoft.com, store-images.s-microsoft.com, r3.sn-4g5edns6.gvt1.com, a1815.dscr.akamai.net, r4---sn-4g5e6nzz.gvt1.com, a1988.dscg1.akamai.net, www.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:58:38	API Interceptor	39x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
239.255.255.250	INVOICE 56387400.html	Get hash	malicious	Browse
	72004542894824073398409989.htmL.htm	Get hash	malicious	Browse
	https://site-8875jhf9-2488-2240.mystrikingly.com/	Get hash	malicious	Browse
	gwoodring@seminolecountyfl.gov.html	Get hash	malicious	Browse
	http://13.107.4.52	Get hash	malicious	Browse
	http://trk.klclick3.com/ls/click	Get hash	malicious	Browse
	https://home4redi.sauerwald-brilon.de/legal	Get hash	malicious	Browse
	https://securepubads.g.doubleclick.net/pcs/view?adurl=http%3a%2f%2fwww.GracehealthmiGracehealthmi.cirurgiaplasticarecife.com.br/#.aHR0cHM6Ly9zb2xlbmVyZ3kuY29tLnBoLy53ZWxsLWtub3duL29mZiNsYXVyZW4uY2FuZGVyc0BncmFjZWhlYWx0aG1pLm9yZw	Get hash	malicious	Browse
	https://thegetx.com/a-9afernandes-e8marin-9anl	Get hash	malicious	Browse
	https://tischlerei-pannwitt.de/wp-content/wp-contacto/h0k3ts/redir/?m=drosenstein@generalatlantic.com	Get hash	malicious	Browse
	https://globalfoundries.grapesadvertising.com/clearcache/main/?e=YWxiZXJ0LnF1aWV0enNjaEBnbG9iYWxmb3VuZHJpZXMuY29t	Get hash	malicious	Browse
	https://kn748364727564829774.playcode.io/	Get hash	malicious	Browse
	http://ktrkt9.cyou/africatoyota-qf/tb.php?eafitaqd1658827825040	Get hash	malicious	Browse
	http://dzh.ylfjso.top	Get hash	malicious	Browse
	https://7chix.app.link/e/yfIBCd7YWrb	Get hash	malicious	Browse
	https://closingtlc.myportfolio.com/	Get hash	malicious	Browse
	https://closingtlc.myportfolio.com/	Get hash	malicious	Browse
	https://www.stay22.com/allez/vrbo/?campaign=poland_travel_warsaw&address=&aid=wyldfamilytrvel&checkin=&checkout=&adults=&children=&link=https://www.myreniwn.com/free/atrinacty/filedocuments	Get hash	malicious	Browse
	https://www.stay22.com/allez/vrbo/?campaign=poland_travel_warsaw&address=&aid=wyldfamilytrvel&checkin=&checkout=&adults=&children=&link=https://www.myreniwn.com/free/atrinacty/filedocuments	Get hash	malicious	Browse
	https://mso.m0367d6378b355472d879736b7350.live/?username=sharon.osborne@bbc.co.uk	Get hash	malicious	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\5812_1451044779\_platform_specific\win_x64\widevinecdm.dll	Docu_Message_07719.htm	Get hash	malicious	Browse
	Due invoice.html	Get hash	malicious	Browse
	#ACH Notification.html	Get hash	malicious	Browse
	secured_remit_#645835.htm	Get hash	malicious	Browse
	secured_remit_#645835.htm	Get hash	malicious	Browse
	PO_G8B3K5.htm	Get hash	malicious	Browse
	secured_remit_645835.htm	Get hash	malicious	Browse
	https://www.golfclubs.com/_739.html	Get hash	malicious	Browse
	Untitled attachment 00009.htm	Get hash	malicious	Browse
	secured_file18375604PCWDUQKJA.htm	Get hash	malicious	Browse
	n_message-audio.htm	Get hash	malicious	Browse
	Message.html	Get hash	malicious	Browse
	Invoice Report.html	Get hash	malicious	Browse
	PO-71036VN.htm	Get hash	malicious	Browse
	Report Jul 14 89715.html	Get hash	malicious	Browse
	Purchase Order_#00042168.Html	Get hash	malicious	Browse
	https://tinyurl5.ru/q662268230	Get hash	malicious	Browse
	#U260e#Ufe0fAudio-3646457064.WAV - 74310406645262051543.html	Get hash	malicious	Browse
	Report Jul 14 91534.html	Get hash	malicious	Browse
	https://dl.monday.com/users/invitation/accept?invitation_token=c78UCKdLWBoPskjvxcD_&redirect_item_id=2911980970&utm_campaign=invite+users&dl_slug=acecashexpress&dl_msgid=12cb56da-1e74-4473-87fa-ad170412c9c1	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\0514ad7a-febe-4a4b-b0bb-7aabb793a604.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	107608
Entropy (8bit):	3.7440439596030655
Encrypted:	false
SSDEEP:	384:b3xwkgKZvpX3mBAjNsr9voU3/MWrHO5/G0bGrxxUvBwdxWf3yavekeSKVrBom1CR:3/+BJcR/74e7IYefdkew+kKmY8Jj
MD5:	EBDA44AAC0C9CE83F3A2ECE40571BFC0
SHA1:	AD73E04743250614E810D0E43682CD3B325DE335
SHA-256:	6C2DDF1277B3F121576E8394EA0834510452BBEAA303671394962DBF97700FF8
SHA-512:	CE106F7D4E28CAD54A8F6AFCC57795ABC924C16E10B81B409D665D02A74453ED1DBA24C8CC6A19E1A864FEBF694512F758AFEBFA7E60FFDC06D78CC5B61F1244
Malicious:	false
Preview:	T..................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....c8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

C:\Users\user\AppData\Local\Google\Chrome\User Data\06f48d95-77d6-44e6-9651-d0991f4cb8bc.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	215881
Entropy (8bit):	6.071369906369867
Encrypted:	false
SSDEEP:	6144:VodMZzdAthUXeW97vyb/K9lLvaqfIlUOoSiuRL:VodMZzL9ab8lLgoA
MD5:	C5939ABFFA12A90A24AC2241C3DA31D6
SHA1:	DC2F7A55CD7D6642FBE5F97B6DCEBCBBB5BFF54B
SHA-256:	7E273705325765EE9EE6E289971FEC9089A369FA6C500F0FCAC67844AB13C833
SHA-512:	EFBF14586FF7B489F1E151FCB361D6F1A257A42C2D15A6C5F44A8155215CF4C709D1431321DA07A76AA908B75D2B6BEF2A48A4ECB38F54588ADEF08382BAE05B
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.65884028178989e+12,"network":1.658840283e+12,"ticks":113757398.0,"uncertainty":4306778.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245922715401452"},"plugins":{"metadata":{"adobe-flash-player":{"di

C:\Users\user\AppData\Local\Google\Chrome\User Data\1b38f540-a382-4ebd-9cdb-8673ce1d99e4.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	109592
Entropy (8bit):	3.744448194549126
Encrypted:	false
SSDEEP:	384:63xwkgKZvpXrlmgVRjAjNsr9voU3/MWrHO5/G0bGrxxUvBwdxWf3yavekeSKVrBk:M5i+BJcR/74e7IYefdkew+kKmY8JD
MD5:	90B0AD4B205C6ED4D74FEB630E1EFBDD
SHA1:	CF50D2CFE33492A0E12F45A85451891E7C926C4B
SHA-256:	0CC147AD51698CE0B0EB4AF848B24E5FF4E6CF69F29D8FDAAD537D1B3ABE429D
SHA-512:	D3A648AA6E81B213521F7199077A9A0C28670947ED62136FB6B84367AC7B6FD8A4615DA94609C40B78C13E057A1369649F08F8347DB7BF462DBD4919C4B473B3
Malicious:	false
Preview:	...................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....c8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

C:\Users\user\AppData\Local\Google\Chrome\User Data\1f73dca9-0a69-4e98-aad9-0779d4b907c6.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	207631
Entropy (8bit):	6.044014205804688
Encrypted:	false
SSDEEP:	6144:CdMZzdAthUXeW97vyb/K9lLvaqfIlUOoSiuRL:CdMZzL9ab8lLgoA
MD5:	1AA823BB46124D2300B1B08680D009CE
SHA1:	0D8C651765C30D0B8F9278C537444A9B2D41E308
SHA-256:	3207F518F0862FC9433B65ADBC80ED6129681EEB9E39B733BDD66DDF6D74B0AC
SHA-512:	F931F4EB7A2C575EC60373B01799FFA4AFE66212D0F66AD758B69DE7D55ED9B1E6D3F795467BE71F4445893BF521B169C17C4971C409016E6F9A7D1275A34991
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.65884028178989e+12,"network":1.658840283e+12,"ticks":113757398.0,"uncertainty":4306778.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129457271"},"plugins":{"metadata":{"adobe-flash-player":{"di

C:\Users\user\AppData\Local\Google\Chrome\User Data\5d5b031e-6121-437f-bdd4-62211fb6c455.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	215881
Entropy (8bit):	6.0713697438578125
Encrypted:	false
SSDEEP:	6144:AodMZzdAthUXeW97vyb/K9lLvaqfIlUOoSiuRL:AodMZzL9ab8lLgoA
MD5:	490F760A3FDA6C9BBF9033396E2D98DC
SHA1:	F663D392A951C8AE1BDBE494F1D02E886714F795
SHA-256:	FB05933C16251744A457AB2D8A2C00A2523DDA566E641C4513831B5D7F9C4B2A
SHA-512:	CF0474366DBFA430B88F11D044F49A1FE6692E0039CA57F686F82F917F73912B905B90F8C86B8EC1126E90F7FEBB8294EA06755981E63E50762CF7ACCC82E844
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.65884028178989e+12,"network":1.658840283e+12,"ticks":113757398.0,"uncertainty":4306778.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129457271"},"plugins":{"metadata":{"adobe-flash-player":{"di

C:\Users\user\AppData\Local\Google\Chrome\User Data\5f69ba03-1712-46c4-ae4e-d8c7366a0881.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	207537
Entropy (8bit):	6.043772813306441
Encrypted:	false
SSDEEP:	6144:2dMZzdAthUXeW97vyb/K9lLvaqfIlUOoSiuRL:2dMZzL9ab8lLgoA
MD5:	B99CAE0AA9AB7BAAB0DBD976DCE1C23C
SHA1:	246DB119C21E8EC1AD0DF96078680E920456A0B7
SHA-256:	70EA0BE27DF1638597B720C1BF0B73E662D1B779EB5725B02BE833BBB18D71AB
SHA-512:	E9CCF880388E19BA1B1852BAF61403791D37D45E3C6FE2637D6EEF7D40E810C5799D84B7BEC0428C5A15DBAA96B361ABF07745F34B6CFE39B8206CC2F8FA730F
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.65884028178989e+12,"network":1.658840283e+12,"ticks":113757398.0,"uncertainty":4306778.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129457271"},"plugins":{"metadata":{"adobe-flash-player":{"di

C:\Users\user\AppData\Local\Google\Chrome\User Data\61a66f66-d618-4260-b9d5-91e00506acc3.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	207997
Entropy (8bit):	6.0448014027907595
Encrypted:	false
SSDEEP:	6144:/dMZzdAthUXeW97vyb/K9lLvaqfIlUOoSiuRL:/dMZzL9ab8lLgoA
MD5:	4F9A532FDCCB428BB9F0B3B027D6D802
SHA1:	F48DC3479086AC5FB3FE504EF1C9990B65371263
SHA-256:	18725544904E7D1E540EDC5923AE9F33FFE89D8CD821B4BAFD4EC1279CAAAE45
SHA-512:	61EFA51E9306F41389EF9D575CB2D0099A022D352002AD6808478727F04FA8F5E99EDCBBD9DE9124332B7CAC22A8A68B826D820887DF8D4AE0AA040CF4FEE931
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.65884028178989e+12,"network":1.658840283e+12,"ticks":113757398.0,"uncertainty":4306778.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129457271"},"plugins":{"metadata":{"adobe-flash-player":{"di

C:\Users\user\AppData\Local\Google\Chrome\User Data\7b5010af-e4ad-406f-bb1e-ae58a8383a4d.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	215881
Entropy (8bit):	6.071370201942895
Encrypted:	false
SSDEEP:	6144:qodMZzdAthUXeW97vyb/K9lLvaqfIlUOoSiuRL:qodMZzL9ab8lLgoA
MD5:	E6A3B67D4C4A7FA096582ED9B1125C0E
SHA1:	B983FDF6B10CAFB2502DBFD14B53C09C06B23B6E
SHA-256:	B2342AF0DCE6073BFC5CB4B153F5EC17E4DF4424F9B9A062CEBF63376052D6B1
SHA-512:	9A666571A703CCDB933D5289FC5687B1B16425BEB22C21A54BEEC7CE04E6888D8A103F8C97D6A2557AC2CC6A70EF9FAF4F021185A7347C04D31286F55F9657AF
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.65884028178989e+12,"network":1.658840283e+12,"ticks":113757398.0,"uncertainty":4306778.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13245922715401452"},"plugins":{"metadata":{"adobe-flash-player":{"di

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	modified
Size (bytes):	40
Entropy (8bit):	3.3041625260016576
Encrypted:	false
SSDEEP:	3:FkXwgs0oRLn:+taRLn
MD5:	7AE9008C2AA5ED3E5ED52743E082F5BF
SHA1:	CD90099842F51474494BFC490433578A89C1B539
SHA-256:	94E7D9BF431A0E3F0FD02F0FBA7321F43DD8B523E3D32092AFC474D3FD5ABF62
SHA-512:	596E66D10186ADAD552F4CF7E74CD438AD19AF4C30950D2D6EB80E9F9430CA475D12BB79423EC8D15EAF37ABE0AD1DCCAE459C356A00055A82155C24A35C6F14
Malicious:	false
Preview:	sdPC.....................UO..E.D.Q.o....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000001.dbtmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000002.dbtmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Xv:1qIF/
MD5:	206702161F94C5CD39FADD03F4014D98
SHA1:	BD8BFC144FB5326D21BD1531523D9FB50E1B600A
SHA-256:	1005A525006F148C86EFCBFB36C6EAC091B311532448010F70F7DE9A68007167
SHA-512:	0AF09F26941B11991C750D1A2B525C39A8970900E98CBA96FD1B55DBF93FEE79E18B8AAB258F48B4F7BDA40D059629BC7770D84371235CDB1352A4F17F80E145
Malicious:	false
Preview:	MANIFEST-000002.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\6801761e-0cf8-4bb7-bb70-7ccbd68a919f.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4874
Entropy (8bit):	4.925473274422577
Encrypted:	false
SSDEEP:	48:YcXkMkliPBrqAmiqTlYGlQKHoTw0JoJrN4MqM8C1Nfct/9BhUJo3KhmeSnpNGzFc:nNzG91pIKIHoD5k0JCKL8bbOTlVuHn
MD5:	A9262FDF4F33C7C7B729ED7A0D60A094
SHA1:	80D0A5DBD3C020F87A8ADB49758A02C6A62F727B
SHA-256:	D804A1D77CBFD06035D3462F631C3FBD61515D3F62D802C9D3EFCF9A3AE830B6
SHA-512:	FFBF5577D74BDF5CFFD488863AB5A12E393E0F6163114D7A4BF81CCB055A798B67DF4F3D801B96001085609029A02C2F09C4E21F81555491FC924785965D2D1D
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13303313880173618","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","2042016"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\73c8fed3-727f-4ac9-944a-b65d2783ccad.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	17702
Entropy (8bit):	5.576915332924222
Encrypted:	false
SSDEEP:	384:QJ6tGcLl7xX21kXqKf/pUZNCgVLH2HfD7rUh9Z5L4G:mcLl521kXqKf/pUZNCgVLH2HffrUhJLp
MD5:	A502D247A2769C1DBC3D18895607FB93
SHA1:	055CAD0BC501E67A64C5C65D0BAC3A855834492F
SHA-256:	7038268D23614280FCE604645E16D4CDDE45A5570E6B4F22C92A2A3EF7FC1C50
SHA-512:	E20AE48D11953411D128200165B6563E25EAE8AA5085EF963FB4193108442811D5CDA08F36AEAAE28D63C1CA90E5909DBE94417DC814FBC9AC23AD7E870AE87C
Malicious:	false
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13303313879439467","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7bb1f2d6-2d18-461d-8b84-53470bcedbd9.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4914
Entropy (8bit):	4.9341851874640525
Encrypted:	false
SSDEEP:	48:YcXkMkliPBQIJqAmiqTlYGlQKHoTw0JoJrN4MqM8C1Nfct/9BhUJo3KhmeSnpNGW:nNzg91pIKIHoD5k0JCKL8bbOTlVuHn
MD5:	E0B1D678C44051CA831239F23A81F6EC
SHA1:	9060D7FC9A77A7DC1C21B9105FD73E297185FBAD
SHA-256:	1AF4DBD86C7D1AC2C165E8D2C34298BB85685D07311A93478DEF17D5F5B99D01
SHA-512:	65A234625DD1DC4EB9FB73D3C59C929181CFB1D5FC27B214A4B003DCFA891C4297A96A3E56F4CF9BB81749EB06F8E05B7C7697166F50A5F2D5EC96A9312EE71C
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13303313880173618","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","2042016"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\7d698549-d957-4dce-95dc-da233fb6a27f.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9ab813e6-8392-43e6-b148-805af9f68674.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	3473
Entropy (8bit):	4.884843136744451
Encrypted:	false
SSDEEP:	96:6FGX0G70GhIGpyGzRDYLiEHYDBKGzUGaCGjHGESHG/OG6mhM:6Fe0i0sIIyGzRDYLiEHYDBKSUpCQHrSP
MD5:	494384A177157C36E9017D1FFB39F0BF
SHA1:	CE5D9754A70CD84CEE77C9180DB92C69715BE105
SHA-256:	07CF0A5189FAD30A4AA721F4F6DA1B15100991115833EACFA1E2DC84A1B54337
SHA-512:	BFB80EEC0C0B5D9E487047703BE49826321A4D249422E0C81E978E6C8A310F41C7B4B8F849229BA87484FDF4831DD6A98FF994D0FDA5CE3D341CE615C15F2F1C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607497410","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":27387},"server":"https://www.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607334226","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":34287},"server":"https://ssl.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607463627","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":31787},"server":"https://fonts.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248516607318875","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":23359},"server":"https://apis.google.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[],"expiration":"13248

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\9ba921d9-caf9-450d-9591-04b90c0457f7.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	19796
Entropy (8bit):	5.564081380415972
Encrypted:	false
SSDEEP:	384:QJ6tlcLl7xX21kXqKf/pUZNCgVLH2HfD7rUgHGf9ZEIL4A:FcLl521kXqKf/pUZNCgVLH2HffrUkGfH
MD5:	B55A0C076C069C00CFDDA40DFF08A146
SHA1:	72049D11A6B7CD2A353C41E198DFD82EE03E91F5
SHA-256:	26739ABC924EDFCDF0368A5F6D92A9DFCA958BA1A4A0B50570EC08FC95175F26
SHA-512:	A36060B636FEA149C5C1507372C8159D569DCA4802952F8D2E827F8285EE1E7A491F67DEF5AE889EA591B5CB43F19E2CEACC74ADF79350994C1329BB942CD401
Malicious:	false
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13303313879439467","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\CURRENT (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Xv:1qIF/
MD5:	206702161F94C5CD39FADD03F4014D98
SHA1:	BD8BFC144FB5326D21BD1531523D9FB50E1B600A
SHA-256:	1005A525006F148C86EFCBFB36C6EAC091B311532448010F70F7DE9A68007167
SHA-512:	0AF09F26941B11991C750D1A2B525C39A8970900E98CBA96FD1B55DBF93FEE79E18B8AAB258F48B4F7BDA40D059629BC7770D84371235CDB1352A4F17F80E145
Malicious:	false
Preview:	MANIFEST-000002.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	11217
Entropy (8bit):	6.069602775336632
Encrypted:	false
SSDEEP:	192:GbylJnlTwGB7V9Hne4qasKxXItmLG48gcLg/PkI:Gb+nldByaFx4toj8VEPT
MD5:	90F880064A42B29CCFF51FE5425BF1A3
SHA1:	6A3CAE3996E9FFF653A1DDF731CED32B2BE2ACBF
SHA-256:	965203D541E442C107DBC6D5B395168123D0397559774BEAE4E5B9ABC44EF268
SHA-512:	D9CBFCD865356F19A57954F8FD952CAF3D31B354112766C41892D1EF40BD2533682D4EC3F4DA0E59A5397364F67A484B45091BA94E6C69ED18AB681403DFD3F3
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["A+1PYW3V6CJbBuQ7aqrgYhyH3bT8PKyBXp3hN2slpI0=","WSOpQRkYTHjPSlG9Zif2a7TNhy43NDcG1Zg5Nv0UbH0=","jDctR8ImG5KZrQKm4kDjUB7FokSJfjo/pmvFowRVlaY=","LPxhhJiuU0lprt0T6flpS7TkaDg7MocrbmzO65xH6RI=","nZ9zLb2By96AkKXALRM+C0Eu11XUjPiMXEKjiCPdtHE=","wifibc1QfMBN2jrtUtLgsCefvuceTpAatmLvul11RJA=","dHjWlSIIdjj7MWqg3T8MG58RuuqRXk32vqi/13JqEgA=","zd3DV7dbvfNvx1hdhU01fW5ily52DLN0CFL/ADaEeTI=","DpjXcO85FFFY9KJFPkGNfFUtdQIOsGwO5jUckiUwY14=","gqid6l1+mk/6yWgUECRofI9lMipXgXh2jEN2+CxmPE0=","prDB91X2Mmfg/M/txVMITWBmEGbOGjqBTP7CMjYqdHs=","yLPAqV4gqoyS/zFkEt3Cn2j0q2v9QOSthVFfWn8EzCM=","EPQ3jzdrLkAHyvf3920B5Y3aAkO1IJdn/UtbnAmq6T0=","+oOc6ca+ChKUpTu+oa2ZRxRE+wG3QJmuYWEvYCs40NI=","3mBGNAiRlTANEQkqzU3TEi+5wJ0ubR5uwtS4/9OOM7w=","1A9NNawxuhu95H5eThvf1rewJ4QQWhhPNxJXO1C/n68=","E3vWLQxzmj+e5QxYbUscllJ5n0ITpw5JBHV1Kph3/KM=","i3I8ghdTF9c1ZXNBZmvsID+DV4gxBVN27rj9wsMtRpg=","R8B8qYabnMSlLPhrtu0hGYrHn3llsMHqBbi70gkIjEE=","rhlzuEvv2KRAFMms896xFwkNgPrw6WvmgPn6xrBSa2Y=","LAMXv6sRb0VZrY34aVXF3Fftxs

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\000003.log

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	38
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	3:FQxlXNQxlX:qTCT
MD5:	51A2CBB807F5085530DEC18E45CB8569
SHA1:	7AD88CD3DE5844C7FC269C4500228A630016AB5B
SHA-256:	1C43A1BDA1E458863C46DFAE7FB43BFB3E27802169F37320399B1DD799A819AC
SHA-512:	B643A8FA75EDA90C89AB98F79D4D022BB81F1F62F50ED4E5440F487F22D1163671EC3AE73C4742C11830214173FF2935C785018318F4A4CAD413AE4EEEF985DF
Malicious:	false
Preview:	.f.5................f.5...............

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	372
Entropy (8bit):	5.314627002947221
Encrypted:	false
SSDEEP:	6:6aaG4q2Pwkn23iKKdK25+Xqx8chI+IFUtqV5avDj3JZmwYV5aWrLDkwOwkn23iKG:f4vYf5KkTXfchI3FUtxJ/sD5Jf5KkTXc
MD5:	D7B142D7C7C968CA8FD2D55791EE5310
SHA1:	AF77F3C5893203A23E554DA5757C3DCD94580999
SHA-256:	926365516ABBBA80788236A681B0DD9D270DF1D38840302C98A05CA355B35521
SHA-512:	09FB1D0F3C4CB88B1D3D79292CE3DFC4506CCDC3086A926DA2ACC8AD01D1BC8B90DF3FCB419F3803A548884110F7D15B3B9E0A74036171F0ED6EE9D439B8C0C8
Malicious:	false
Preview:	2022/07/26-14:58:03.739 15f4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2022/07/26-14:58:03.740 15f4 Recovering log #3.2022/07/26-14:58:03.741 15f4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.old (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	372
Entropy (8bit):	5.314627002947221
Encrypted:	false
SSDEEP:	6:6aaG4q2Pwkn23iKKdK25+Xqx8chI+IFUtqV5avDj3JZmwYV5aWrLDkwOwkn23iKG:f4vYf5KkTXfchI3FUtxJ/sD5Jf5KkTXc
MD5:	D7B142D7C7C968CA8FD2D55791EE5310
SHA1:	AF77F3C5893203A23E554DA5757C3DCD94580999
SHA-256:	926365516ABBBA80788236A681B0DD9D270DF1D38840302C98A05CA355B35521
SHA-512:	09FB1D0F3C4CB88B1D3D79292CE3DFC4506CCDC3086A926DA2ACC8AD01D1BC8B90DF3FCB419F3803A548884110F7D15B3B9E0A74036171F0ED6EE9D439B8C0C8
Malicious:	false
Preview:	2022/07/26-14:58:03.739 15f4 Reusing MANIFEST C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/MANIFEST-000001.2022/07/26-14:58:03.740 15f4 Recovering log #3.2022/07/26-14:58:03.741 15f4 Reusing old log C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB/000003.log .

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History Provider Cache

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	620
Entropy (8bit):	5.192741718978729
Encrypted:	false
SSDEEP:	12:sMR3ZAY5jzu1rANRK7i8yy1fOL4j0iYxt9uhBV3KBk778B/xgskZBalnXBfsAzHf:sMR5uUf6fxhYxfGIY78BJgskfalnXpsg
MD5:	7B2A8C5860846AEB14F25EAD47B502BB
SHA1:	A935953CDE71149B23B0AD1CDFD2CE66576A965C
SHA-256:	977B7569ADFD0A9DDFE6D5C96974322DE28674AF8CE9B286F4DD8CB2EA392FC6
SHA-512:	C72EACD30AF58821E11CF245DAC03C63E2000F6E77152DBE86743E8E89B676012788147C3A1D8A10DE4EA1861F2A7724785A1FBA5DDF716D518E5DA1344FB2C8
Malicious:	false
Preview:	............."F....c..desktop..document..file..html..user..online..users..x18flxflh9j......c......desktop......document......file......html......user......online......users......x18flxflh9..2.........1........8........9........c.........d.........e.............f.........h.........i.........j........k........l...........m.........n..........o...........p........r........s..........t..........u.........x...:S...................................................................................Be...a...... ........file:///C:/Users/user/Desktop/X18flXFlh9.html2.Online Document:...............J...............*....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\MANIFEST-000001

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PGP\011Secret Key -
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1487
Entropy (8bit):	4.807876453899381
Encrypted:	false
SSDEEP:	24:Y26aL3M33ayFGRaXa63aDaaraqavatZa+Rdsd7kLydymRdsdPdR/QYhbG7n/iy:Y2nzM3qyvK6qDHGXCtwWsjDsvR4Yhbw
MD5:	C992BD29F531D682AF2C25E8D4E90B8A
SHA1:	15B309E05112E955C63ADA19BC4F2A92362B521F
SHA-256:	90E74CCF50422486ECDD61DB4B13FD985654D767861D62923DDA8D12E41AD8E3
SHA-512:	284A19B32F23A59444AC0D34D461F49AC7DAA9E78278953AAE1D28596F0A69CB094A993191A0C043C6269F01ABDAD4D66ECF596B988E98675BC8825AC0601D69
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://www.google.com","supports_spdy":true},{"isolation":[],"server":"https://dns.google","supports_spdy":true},{"isolation":[],"server":"https://www.googleapis.com","supports_spdy":true},{"isolation":[],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"isolation":[],"server":"https://redirector.gvt1.com","supports_spdy":true},{"isolation":[],"server":"https://fonts.googleapis.com","supports_spdy":true},{"isolation":[],"server":"https://ogs.google.com","supports_spdy":true},{"isolation":[],"server":"https://play.google.com","supports_spdy":true},{"isolation":[],"server":"https://apis.google.com","supports_spdy":true},{"isolation":[],"server":"https://fonts.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://ssl.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://www.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[50],"expi

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4914
Entropy (8bit):	4.9341851874640525
Encrypted:	false
SSDEEP:	48:YcXkMkliPBQIJqAmiqTlYGlQKHoTw0JoJrN4MqM8C1Nfct/9BhUJo3KhmeSnpNGW:nNzg91pIKIHoD5k0JCKL8bbOTlVuHn
MD5:	E0B1D678C44051CA831239F23A81F6EC
SHA1:	9060D7FC9A77A7DC1C21B9105FD73E297185FBAD
SHA-256:	1AF4DBD86C7D1AC2C165E8D2C34298BB85685D07311A93478DEF17D5F5B99D01
SHA-512:	65A234625DD1DC4EB9FB73D3C59C929181CFB1D5FC27B214A4B003DCFA891C4297A96A3E56F4CF9BB81749EB06F8E05B7C7697166F50A5F2D5EC96A9312EE71C
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13303313880173618","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","2042016"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	19796
Entropy (8bit):	5.564081380415972
Encrypted:	false
SSDEEP:	384:QJ6tlcLl7xX21kXqKf/pUZNCgVLH2HfD7rUgHGf9ZEIL4A:FcLl521kXqKf/pUZNCgVLH2HffrUkGfH
MD5:	B55A0C076C069C00CFDDA40DFF08A146
SHA1:	72049D11A6B7CD2A353C41E198DFD82EE03E91F5
SHA-256:	26739ABC924EDFCDF0368A5F6D92A9DFCA958BA1A4A0B50570EC08FC95175F26
SHA-512:	A36060B636FEA149C5C1507372C8159D569DCA4802952F8D2E827F8285EE1E7A491F67DEF5AE889EA591B5CB43F19E2CEACC74ADF79350994C1329BB942CD401
Malicious:	false
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13303313879439467","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\795fee26-e9c4-4fce-9494-bb4d678dd337.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	325
Entropy (8bit):	4.971623449303805
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eq7JdV5p7DHJShsDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdHfHYhsBdLJlyH7E4f3K33y
MD5:	8CA9278965B437DFC789E755E4C61B82
SHA1:	5776B6C90CA1D2DDC765ED673B5E6DC8E167F0D6
SHA-256:	A57D9231244C1FBDE58A1BF50CAD3A1E3EA28D042BFA272782B65139446E7C51
SHA-512:	3065FE0743AD88E02F8C8FF6CF03B832B616DD08061EAE25A5106422228D45EB999EE2CBE4E9C96D5FFC108CB817766240E27BF97E3E5C2A58081D369E2968F8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248516514667526","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\GPUCache\data_1

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\gfdkimpbcpahaombhbimeihdjnejgicl\def\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	325
Entropy (8bit):	4.971623449303805
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eq7JdV5p7DHJShsDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdHfHYhsBdLJlyH7E4f3K33y
MD5:	8CA9278965B437DFC789E755E4C61B82
SHA1:	5776B6C90CA1D2DDC765ED673B5E6DC8E167F0D6
SHA-256:	A57D9231244C1FBDE58A1BF50CAD3A1E3EA28D042BFA272782B65139446E7C51
SHA-512:	3065FE0743AD88E02F8C8FF6CF03B832B616DD08061EAE25A5106422228D45EB999EE2CBE4E9C96D5FFC108CB817766240E27BF97E3E5C2A58081D369E2968F8
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248516514667526","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	325
Entropy (8bit):	4.9616384877719995
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eq7JdV5pirhsDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdHirhsBdLJlyH7E4f3K33y
MD5:	B0429187E1BE99DE4D548DC5B2EDEA0A
SHA1:	B3E07BEE5D753BF1B613BD2DE665C7C21E8184F6
SHA-256:	D8DABBF936DAB4F17437ECA255020EA847D76D6B789F9486010C95E995CFED03
SHA-512:	233F7BDAA848A295E9F58CA52761829FE1044DA1DE1FBCAC407FADC8C7ABA1E4FFD7CA7A4FBE649E83FD1815DC2E3619ACB2A22CE5B2C7241E474CDB9AF2F7ED
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248516523181804","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\d7026b31-c03f-44a6-9299-7ef70cac7f56.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	325
Entropy (8bit):	4.9616384877719995
Encrypted:	false
SSDEEP:	6:YHpoNXR8+eq7JdV5pirhsDHF4R8HLJ2AVQBR70S7PMVKJw1K3KnMRK3VY:YHO8sdHirhsBdLJlyH7E4f3K33y
MD5:	B0429187E1BE99DE4D548DC5B2EDEA0A
SHA1:	B3E07BEE5D753BF1B613BD2DE665C7C21E8184F6
SHA-256:	D8DABBF936DAB4F17437ECA255020EA847D76D6B789F9486010C95E995CFED03
SHA-512:	233F7BDAA848A295E9F58CA52761829FE1044DA1DE1FBCAC407FADC8C7ABA1E4FFD7CA7A4FBE649E83FD1815DC2E3619ACB2A22CE5B2C7241E474CDB9AF2F7ED
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"alternative_service":[{"advertised_versions":[50],"expiration":"13248516523181804","port":443,"protocol_str":"quic"}],"isolation":[],"server":"https://dns.google","supports_spdy":true}],"version":5},"network_qualities":{"CAASABiAgICA+P////8B":"4G","CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\b3088083-3601-4628-a702-8dae6f3e6bf6.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	19795
Entropy (8bit):	5.564359400234282
Encrypted:	false
SSDEEP:	384:QJ6tlcLl7xX21kXqKf/pUZNCgVLH2HfD7rUgHGk9ZI7L4o:FcLl521kXqKf/pUZNCgVLH2HffrUkGkm
MD5:	FA9A6CBE38286B63E3A8AAD0DBFB9398
SHA1:	D32C6BADC78604FAB174D667818B3FA84DC5D73C
SHA-256:	5D167F9976756899E9801FDE927892657AF38DBCBC85A758F220503521798022
SHA-512:	37493E99C20D99A9551C1E82BB79DD19C671C57444020EC31539B2C13B6D2D2F1A9A38435D3F86E52250B2DF1E2F4D3F7B5FD1DE885397203F81A12388B8A678
Malicious:	false
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13303313879439467","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\b9e446b1-83fb-4d24-add5-d52710e577b6.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	4874
Entropy (8bit):	4.925473274422577
Encrypted:	false
SSDEEP:	48:YcXkMkliPBrqAmiqTlYGlQKHoTw0JoJrN4MqM8C1Nfct/9BhUJo3KhmeSnpNGzFc:nNzG91pIKIHoD5k0JCKL8bbOTlVuHn
MD5:	A9262FDF4F33C7C7B729ED7A0D60A094
SHA1:	80D0A5DBD3C020F87A8ADB49758A02C6A62F727B
SHA-256:	D804A1D77CBFD06035D3462F631C3FBD61515D3F62D802C9D3EFCF9A3AE830B6
SHA-512:	FFBF5577D74BDF5CFFD488863AB5A12E393E0F6163114D7A4BF81CCB055A798B67DF4F3D801B96001085609029A02C2F09C4E21F81555491FC924785965D2D1D
Malicious:	false
Preview:	{"account_id_migration_state":2,"account_tracker_service_last_update":"13303313880173618","alternate_error_pages":{"backup":true},"announcement_notification_service_first_run_time":"13245924509391818","autocomplete":{"retention_policy_last_version":85},"autofill":{"orphan_rows_removed":true},"bookmark_bar":{"show_on_all_tabs":false},"browser":{"has_seen_welcome_page":true,"navi_onboard_group":"","should_reset_check_default_browser":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"countryid_at_install":21843,"data_reduction":{"daily_original_length":["0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","0","2042016"],"daily_received_length":["0","0","0","0","0","0","0","0","0","0","0","0"

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000004.dbtmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Rv:1qIFJ
MD5:	6752A1D65B201C13B62EA44016EB221F
SHA1:	58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
SHA-256:	0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
SHA-512:	9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
Malicious:	false
Preview:	MANIFEST-000004.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Rv:1qIFJ
MD5:	6752A1D65B201C13B62EA44016EB221F
SHA1:	58ECF154D01A62233ED7FB494ACE3C3D4FFCE08B
SHA-256:	0861415CADA612EA5834D56E2CF1055D3E63979B69EB71D32AE9AE394D8306CD
SHA-512:	9CFD838D3FB570B44FC3461623AB2296123404C6C8F576B0DE0AABD9A6020840D4C9125EB679ED384170DBCAAC2FA30DC7FA9EE5B77D6DF7C344A0AA030E0389
Malicious:	false
Preview:	MANIFEST-000004.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\e870ed53-cd3c-43b3-85f9-c54f131193a3.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	1487
Entropy (8bit):	4.807876453899381
Encrypted:	false
SSDEEP:	24:Y26aL3M33ayFGRaXa63aDaaraqavatZa+Rdsd7kLydymRdsdPdR/QYhbG7n/iy:Y2nzM3qyvK6qDHGXCtwWsjDsvR4Yhbw
MD5:	C992BD29F531D682AF2C25E8D4E90B8A
SHA1:	15B309E05112E955C63ADA19BC4F2A92362B521F
SHA-256:	90E74CCF50422486ECDD61DB4B13FD985654D767861D62923DDA8D12E41AD8E3
SHA-512:	284A19B32F23A59444AC0D34D461F49AC7DAA9E78278953AAE1D28596F0A69CB094A993191A0C043C6269F01ABDAD4D66ECF596B988E98675BC8825AC0601D69
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://www.google.com","supports_spdy":true},{"isolation":[],"server":"https://dns.google","supports_spdy":true},{"isolation":[],"server":"https://www.googleapis.com","supports_spdy":true},{"isolation":[],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"isolation":[],"server":"https://redirector.gvt1.com","supports_spdy":true},{"isolation":[],"server":"https://fonts.googleapis.com","supports_spdy":true},{"isolation":[],"server":"https://ogs.google.com","supports_spdy":true},{"isolation":[],"server":"https://play.google.com","supports_spdy":true},{"isolation":[],"server":"https://apis.google.com","supports_spdy":true},{"isolation":[],"server":"https://fonts.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://ssl.gstatic.com","supports_spdy":true},{"isolation":[],"server":"https://www.gstatic.com","supports_spdy":true},{"alternative_service":[{"advertised_versions":[50],"expi

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\eba3871e-a60c-4540-a7ab-b3af1a79900d.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	17703
Entropy (8bit):	5.57674547508882
Encrypted:	false
SSDEEP:	384:QJ6tlcLl7xX21kXqKf/pUZNCgVLH2HfD7rUJ9Z5L4R:FcLl521kXqKf/pUZNCgVLH2HffrUJJLy
MD5:	74FD668A97CA5A5175C44A2F1D593600
SHA1:	DB2AAAB4CDBA0472BA8729EF0EBA52395B1404E9
SHA-256:	BB2BDBF7D77F92EA7D2265D5AAD4AFC6561BA3F90290582E57817E93B6B177EB
SHA-512:	B334BC3827DD111CB7D2E7DC25E6FBFA689A7F1D46522B20747996265DC4EBEE8A8CF7A2CC63592266899A81DF3A23E977B60B6BFAAA23A2FE4B8B5DFA4B04B3
Malicious:	false
Preview:	{"download":{"always_open_pdf_externally":true,"directory_upgrade":true,"extensions_to_open":"pdf:doc:docx:docxm:docm:xls:xlsx:xlsxm:xlsm:ppt:pptx:pptxm:pptm:mht:rtf:pub:vsd:mpp:mdb:dot:dotm:xlsb:xll:hwp:show:cell:hwpx:hwt:jtd:zip:iso:7z:rar:tar:vbs:js:jse:vbe:exe:html:htm:xhtml:tbz2:lz"},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"manifest_permissions":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"from_bookmark":false,"from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"install_time":"13303313879439467","location":5,"manifest":{"app":{"launch":{"web_url":"https://chrome.google.com/webstore"},"urls":["https://chrome.google.com/webstore"]},"description":"Discover great apps, games, extensions and themes for Google Chrome.","icons":{"128":"webstore_i

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Browser

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	3.138546519832722
Encrypted:	false
SSDEEP:	3:tbloIlrJ5ldQxl7aXVdJiG6R0RlAl:tbdlrnQxZaHIGi0R6l
MD5:	DE9EF0C5BCC012A3A1131988DEE272D8
SHA1:	FA9CCBDC969AC9E1474FCE773234B28D50951CD8
SHA-256:	3615498FBEF408A96BF30E01C318DAC2D5451B054998119080E7FAAC5995F590
SHA-512:	CEA946EBEADFE6BE65E33EDFF6C68953A84EC2E2410884E12F406CAC1E6C8A0793180433A7EF7CE097B24EA78A1FDBB4E3B3D9CDF1A827AB6FF5605DA3691724
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Last Version

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.8150724101159437
Encrypted:	false
SSDEEP:	3:Yx7:4
MD5:	C422F72BA41F662A919ED0B70E5C3289
SHA1:	AAD27C14B27F56B6E7C744A8EC5B1A7D767D7632
SHA-256:	02E71EB4C587FEB7EE00CE8600F97411C2774C2FC34CB95B92D5538E7F30DA59
SHA-512:	86010ED2B2EEBDCC5A8A076B37703669C294C6D1BFAAEA963E26A9C94B81B4C53EC765D9425E5B616159C43923F800A891F9B903659575DF02F8845521F8DC46
Malicious:	false
Preview:	85.0.4183.121

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	207997
Entropy (8bit):	6.0448014027907595
Encrypted:	false
SSDEEP:	6144:/dMZzdAthUXeW97vyb/K9lLvaqfIlUOoSiuRL:/dMZzL9ab8lLgoA
MD5:	4F9A532FDCCB428BB9F0B3B027D6D802
SHA1:	F48DC3479086AC5FB3FE504EF1C9990B65371263
SHA-256:	18725544904E7D1E540EDC5923AE9F33FFE89D8CD821B4BAFD4EC1279CAAAE45
SHA-512:	61EFA51E9306F41389EF9D575CB2D0099A022D352002AD6808478727F04FA8F5E99EDCBBD9DE9124332B7CAC22A8A68B826D820887DF8D4AE0AA040CF4FEE931
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.65884028178989e+12,"network":1.658840283e+12,"ticks":113757398.0,"uncertainty":4306778.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129457271"},"plugins":{"metadata":{"adobe-flash-player":{"di

C:\Users\user\AppData\Local\Google\Chrome\User Data\Module Info Cache (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	110312
Entropy (8bit):	3.7443447306093764
Encrypted:	false
SSDEEP:	384:5j3xwkgKZvpXrlmgVRjAjNsr9voU3/MWrHO5/G0bGrxxUvBwdxWf3yavekeSKVrI:5/5i+BJcRM74e7IYefdkew+kKmY8Ju
MD5:	CB10B6C8CE3667999A14153D69F97281
SHA1:	382F95166BEFA919A5D6548AC8D7F295F6F2B7A8
SHA-256:	EE49E8BEF6C72048375B6CDE1FB40C06ABABF985A950187F000C6B3F0393EC33
SHA-512:	3E8E05A72520106D0F5BBB7F122B70DB88518C1200D2F7F19DCAE6118359FEF9A77D0C4C75B37B756988E3B2494C2AD803946FCAD8CA99F84F8AB3854DBB496F
Malicious:	false
Preview:	..................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....c8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Indexed Rules\27\scoped_dir5812_736496725\Ruleset Data

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	150056
Entropy (8bit):	4.8588214550289095
Encrypted:	false
SSDEEP:	3072:P8C4uHgjBz+BZKEZZ3F0Sl03PzpDL7UI09QEwNyfe:P8C5go1U6IYeH
MD5:	C56FF16BF9B9FC0002C0128DD0BD763D
SHA1:	5048CFDBAC5D7AAAD345BAE08E66E8C4E803CA02
SHA-256:	404AA48D274C3A8FEC3145858E00279D01E0C37A5304218E191C0156E4DE00FF
SHA-512:	D993A324F5D9A1FC4FB3131252F48679750081D996295C994E2DCA4E84F2DECF7E90AF6766EFEDC2CEFC6B66194FFF38181C9E9CE45346BEEB8B3A09CE66BB73
Malicious:	false
Preview:	.........................[.................................. ...X...l...h...d...0.......X...T...P...L...H.......@...<.......4...0...,.......\|...`...D........... ................................'......ozama........*...'......g.bat........&...'......onwod.......`....'......ennab............'......nozam............(......geips.......P...((......rekoj...........@(......lgoog...........X(......uotpo........+..p(......lreko.......d...h(...............Y...............Y...Y..pY..TY..8Y...Y...Y...Y...Y...Y...Y...X...Y...Y...Y...Y...Y...X..\|Y..xY...X..pY..xX..hY..XX..`Y..\Y..4X..TY..PY..LY..HY..DY..@Y...X..8Y...W..0Y...W..(Y...W.. Y...Y...Y...Y...Y...Y...Y...Y...Y...X...X...X...X..PW..4W...X...X...X...X...W...X...X...X...X...V...X...V...V...X...X...X..xV...X...X...X...X...X...X...X...X...X..\|X..4V..tX..pX..lX..hX..dX...V...U..XX...U..PX..LX...U..DX..@X..<X..8X..xU..\U..@U..(X..$X.. X...X...X...X...U...X...X...X...X...T...T...T...T...W...W...W...W...W...W...W...W...W..LT...W...W...W...W.. T...W..

C:\Users\user\AppData\Local\Google\Chrome\User Data\ab4b71d1-ae2b-4e9d-90c6-242899a4d2a1.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	207913
Entropy (8bit):	6.044658556747006
Encrypted:	false
SSDEEP:	6144:PdMZzdAthUXeW97vyb/K9lLvaqfIlUOoSiuRL:PdMZzL9ab8lLgoA
MD5:	F20FC96DD253DC9708C2F256B9624DF4
SHA1:	91F0C59799D36C6193F810224422E7B1E160B5D4
SHA-256:	9A69CC75F6476208C03DC1ABA8C5424AAFFDB3CEA2F911CFC1DA81E39BFADA6D
SHA-512:	188C15AC4F5F48A946215F8D8F51598EEA9B1B027998C7D9601911B814C9AF8E985011A7FC324A0C5CE1F0DA39260F4D8F94D6FC227BBC4354D33A3A05A5D9F8
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.65884028178989e+12,"network":1.658840283e+12,"ticks":113757398.0,"uncertainty":4306778.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129457271"},"plugins":{"metadata":{"adobe-flash-player":{"di

C:\Users\user\AppData\Local\Google\Chrome\User Data\d9c81ebc-4988-4021-9dca-20018f7c6afb.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	207820
Entropy (8bit):	6.044425003487069
Encrypted:	false
SSDEEP:	6144:JdMZzdAthUXeW97vyb/K9lLvaqfIlUOoSiuRL:JdMZzL9ab8lLgoA
MD5:	D23A0AED9DAF6130BB84A3BD319C5501
SHA1:	5FED4C4728A1CABD513EA29F575EFB5E0FAA16DB
SHA-256:	54A24608D9D04B22095A260035B1245D1CD782EF18F8AFF4A1FAAB76ACB5F8A4
SHA-512:	1BB54C5F94C176C00A209EC428AF148612FCD621DD27AC18D51723E54859DB3BD78A92F63BAAEE21A1FF29C738819BEBBF869734B3ACBDF23F625582B6007461
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.65884028178989e+12,"network":1.658840283e+12,"ticks":113757398.0,"uncertainty":4306778.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129457271"},"plugins":{"metadata":{"adobe-flash-player":{"di

C:\Users\user\AppData\Local\Google\Chrome\User Data\ea6a85df-bddb-48ba-b678-a14973ab9819.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	207445
Entropy (8bit):	6.043525128428538
Encrypted:	false
SSDEEP:	6144:xdMZzdAthUXeW97vyb/K9lLvaqfIlUOoSiuRL:xdMZzL9ab8lLgoA
MD5:	ACC0AECEB14A9504CE36B4DFF2BB0FFE
SHA1:	1E3883F2145A07A774E97C3D88B923F84664AE36
SHA-256:	2CBBE006D26F6AC3AE6A8E59AE64284C374862287D384A860491C4D503DBD085
SHA-512:	7BB11C11F6489D541D631DAA16075F2776EBFA67AC41A235F574FEC085B487488446A6813D4ABA29F3967F246886392431BB326639FD9C7418D5B017E617A44D
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.65884028178989e+12,"network":1.658840283e+12,"ticks":113757398.0,"uncertainty":4306778.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129457271"},"plugins":{"metadata":{"adobe-flash-player":{"di

C:\Users\user\AppData\Local\Google\Chrome\User Data\f56a5917-3940-401d-8bc8-8e2df658ca9f.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	110312
Entropy (8bit):	3.7443447306093764
Encrypted:	false
SSDEEP:	384:5j3xwkgKZvpXrlmgVRjAjNsr9voU3/MWrHO5/G0bGrxxUvBwdxWf3yavekeSKVrI:5/5i+BJcRM74e7IYefdkew+kKmY8Ju
MD5:	CB10B6C8CE3667999A14153D69F97281
SHA1:	382F95166BEFA919A5D6548AC8D7F295F6F2B7A8
SHA-256:	EE49E8BEF6C72048375B6CDE1FB40C06ABABF985A950187F000C6B3F0393EC33
SHA-512:	3E8E05A72520106D0F5BBB7F122B70DB88518C1200D2F7F19DCAE6118359FEF9A77D0C4C75B37B756988E3B2494C2AD803946FCAD8CA99F84F8AB3854DBB496F
Malicious:	false
Preview:	..................C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L..P!...[)...%.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .o.f.f.i.c.e.\.o.f.f.i.c.e.1.6.\.......g.r.o.o.v.e.e.x...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .2.0.1.6......M.i.c.r.o.s.o.f.t. .O.n.e.D.r.i.v.e. .f.o.r. .B.u.s.i.n.e.s.s. .E.x.t.e.n.s.i.o.n.s.....1.6...0...4.7.1.1...1.0.0.0.....*...C.:.\.P.R.O.G.R.A.~.1.\.M.I.C.R.O.S.~.1.\.O.f.f.i.c.e.1.6.\.G.R.O.O.V.E.E.X...D.L.L.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n....c8.D...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.C.o.m.m.o.n. .F.i.l.e.s.\.M.i.c.r.o.s.o.f.t. .S.h.a.r.e.d.\.O.F.F.I.C.E.1.6.\.m.s.o.s.h.e.x.t...d.l.l..@.....U/...%.c.o.m.m.o.n.p.r.o.g.r.a.m.f.i.l.e.s.%.\.m.i.c.r.o.s.o.f.t. .s.h.a.r.e.d.\.o.f.f.i.c.e.1.6.\.......m.s.o.s.h.e.x.t...d.l.l.....M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e.)...M.i.c.r.o.s.o.f.t. .O.f.f.i.c.e. .S.h.e.l.l. .E.x.t.e.n.s.i.o.n. .H.a.n.d.l.e.r.s.......1.6...0...4.2.6.6...1.0.0.1.....D...C.:.\.P.r.o.g.r.a.m.

C:\Users\user\AppData\Local\Google\Chrome\User Data\f64113ef-7ab7-47a0-9d82-fb927a92ccc2.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	207997
Entropy (8bit):	6.0448014027907595
Encrypted:	false
SSDEEP:	6144:/dMZzdAthUXeW97vyb/K9lLvaqfIlUOoSiuRL:/dMZzL9ab8lLgoA
MD5:	4F9A532FDCCB428BB9F0B3B027D6D802
SHA1:	F48DC3479086AC5FB3FE504EF1C9990B65371263
SHA-256:	18725544904E7D1E540EDC5923AE9F33FFE89D8CD821B4BAFD4EC1279CAAAE45
SHA-512:	61EFA51E9306F41389EF9D575CB2D0099A022D352002AD6808478727F04FA8F5E99EDCBBD9DE9124332B7CAC22A8A68B826D820887DF8D4AE0AA040CF4FEE931
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"85.0.4183.121"},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en-GB"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.65884028178989e+12,"network":1.658840283e+12,"ticks":113757398.0,"uncertainty":4306778.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAABaHlwIoHYlQKZwuwW8V0yxAAAAAAIAAAAAABBmAAAAAQAAIAAAAOT4j8Zm9U1zXX6oEUpPqIYBIjSlOiLGeiMKiIFJZDroAAAAAA6AAAAAAgAAIAAAAFW1OavBhyV7qwszPZbindD+KU2Osh5O7HSmDPpFnuCDMAAAAGEkmqbufgFUSmOzx4cW7Aup7spqps4DvqbPrwRgUGqSpRZvQkbO+yVH56WF9zMTt0AAAAAyRwtYxjf7/AqYrFr0JZ6kbTiUt0/2PKkCw7ntLtbN2qrad7I3MeL4iNGDFgqRlhWgsb/6w0gJzQxAfL6rdzxi"},"password_manager":{"os_password_blank":true,"os_password_last_changed":"13291206129457271"},"plugins":{"metadata":{"adobe-flash-player":{"di

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	22280
Entropy (8bit):	5.604639525965966
Encrypted:	false
SSDEEP:	384:rtCFqQvVf7KJCIYSB+JjsRD7Y9g9SJ3xq1BMJ4Em+FByCmST303YZy:yuY4IoR39cZJSsT1I
MD5:	5B2009D724E62783D6D666E93B6C109E
SHA1:	44FDFECB359B4F5B05F405EF0D33056585D04B18
SHA-256:	DF552D2411471B0FE793D26E9D10CA0FBE2A123D80D98DD95C505BA377C747AA
SHA-512:	BDA0636E27CD6C21AF34AA8EB83F562C8B8C2516A173BEBE7E2FB13716998B719F304AB2592BB93FBF02C60039E818B1E86CB94657906372D2231432E69A0FC7
Malicious:	false
Preview:	@...e...........y...................A................@..........H...............<@.^.L."My...:E..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\36993d0a-d052-46f9-8c4f-49e73b36ae2f.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	248531
Entropy (8bit):	7.963657412635355
Encrypted:	false
SSDEEP:	3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5:	541F52E24FE1EF9F8E12377A6CCAE0C0
SHA1:	189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
SHA-256:	81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
SHA-512:	D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f\|.~.c.4.E.......0..0....H............0.......).'..b.$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.\|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$\|..\|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...\|!..A..L.+.=...kP.!.1..

C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	data
Category:	dropped
Size (bytes):	2752512
Entropy (8bit):	4.254424654475395
Encrypted:	false
SSDEEP:	12288:8/3FyXXBGP50dO1F2SGCEgqEdiqsLkcOUwsUTGoChBQQzvSbJxPRC+XQSxb6Dc7l:chf1F9glZucYsUGobbJV8kVxb6Y+rod
MD5:	17BE394B5CD6D74C3709E39F02CD1AA3
SHA1:	960586A973F517582292E427CB254558B006C53D
SHA-256:	97EF6F319BF880412459655F70A32801241E551C6CF51C85CEB9F39EB86054E6
SHA-512:	26B78355CBA7E7A6CC83CFDAEC106DB1D464D62EE2CC7D3558BEDB90536E7B954F61CA58732399113B3286FE0E8B68D960512AFFA93E9D157622C346C21F2347
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5812_1385192279\Filtering Rules

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	97968
Entropy (8bit):	5.489893397464442
Encrypted:	false
SSDEEP:	1536:ojHlFMJw9iI9Yh9FHc6cPC3CpBHTrDo630a8Q78xRAQudDv4NZ/p2GuN+BO1:6FMJw9v9efHc6cPCURDR30EYnAQuJANw
MD5:	3846A25BC9191585763E06550798BAB1
SHA1:	F43D903B13AB969E2276E304795CE164F22F893C
SHA-256:	C7D5D133E8F995D3E4D5B68F28BE0D7B1F290DFBD1502E0EC260142325FA8F88
SHA-512:	6B1E1776DE4B4B7D7BD7E6252F555AD84CC689EFE1F3920B3ACFE23DE65212254FC219E0A530037A5EA819894BC2F5B85ECFC0ADDEE9AF3163393AA32F97BA44
Malicious:	false
Preview:	............0.8.@.R.-728x90...........0.8.@.R.adtdp.com^..........0.8.@.R.yomeno.xyz^.:...........adcore.com.au.....adcore.ch..0.8.@.R./adcore_..........0.8.@.R.uwoaptee.com^.8.........safeway.com0.8.@.R.fwcdn2.com/js/embed-feed.js..........0.8.@.R._468_60..3........0.8.@.R#/wp-content/plugins/wp-super-popup/.9........0.8.@.R)bancodevenezuela.com/imagenes/publicidad/..........0.8.@.R..adbutler-..........0.8.@.R.adrecover.com^..........0.8.@.R.hdbcode.com^.?...........google.com0.8.@.R!developers.google.com/google-ads/.-...........konograma.com..0.8.@.R./adserver..............vk.com0.8.@.R.vk.me/css/al/ads.css.,........0.8.@.R.mysmth.net/nForum//ADAgent_..........0.8.@.R.indoleads.com^.%......0.8.@.R.discordapp.com/banners/.E...........daum.net0.8.@.R)daumcdn.net/adfit/static/ad-native.min.js.(........0.8.@.R.looker.com/api/internal/.#........0.8.@.R.broadstreetads.com^..........0.8.@.R./banner.cgi?..............thefreedictionary.com...downloads.codefi.re*...windows7themes.net

C:\Users\user\AppData\Local\Temp\5812_1385192279\LICENSE.txt

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	24623
Entropy (8bit):	4.588307081140814
Encrypted:	false
SSDEEP:	384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm0:mvagXreRnTqzazWgj0v6XqD
MD5:	D33AAA5246E1CE0A94FA15BA0C407AE2
SHA1:	11D197ACB61361657D638154A9416DC3249EC9FB
SHA-256:	1D4FF95CE9C6E21FE4A4FF3B41E7A0DF88638DD449D909A7B46974D3DFAB7311
SHA-512:	98B1B12FF0991FD7A5612141F83F69B86BC5A89DD62FC472EE5971817B7BBB612A034C746C2D81AE58FDF6873129256A89AA8BB7456022246DC4515BAAE2454B
Malicious:	false
Preview:	EasyList Repository Licences.... Unless otherwise noted, the contents of the EasyList repository.. (https://github.com/easylist) is dual licensed under the GNU General.. Public License version 3 of the License, or (at your option) any later.. version, and Creative Commons Attribution-ShareAlike 3.0 Unported, or.. (at your option) any later version. You may use and/or modify the files.. as permitted by either licence; if required, "The EasyList authors.. (https://easylist.to/)" should be attributed as the source of the.. material. All relevant licence files are included in the repository..... Please be aware that files hosted externally and referenced in the.. repository, including but not limited to subscriptions other than.. EasyList, EasyPrivacy, EasyList Germany and EasyList Italy, may be.. available under other conditions; permission must be granted by the.. respective copyright holders to authorise the use of their material.......Creative Commons Attribut

C:\Users\user\AppData\Local\Temp\5812_1385192279\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1529
Entropy (8bit):	5.993915630498445
Encrypted:	false
SSDEEP:	24:pZRj/flTHYfcl5kYbKqLjeT3azkaoX1pF/kSYYRVHbo0doXxOB6G6QL3foQ3QL5D:p/h4ElBbKdTakak1pFcSfRV7o0dkx8L4
MD5:	6B2EDD2D0C16E5D77BD2C3E4AE88C95F
SHA1:	BC82982FA8A04FA6FD9F17DA03D443A57E0F78D4
SHA-256:	CA0F5F75FC56FBEDA7522B2C83707A451D01760F417C497A37C70554E290B737
SHA-512:	533026A33030795ABF24B6E78D26763734D98CA74BFA4FAC2073EFAD0BB5CA1C38E7036BEAF17E6ABBFE56CF968E80EB3CA3CFD23AEEC10CE1280E8DB1C4078C
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJGaWx0ZXJpbmcgUnVsZXMiLCJyb290X2hhc2giOiJMTF90X0NkWWRYUnpMSHJBZ3hmUW5tcENTaXlkWEtzVVlJZnZjLTR0czRBIn0seyJwYXRoIjoiTElDRU5TRS50eHQiLCJyb290X2hhc2giOiIyaWswNmk0TFlCdVNHNWphRGFIS253NE9pdnVSRzZsQ0JKMVk0TGtzRFJJIn0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6Imo4MmhRZGhaa0MwMjFWOEZ1MHUtMExvMnVJdXI5SzdFem5JcHE3WHd2YlkifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJnY21qa21nZGxnbmtrY29jbW9laW1pbmFpam1tam5paSIsIml0ZW1fdmVyc2lvbiI6IjkuMzYuMCIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"VM_rIA1uXuXjbhz_uZ8uQp9F3FfgEgGTjCXL08Q_jrGXXH-Yty1DqAw4yzWsadeOjVRozUf_7kBrYJ2U8Y8slircdLRbrqJejQeyyrJx4HFT8qgZEb60YHdsOd76C57YzF5dXErpjT7_FkWA41lTxLQvdWbACMO0DE7uOHO9mZx5pM98Ni9GsM_yxJbRSyDZWa8BdPHErfMuO6YE6D8tbnYTr2tXcMV9p2ZEAFMiso2B-6DSr

C:\Users\user\AppData\Local\Temp\5812_1385192279\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.9458563396006063
Encrypted:	false
SSDEEP:	3:SWllBTGVn1VJ8U1hRGGpWdTdSATn:SWNT+eKhRR4dTVT
MD5:	991F44CE02222E783A1FEFE4187727CE
SHA1:	9855D1CA0338ADCD5829C3260BF7FAAF88A23509
SHA-256:	58704ADE087671AA1226BC9CEC1719F5B80B90C571EF747812A64458BBEA0F50
SHA-512:	C2616426939B235620A22B24A9BEC6D4F7DBB695C812F1784A4C95B41E53A21F371A6C440177CFABDE47E203EB83269F9013FC75C6D758EA6FDFE7B52B4A554E
Malicious:	false
Preview:	1.34ff2e9d7a7ce81c5d760d4b0f4b59a0237dd5db0d1e84ccd5103a30687eac17

C:\Users\user\AppData\Local\Temp\5812_1385192279\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.563301657145084
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFHXG7LGMdv5HcDKhtUJKS1Avn:F6VlMZWuMt5SKPS1Avn
MD5:	47B89067C397B3EABBD04E6FC4008B71
SHA1:	7B4E623806D7EA8BFCD2FE6836A21E50C9F9340E
SHA-256:	8FCDA141D859902D36D55F05BB4BBED0BA36B88BABF4AEC4CE7229ABB5F0BDB6
SHA-512:	FDA1CE8EB24A05F65E8132248EEF96C422E5AA2D3254B590FBFD3FCB2016E3B7F6E4B53702D88E1695D4BEC0175F72EB4256CDAA2FF72DDF4390D480D04BA373
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "Subresource Filtering Rules",. "ruleset_format": 1,. "version": "9.36.0".}.

C:\Users\user\AppData\Local\Temp\5812_1451044779\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	5.971745384085355
Encrypted:	false
SSDEEP:	24:pZRj/flTyyRTGYGRM86CAjkVmdZzUU7aoXtu0tSPqNnQoXCrBJr4k0UpLaahl6mc:p/hyyj7qAdZzUU7aktuLinQkCdJr70Uy
MD5:	3E59AFF1F633A40146220723D49FF69D
SHA1:	91114719E0FAE4D557857A57BFCEF4A621AAFAAA
SHA-256:	5EFF1D2049B3AFDB8F44C4C68DEB1B0F5081B43C9A1BE5AAC32B741CCC6016B3
SHA-512:	75E4EB0141E6E6F547E58D215DEDC2BFB7C9431015097859783302E9A770695AF9C4AC775101A2309468A1431D20483BCF4B204FC706CF5EBF605E6FD9E5864A
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJfcGxhdGZvcm1fc3BlY2lmaWMvd2luX3g2NC93aWRldmluZWNkbS5kbGwiLCJyb290X2hhc2giOiJUVWprbmV5ZDNlZmRVR0p0WnM0elNBbXRWLTREcEQ4TXM0UW5rZE1MVTBvIn0seyJwYXRoIjoiX3BsYXRmb3JtX3NwZWNpZmljL3dpbl94NjQvd2lkZXZpbmVjZG0uZGxsLnNpZyIsInJvb3RfaGFzaCI6IjJ3eXRkUHVFY3U1MDdJenRuN2VKOUNwQVd5ZVdXU0xoekdGQVlXQklfZkUifSx7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoicW9aS2xCRVJoTzIybXpwaEctZzFHNjQyc0pCRjNuN3laUzRWYlEwT3JZayJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Im9pbW9tcGVjYWduYWpkZWpnbm5qaWpvYmViYWVpZ2VrIiwiaXRlbV92ZXJzaW9uIjoiNC4xMC4yMzkxLjAiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"J_varh3pbSCuoxRJJKBMABg5gxFq57n03z43XkUWJM7oy3eWRQ133bpCLFZB9QxF4hEr0j3QkT-oGRSGF8e2UNhauTxV8FmTjYoSF34D_idMe81x8xr_sKSshYV0BJC5VPDDw9-FcorpDHeeOmgpnBf

C:\Users\user\AppData\Local\Temp\5812_1451044779\_platform_specific\win_x64\widevinecdm.dll

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10053976
Entropy (8bit):	7.433454408979122
Encrypted:	false
SSDEEP:	98304:sQ8AwzExgSMcgTnSUpCSDVLcyjbc2ZFWReP+klU/6CFNbnVzHyJJwN19hzjS1SJ:sQLw6Mce5p3VQyjbc0va/PFNzlyJahZJ
MD5:	55CE1BB968F23F546ED9E683050954A7
SHA1:	8088DED3DDF9D27700E470A75CFA7FA2EF565731
SHA-256:	6CB80D4B43B81D2C1DF133565638D3471E108702AE5FAED47300F3AE15BAA33D
SHA-512:	7F4F27EF9C7F571CD6C04305C6CE0A75CA0F7BDC4587A438133794418C530F0E95BF19B56DB120AA49DC96626E80058E567C47EC66B2813FD3A6A146AF1054A0
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Docu_Message_07719.htm, Detection: malicious, Browse Filename: Due invoice.html, Detection: malicious, Browse Filename: #ACH Notification.html, Detection: malicious, Browse Filename: secured_remit_#645835.htm, Detection: malicious, Browse Filename: secured_remit_#645835.htm, Detection: malicious, Browse Filename: PO_G8B3K5.htm, Detection: malicious, Browse Filename: secured_remit_645835.htm, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Untitled attachment 00009.htm, Detection: malicious, Browse Filename: secured_file18375604PCWDUQKJA.htm, Detection: malicious, Browse Filename: n_message-audio.htm, Detection: malicious, Browse Filename: Message.html, Detection: malicious, Browse Filename: Invoice Report.html, Detection: malicious, Browse Filename: PO-71036VN.htm, Detection: malicious, Browse Filename: Report Jul 14 89715.html, Detection: malicious, Browse Filename: Purchase Order_#00042168.Html, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: #U260e#Ufe0fAudio-3646457064.WAV - 74310406645262051543.html, Detection: malicious, Browse Filename: Report Jul 14 91534.html, Detection: malicious, Browse Filename: , Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d.....\`.........." .....lS...E.......P.......................................2.....LS....`A........................................(...........x....02.......0.T....J..X....@2..;.........................p..(.......0............................................text....kS......lS................. ..`.rdata...SD...S..TD..pS.............@..@.data...X........2.................@....pdata..T.....0.....................@..@.00cfg..(.....1.....................@..@.rodata.......2..................... ..`.tls....1.....2.....................@..._RDATA....... 2.....................@..@.rsrc........02.....................@..@.reloc...;...@2..<..................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5812_1451044779\_platform_specific\win_x64\widevinecdm.dll.sig

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	7.570377692439448
Encrypted:	false
SSDEEP:	24:38H/VZn47VBRxgCUQuODHBJeriJ8yojUdnkLvXWgl0oHLrUXAo8/f6Lu57x/:38HdurRxHSOlAiqYoXWVDX6XYu57x/
MD5:	EDEC647D2132F0F988F43BFCBA5932BA
SHA1:	3B16ABF4669A598A0095556D5DBBDCA0D448E654
SHA-256:	DB0CAD74FB8472EE74EC8CED9FB789F42A405B27965922E1CC6140616048FDF1
SHA-512:	005613A96CBE17C8482FBD973AFF8DF9D93C4D1BE8B9A01019E2436CDDF085BCD8748E1863221A3E15D541829C4BF81779F5A049255101F5CB7EA68DF92C7730
Malicious:	false
Preview:	....0...0...........6cd/+J.v{..B...0....H........0}1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1"0 ..U....widevine-codesign-root-ca0...171013173909Z..271011173909Z0y1.0...U....US1.0...U....Washington1.0...U....Kirkland1.0...U....Google1.0...U....Widevine1.0...U....widevine-vmp-codesign0.."0....H.............0.........2F..8.e..-....$r...{^........0.%.HA...sA"D.q.=6...#.J.N.......&..k;.+...<xF.......B8.)S....o..\|Ci.F.A6....J.......Y..4..{.5u.9N...=...#.M..s.F!j.f%&ld.R...?!Ot@......#.f..O..[.V.p0y....+...S.].....M.=.9...>.. ........>.:....1tl.....`D/c..j..........0..0...U......L...cC.E..R.n...$.0...U.#..0....=..tW....!.B.#U).0...U....0.0...U........0...U.%..0...+.......0...+.....y........0....H.............g.."..[..t{.4~.,.G....4K.....(x$...} ....N..b\|d......h..u6?.L.(&.Oup...$!...4R. 5.-...s...K/..U[..[.+.sAX*.~...^0..ba>;.#....x...b.-1...E..l....S.n.a....)U .q..C>d:...<[..F5...7...[.-.l}.T Lc.X..Qf...z..:.Q..e.m

C:\Users\user\AppData\Local\Temp\5812_1451044779\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.8618480997673856
Encrypted:	false
SSDEEP:	3:S4VW243EXtcQXQ8OUJGb00JpgUu:S7t3E+CLOZo0J6Uu
MD5:	9546E4EF0287DB27186BBCCF94ACA349
SHA1:	EB373F0CA09AE7EDF54E9637934B9E406F68BEE6
SHA-256:	08EBFF0F0F9DE95708F24ED2115634D44D8691648892D9BE449766F3677A0D8A
SHA-512:	ED90C91C641034BF6233BC442103988F5F685D0E1A6D84AEB6B67A2BFA6A4E99F48747B3C08C09A200C8487C461B0EB0D6AF68E54E4028EA611DE0EC24E401C5
Malicious:	false
Preview:	1.e80345a4828e2b82d049520da48dc125df0c2600b1e4591cd05c71bb661231e5

C:\Users\user\AppData\Local\Temp\5812_1451044779\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	825
Entropy (8bit):	4.819458905604673
Encrypted:	false
SSDEEP:	24:ulaihI11P1TRuRckckH3WoA0UNqLQxUNqmTb:C1hY91uRfckHksJ
MD5:	E15CE41AD7AB84F270A12DB01724A30D
SHA1:	DA82BF4C88965850A2EA06BC2E4A090F523D7DEA
SHA-256:	AA864A94111184EDB69B3A611BE8351BAE36B09045DE7EF2652E156D0D0EAD89
SHA-512:	51DA142996B586539DB044821E3D3FEA2A60D5F53F165976C770385B10B8B3A3A81078D8710F8984F45E7F09DC035296A7C6C7AA85791EF7BD2022AAC2DA0134
Malicious:	false
Preview:	{. "manifest_version": 2,. "update_url": "https://clients2.google.com/service/update2/crx",. "name": "WidevineCdm",. "description": "Widevine Content Decryption Module",. "version": "4.10.2391.0",. "minimum_chrome_version": "68.0.3430.0",. "x-cdm-module-versions": "4",. "x-cdm-interface-versions": "10",. "x-cdm-host-versions": "10",. "x-cdm-codecs": "vp8,vp09,avc1,av01",. "x-cdm-persistent-license-support": true,. "x-cdm-supported-encryption-schemes": [. "cenc",. "cbcs". ],. "icons": {. "16": "imgs/icon-128x128.png",. "128": "imgs/icon-128x128.png". },. "platforms": [. {. "os": "win",. "arch": "x64",. "sub_package_path": "_platform_specific/win_x64/". },. {. "os": "win",. "arch": "x86",. "sub_package_path": "_platform_specific/win_x86/". }. ].}

C:\Users\user\AppData\Local\Temp\5812_167529333\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	6.005142745622942
Encrypted:	false
SSDEEP:	24:pZRj/flTDyV9yVmddLb7aoX6wcIWQ4vDzRS9KF6oXZEWGPnIQvo+M:p/haEAdV7ak63Rx0KF6keWiI6o+M
MD5:	015CC8BEA4A6A775AF3080882F5D9455
SHA1:	E3728A7B6A32044FDACE9F7FC447997FDE32FB18
SHA-256:	DCD27659E8C9BE4F9130B1CAA328162D305544D9799EF0A0675085A962CF7578
SHA-512:	F6C8FEC2DEB717F361E77117F6FEABBF9B26EACE7402957D7D312F334A82176AD44DAC1A4124AF004C7CA6F3F6B73124740289B9570A85354DB3C1047751F237
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJtYW5pZmVzdC5qc29uIiwicm9vdF9oYXNoIjoiZWJkaGhpRGxDcEhFOUc5RllLMEZTQ1B4RmFBOXBWMVdVYzdPaUVPSlpZSSJ9XSwiZm9ybWF0IjoidHJlZWhhc2giLCJoYXNoX2Jsb2NrX3NpemUiOjQwOTZ9XSwiaXRlbV9pZCI6Imxsa2dqZmZjZHBmZm1oaWFrbWZjZGNibG9oY2NwZm1vIiwiaXRlbV92ZXJzaW9uIjoiMS4wLjAuMTMiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"YQ3bA-EV7C3PaG_SnIbfTSwU1AwZtGpsZ6QFPw-_VbUhBWySX2efppu8GX0fliZRHW6KEP7fjynCV_qNtcgrpl8BjSO-1nmB1KrigfT4kHv6uBh8h_SXujgGRjIPAXCWPLYKco-hqE9tTuQPKmzn_-Zc9GgJpl5lEAsu6UTzjrvVmzKkgkbdcesMNSwbrvyDffx2nikl2p_7U3IkHNyd7hLpsCvZV8VqwCHwC6pOuggw5kmNjLwxmRnjA_Emy9mMXEUEofyh7EEOs9BaUNsokg7qXuxkrMz4S0ja5VB6ZVmBO5Wlvexk3EXD-yDCykgMDxk2WZGpW1JtkYnpOMqgGQ"},{"header":{"kid":"webstore"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"W9LRESuiylidkd-XDuFWN18wHXTE2O2h4LMHy

C:\Users\user\AppData\Local\Temp\5812_167529333\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	66
Entropy (8bit):	3.947126840193127
Encrypted:	false
SSDEEP:	3:SuOcV6oDkEoVavUd1iSiXn:SBCDk5svU6SiX
MD5:	072D0D7C824A2889BEB0B9CEF0FD2197
SHA1:	985C0EC750CFFBBAE6B2F079E77149E434E9D517
SHA-256:	BF69E3FA772C505E6E75E2A5086FF0396248246F319024745B80FC0FB39D93E7
SHA-512:	A397B48EE93B964A38501846F876ABF2C29AF2150786DCF6E37BAA0EADF48DEE2F8601953F8AB7D4AD76CB5586D669CB1F11FF5A8FDE5B638F0B91413B358C03
Malicious:	false
Preview:	1.ab8d70a60ce0fba1355fad4edab88fd4d1bccc566b230998180183d1d776992b

C:\Users\user\AppData\Local\Temp\5812_167529333\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	300
Entropy (8bit):	4.716626192856269
Encrypted:	false
SSDEEP:	6:zeXC6WQpVyTJCAEIfd26VO9bIA6VDHs/C6wrhKXk7Vm01LwyAGI/zqSkhY:0eTJCAEQLO9hQADgK0711LqGika
MD5:	9569E205D5815A3D9E14DEE93B7717C3
SHA1:	020BD6A07EF64A304B07E3ADFDA4C4D5397534CD
SHA-256:	79B7618620E50A91C4F46F4560AD054823F115A03DA55D5651CECE8843896582
SHA-512:	BE5EB17E769203E6A064326F227D21FFC1E8AA3F2684BD9786FAA4D0EAC944E4343608B1AEA25FDA15FFF88D9C41487907037FEF75DC4D1615A27C7041FC0F9C
Malicious:	false
Preview:	{. "description" : "Origin Trials public key updates and disabled features list",. "manifest_version" : 2,. "minimum_chrome_version" : "55",. "name" : "Origin Trials Updates",. "origin-trials" : null,. "update_url" : "https://clients2.google.com/service/update2/crx",. "version" : "1.0.0.13".}

C:\Users\user\AppData\Local\Temp\5812_1821568228\Recovery.crx3

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	145035
Entropy (8bit):	7.995615725071868
Encrypted:	true
SSDEEP:	3072:TdgEhmDf+E8VY0x81Rkc6L2oqzqkPEu30gZlc3G2ZknF:TyEhmDf+/+Fnkj6lEukgZyyF
MD5:	EA1C1FFD3EA54D1FB117BFDBB3569C60
SHA1:	10958B0F690AE8F5240E1528B1CCFFFF28A33272
SHA-256:	7C3A6A7D16AC44C3200F572A764BCE7D8FA84B9572DD028B15C59BDCCBC0A77D
SHA-512:	6C30728CAC9EAC53F0B27B7DBE2222DA83225C3B63617D6B271A6CFEDF18E8F0A8DFFA1053E1CBC4C5E16625F4BBC0D03AA306A946C9D72FAA4CEB779F8FFCAF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b..........S'.....2.{.....'....+.'.."..Y.x.ISa...)....H.&92..?!..~..F.5."...n,.B.-\|\.)..(..... ]G..j.-M)....C......o&L..0.K.....UtP.&.N...;..^w/a{)v...~KG;...?.1...k.c..D.U......J.6.`.G.5.x.k..[...i.A.@I^..I.<A. J...j.'.G.`.$q.N..Tdq]2]p.OF..#.#......'....8.3......0.."0....H.............0.............O..(...':19..O/.>....=.....m.n\.z..q.....JW..F......+H.Z+KGO.9....8.....U...&.y....,$...?.Eo.....\f/.Z..+M8...B.3'..Y.r...X.AS?.~..k..n....... Z...&.G....."n..........l.0v.x#<....Lx,-.w..-..d.....J.pT..('e~{%kQ.Q......rI.....Z....v.N.....J.d_......rX.......w@.b.[.c../V.'c...!.~.k..}z...U.S..nC......@.......Y..#.D.z.....5&.1O...X=p..2.F..P.6yP..>{.....HBX.*.E5....y..

C:\Users\user\AppData\Local\Temp\5812_1821568228\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1765
Entropy (8bit):	6.027545161275716
Encrypted:	false
SSDEEP:	48:p/hii6zkvVI1Jip2qRNHvakuQkCNFxdsGwmBKkgum91:Rz0kv6cNvaYNFwSEhug
MD5:	45821E6EB1AEC30435949B553DB67807
SHA1:	B3CADEB17FE5B76B5DBB428B8D3A07B341F8B1BC
SHA-256:	E5FAE91295BECF7F66BFA4BE1061CA5537ED763EB5D01485F23ECFB583304FEE
SHA-512:	BCBE40CAFAA4B14566D91E361D8FB7F0288D5C459FA478AA4C575444DA4D406E1076FC0B3A31D4A9E5EE034F0FE15A0EFE8A8A52B838DE94B96D3E488D28F0FE
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJSZWNvdmVyeS5jcngzIiwicm9vdF9oYXNoIjoiaGdCR051SzhNR2NKaDlfNmZQaFdEWmpVYUFKeklzeDlJS21DUEZvb0dfUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiIwYXduVFBFQmdDRHkyV05hVVk3Um9mSWN3c3ZwNHFRNUxzZVMxVXRiVXY0In1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoiaWhubGNlbm9jZWhnZGFlZ2RtaGJpZGpobmhkY2hmbW0iLCJpdGVtX3ZlcnNpb24iOiIxLjMuMzYuMTQxIiwicHJvdG9jb2xfdmVyc2lvbiI6MX0","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"iFuMX_kOZ-zJ7KVu6Lxb3rHWZgQvkZhv25x_SGlBiDV_okALrGbj6rUOWyNNNsHXMnT118XZmA696XR8qkr4dwT5Gvez-9gi-WYBY7XBkgo7v6NspGgJF89BNCeI-P9k-zBHOGgrf-fCEiAcoM7xCx9_f8qlRy7nhQPyjOIHn5eEJEir0uSu6gdqR9afnVZ3UoR-VOLdOBt7fA4ee38MP2ut5qWU50F5dvIezfKkTVDMHwztvcLCy6R9SVkdSYv6jwWGccYRl-aclvkkHu6SnbZGI7fmDZdkcBAxBHYEZZMmvb76ro4SO15GDyEVAo_Qf4trdrY_GyN_Bm73imCTjgtoGc

C:\Users\user\AppData\Local\Temp\5812_1821568228\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.7900469623255675
Encrypted:	false
SSDEEP:	3:SpOXzxlQ4BdPWfDL9c:SpOjDQFfVc
MD5:	2AE14F91312C4E8034366B09D49D5B18
SHA1:	AD4933A5D838D0FA0B960C327A5039A9E8249642
SHA-256:	4F122332EF0F2BB490EF59619D3602C1A7277C0A7A19C132202DB4803A09BFA2
SHA-512:	FB0CC467A4B8463F6A3BF42CDC11C23B34EB94A9397644B68714DCB819EE326BAE05022D59D23DC9907DF1E6928064D853FD0900BB6083417892D4D5A9BA7716
Malicious:	false
Preview:	1.aeedb246d19256a956fedaa89fb62423ae5bd8855a2a1f3189161cf045645a19

C:\Users\user\AppData\Local\Temp\5812_1821568228\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.682333395896383
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFJ9LAG9Xg0XTFHqS1wP/pEeSWU4pv/8F/FxLj2RF2fcTZTotL:F6VlM90ggITgS1wnuWfB0NpK4aotL
MD5:	7A8E3A0B6417948DF4D49F3915428D7A
SHA1:	4FC084AABDB13483567D5C417C7ED8FD16726A80
SHA-256:	D1AC274CF1018020F2D9635A518ED1A1F21CC2CBE9E2A4392EC792D54B5B52FE
SHA-512:	064D84A57B28C19AD10742859DA493D0826B47ADC632F6C623DFB4DE36D72A9D29BE98518061A9FFD42D99FCF01F27DE39CE74782B3A5ACBBE11DFDDEEAB59A1
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "ImprovedRecoveryComponentInner",. "version": "1.3.36.141",. "imageName": "image.squash",. "squash": true,. "fsType": "squashfs",. "isRemovable": false.}

C:\Users\user\AppData\Local\Temp\5812_1912184682\LICENSE

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	5.11458514637545
Encrypted:	false
SSDEEP:	48:OBOCrYJ4rYJVwUCLHDy43HV713XEyMmZ3teTHn:LCrYJ4rYJVwUCHZ3Z13XtdUTH
MD5:	EE002CB9E51BB8DFA89640A406A1090A
SHA1:	49EE3AD535947D8821FFDEB67FFC9BC37D1EBBB2
SHA-256:	3DBD2C90050B652D63656481C3E5871C52261575292DB77D4EA63419F187A55B
SHA-512:	D1FDCC436B8CA8C68D4DC7077F84F803A535BF2CE31D9EB5D0C466B62D6567B2C59974995060403ED757E92245DB07E70C6BDDBF1C3519FED300CC5B9BF9177C
Malicious:	false
Preview:	// Copyright 2015 The Chromium Authors. All rights reserved..//.// Redistribution and use in source and binary forms, with or without.// modification, are permitted provided that the following conditions are.// met:.//.// * Redistributions of source code must retain the above copyright.// notice, this list of conditions and the following disclaimer..// * Redistributions in binary form must reproduce the above.// copyright notice, this list of conditions and the following disclaimer.// in the documentation and/or other materials provided with the.// distribution..// * Neither the name of Google Inc. nor the names of its.// contributors may be used to endorse or promote products derived from.// this software without specific prior written permission..//.// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.// A PARTICULAR

C:\Users\user\AppData\Local\Temp\5812_1912184682\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	5.985769367178764
Encrypted:	false
SSDEEP:	24:pZRj/flTU3YNvKKLjoYo7aoXCW4uNpe77HqpaUO31oXb2j53zcSdEyfpojfaMn:p/hUINvKKK7akVJ67dp31kb2FGy+baM
MD5:	691CA7C80BBD6CD8F767A94D2BD6E46C
SHA1:	7EEB0F2AC3DD7C50EDABB9EE74D081291AD214DB
SHA-256:	CFDF246C2275BE2BD85C85706816E1F7B682940539F59110401231397784C920
SHA-512:	4256FD9B2DD84708FA83D2617984D93AA8F7F29DDB6B9D5AB2288B254728D52B1C3CFF4B58F2160A569A0D83656B1140BAACA850E6821E681EA457FFBCB71F15
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJMSUNFTlNFIiwicm9vdF9oYXNoIjoiUGIwc2tBVUxaUzFqWldTQnctV0hIRkltRlhVcExiZDlUcVkwR2ZHSHBWcyJ9LHsicGF0aCI6ImNybC1zZXQiLCJyb290X2hhc2giOiJHeUtPQnIwRlpET0kyUlRlS2ttZXF2eGUzQzZoQ3MxQTZDNzczN0tkeGw0In0seyJwYXRoIjoibWFuaWZlc3QuanNvbiIsInJvb3RfaGFzaCI6IjE2bmlaSjlEN3UtQm5RRnVubWVmcUZhVFRoejBuc0tNVEc3V2tOQUhWYmcifV0sImZvcm1hdCI6InRyZWVoYXNoIiwiaGFzaF9ibG9ja19zaXplIjo0MDk2fV0sIml0ZW1faWQiOiJoZm5rcGltbGhoZ2llYWRkZ2ZlbWpob2ZtZmJsbW5pYiIsIml0ZW1fdmVyc2lvbiI6Ijc0ODIiLCJwcm90b2NvbF92ZXJzaW9uIjoxfQ","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"Sk5xFIMDyLTyKc0a-F3sF8hdcgI5421YDTiSYDR-4TcYbVbSatHJNNW_EFvZ9lEXbhe9Kd-4zob56ryXSSnky1QCTBOpNle9pR3gxTDQ8Sc1ppYKDXXJTxQdaKN4NxZhxgXl6VDm0AavM_6rBPZ4CnrnChHym58H36tjKF80ut0TDxZsh4Yn4zV8DWvc_JIbQzn72bmhv_hHeP2GOCHTme3bblF8c_PTPDyx2PEfWmXxAe6DIhKNvdj54zNigSlqGmQ

C:\Users\user\AppData\Local\Temp\5812_1912184682\crl-set

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	22878
Entropy (8bit):	7.83795123838276
Encrypted:	false
SSDEEP:	384:x26XPK4VeWcURWVPODJc4m8dWxmXYoBZsTQ4k5bYTaQzsvFvatr4G9h96/HDufBr:xfD8ZVGDJJTW0XYozmQ4+YTaSKCr4G0u
MD5:	EE27289E5C0FC63BD82DCDB2FCBA1700
SHA1:	7F6AB7BA2D7BE8C8953DABF143EB9F49AB26EEAC
SHA-256:	FA3BC612CA4564D027FC394D9AA54AFE8905B420D6AFB475972F25AB7239C66F
SHA-512:	E1F4B8F6A1777EC07148B2F6556AECF3D9ECDEA088A8AE8CF85E7EB4E93CF9F9C1D04A6D718F2625E0DC7B2946A53B8D29D17E34C4B39D7ABBB28FCF6B28DF89
Malicious:	false
Preview:	".{"Version":0,"ContentType":"CRLSet","Sequence":7482,"DeltaFrom":0,"NumParents":193,"BlockedSPKIs":["Jdoa1Yu/z7In2HI7GFfUwY57qnQXtPnv+TZrXoafizk=","li5LVLuYp+5dX+uWM/mR08MwDpUU2t57DU+CjHlPjoc=","yP3cdcsb27WMB7TqhHKH9iZlndZrwQomrdm1dbOgo40=","BN3pqpp59hSYaCMl+ghwJ2cH+5ypU4QSC0aJMmhJT8k=","tbqN1/iVZMKInT1kU8hJmMd4JJGbZOoINapimGWRvlA=","wO0gU0a7veButWD1zuAqNjTiR0p+ds+PvvVjuxF90OM=","eBpM8ukkUvPuAdDDgaQhTzkEFlw5CtvWH80RJE4Jstw=","/NdsyiNH5c1bOTR/Uc9DZUtpor/JBzZwpr5H2HAebg4=","lo26afv/Fb83YgiUMa3lp+rUt+rxvnACaBC8V9HGT24=","fNKVt1VEgIq9lAlGbwg3xarcAuM7YVDGZE3goJZZ8jw=","9Sk9R+041MMbLULe47WzrOl8omyirANl42Iu6AITH7s=","nFmjzK6kaZhCsGjPxSz5RdtRmGlXyDLNsYynOEn7ue4=","OUz/WJ5okxLPwHHuC8Gf5MYGIWzlQ0Kd5tti5C27O8E=","NuqWEoyJg5+2IfitDh7gucIgb2Kre02ixnZYk8m3ztI=","pqyh7JgJzFtIIf+dKcXr5lGWC5Gx8ZzIm1Xvh4GKlQk=","MO/kE4JHbDOA8C9+I+ZrovhnsFnuHqaHlrRBuFtdElY=","r1kVGOLmxg67/AkHr6pJvEBR1F5/IUq/7nUS7gD2Ye0=","6EnHF2yT32X2S2FpgjZuVmMReBK2+ivAyPqK6u5Bgcw=","0x7DkoW3pTGdAVfbQg7YfHQ+Mzu8d/h3H3BGT0NqYEk=","h7/Yr

C:\Users\user\AppData\Local\Temp\5812_1912184682\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.8528001358115724
Encrypted:	false
SSDEEP:	3:SVBd8EVnDTApOhAVaTlEDKYn:S7VDAmh2KYn
MD5:	DB301339223A5D44633B22805259975F
SHA1:	3C8A7A61D52E91E86325BFB6050137A706E5B832
SHA-256:	1FA5430BC9993F7D4AD95D8728F3B20547FE6DA561D6B7949797FA8A1B67513D
SHA-512:	A11107AC70D60BBAF5119CB4AE68D42CB124DF20FD9E1E19FC907C5999AAC12727B2D788120224E0C347EC95C632D1B3C61488C33610E6C6453BD0F3CD348BBB
Malicious:	false
Preview:	1.09dab8507c15a0ada2555e77f2feb472da812a6752de2e0386299bbba8a11661

C:\Users\user\AppData\Local\Temp\5812_1912184682\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	190
Entropy (8bit):	4.774623125717942
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFJU/QV5WRKFgS1opJEeSWU4pv/8F/FxLj2RF2fcTZTotL:F6VlMs/lR/S1opOWfB0NpK4aotL
MD5:	C9C7D0B89B2F270BE33297E9C0C89CB7
SHA1:	EE177AE5DAA7C2CFA902759530D120B56B08FF8E
SHA-256:	D7A9E2649F43EEEF819D016E9E679FA856934E1CF49EC28C4C6ED690D00755B8
SHA-512:	088D93BB0E242A70893E13CA35A2B40AC454ACB6324C6717CCD32DE33922104011D9EBBCD45FBE78BF5386FA6BE1D14561F0D4B1E60F2548D05F6483B939C406
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "crl-set-150087025983073870.data",. "version": "7482",. "imageName": "image.squash",. "squash": true,. "fsType": "squashfs",. "isRemovable": false.}

C:\Users\user\AppData\Local\Temp\5812_1989253452\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	6.006853257458947
Encrypted:	false
SSDEEP:	24:pZRj/flTm6MhvtGpqYiyfdpFpNizkaoXCope0vtjXD/heMF8fgqoXx8VaO95eumN:p/h4FI1Hfdp/NikakCo4AtjXr59qkOa9
MD5:	EC8699952FD7EF71EBE8F45CADF2046D
SHA1:	E7246D7B5AE48C892ED24B6D3F81FDD66B638604
SHA-256:	1C81D43DB200F4ED1ACEF95A4ED69D99ED2973B466DA5A4BFED724926B756027
SHA-512:	1571DB91CDF87671760B06B1EF0EE7B79EA879F8AD71C14A526230264801ADABFE5E4EB2DA17F054DF3BCCA1622EE8BC8241A5B3C1EE40AD93EDDD9591C958DF
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJkb3dubG9hZF9maWxlX3R5cGVzLnBiIiwicm9vdF9oYXNoIjoiekd1OFNyWE56YWp3ZGhCSmtpZXZZWmRqTXA0Y3lnSElZMVRGQjZ3Q3BaQSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJtcTVMa213UHJhelRNX3ZHQU5wQlFJQTFKdHM2c3FrT3YtYzAzbVdWSm1nIn1dLCJmb3JtYXQiOiJ0cmVlaGFzaCIsImhhc2hfYmxvY2tfc2l6ZSI6NDA5Nn1dLCJpdGVtX2lkIjoia2hhb2llYm5ka29qbG1wcGVlbWpoYnBiYW5kaWxqcGUiLCJpdGVtX3ZlcnNpb24iOiI1MSIsInByb3RvY29sX3ZlcnNpb24iOjF9","signatures":[{"header":{"kid":"publisher"},"protected":"eyJhbGciOiJSUzI1NiJ9","signature":"0mlVKh0U_5rfXH2M8gr-QNee1za-5wIRHW8zk5NyBFDHbhqSzhhokA6hAr2wWF4YYIvQVzbFyxI8YTzyiq5eREFDRi13P3xlqx2XCkoBzRnuhu1wnjFw7noyyJsu4VkkzMyvsKxp8pXM_xn4YMoYKKVGsXoCdl4rqzmhHk7DDPQWXYO07v8Ygi1zEyKr6NNaElLbxyHQqKO6uTQdxPZ4brHY1-tCSHV6NmweLbs4dxjWzr60tISaUhESrbSwE4encq5THrEXi900aSwHl-0CqsD6lpZP4BIDnIqp_9b4S-fA1PLwsXRhY3YYD4DKerYS7cZE_yHK0Bh-3-3_ouTAfw"},

C:\Users\user\AppData\Local\Temp\5812_1989253452\download_file_types.pb

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	dropped
Size (bytes):	7716
Entropy (8bit):	5.129588744479821
Encrypted:	false
SSDEEP:	192:f0aEW8SsWk/pvtHB3Nf5Y10k6QKEa4pmigb1BPxzOaRsO6v:f0aEW8SsWk/pvtHB3Nf5YKk6QKEa4pmA
MD5:	6AE4B0CE9611B6BDF5CB5F2804ABC86F
SHA1:	38A7038DE1279146680299FD10C8D7D2CFE9D898
SHA-256:	DDCFA9305103E37BAE828EE2EBFDF6666A34B10734B34C9BA4EE98A41BD71A33
SHA-512:	554E303609759AE8F370AB3703F100EB0DE3C3DBA736A370C7DFC3FEEA5CC7A08A23C6D29A13E84C75E5610EB972B47303B87D6646CDF45D837AB3E840FD902A
Malicious:	false
Preview:	.3...#<....jpg... ..........jpeg... ..........mp3... ..........mp4... ..........png... ..........csv... ..........ica... ..........gif... ..........txt... ..........package... ..........tif... ..........webp... ..........mkv... ..........wav... ..........mov... ..........avif... ..........swf.D ..........spl.E ..........crx.. ..........001..... ..........7z.4.. ..........ace..... ..........arc..... ..........arj.:.. ..........b64..... ..........balz..... ..........bhx..... ..........bin..... ......0.....bz..... ..........bz2.8.. ..........bzip2..... ..........cab.... ..........cpio.@.. ..........fat..... ..........gz.6.. ..........gzip..... ..........hfs..... ..........hqx..... ..........iso..... ......0.....lha.<.. ..........lpaq1..... ..........lpaq5..... ..........lpaq8..... ..........lzh.;.. ..........lzma.?.. ..........mim..... ..........ntfs..... ..........paq8f..... ..........paq8jd..... ..........paq8l..... ..........paq8o.....

C:\Users\user\AppData\Local\Temp\5812_1989253452\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.8964453558303034
Encrypted:	false
SSDEEP:	3:SVYSQc3xbaSEFHEGUQ3DdBn:SfQqUHvU4dB
MD5:	630815B3559AC244B058F338494FAC16
SHA1:	41272BAF131EC1B8B94039D28D1D5173F6E8AFE4
SHA-256:	E21B642897B112D835FE4A04EFEA15F198A1C4ADD4B921AC098DAB191D669284
SHA-512:	3C9548E8C2769880A15F620EE52330096AB576A2F439CF7C2A29CCD2394BD6A737F962F8F96627F0FF94C740B92D65F5A92DC886F5B12512BF075169D096584F
Malicious:	false
Preview:	1.0835331e67dfbac434441ed07a3afbbea7671820ce2c0dbc1f351fd20c3f8a05

C:\Users\user\AppData\Local\Temp\5812_1989253452\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	173
Entropy (8bit):	4.479129266715852
Encrypted:	false
SSDEEP:	3:rR6TAulhFphifFRxJ1KnOFgS1BEeSWU4pv/8F/FxLj2RF2fcTZTotL:F6VlMDf1KqgS12WfB0NpK4aotL
MD5:	D354060BBF9C1C00C45EFD9A5D7265E5
SHA1:	8A6B296FA53516F82819655F00AA88E54D359B30
SHA-256:	9AAE4B926C0FADACD333FBC600DA4140803526DB3AB2A90EBFE734DE65952668
SHA-512:	BF5AF3A57A05E4ABBC9C0CF3675B7744940068D6C1309A3562106FAC747D4A6D8B2029027C85C1479AA26AADBE8DA11E6A5476E3C8C3808EEA33C2A666239764
Malicious:	false
Preview:	{. "manifest_version": 2,. "name": "fileTypePolicies",. "version": "51",. "imageName": "image.squash",. "squash": true,. "fsType": "squashfs",. "isRemovable": false.}

C:\Users\user\AppData\Local\Temp\5812_2020592197\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	3034
Entropy (8bit):	5.876664552417901
Encrypted:	false
SSDEEP:	48:p/hEc9q0S+UTKYM43z8nqMsfWRUWEADM/W9n7lqFkakzcVTGkcYTPi6zM:RGcg5z/jjjHgUnV278+aWLy4
MD5:	8B6C3E16DFBF5FD1C9AC2267801DB38E
SHA1:	F5CADC5914DF858C96C189B092BC89C29407BBAA
SHA-256:	FD986A547D9585E98F451B87CA85DEB4B61EE540C6FAC678D7BEDABF04653095
SHA-512:	37048EF8FADF62A26CAEC6EE90AC192429AB1E99424E5C68FACA90C0DAD68642C761FDCAC03FC38FA930841F91FA145A6943EC7F168D4F2FA426F1F092C2F502
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJfcGxhdGZvcm1fc3BlY2lmaWMveDg2XzY0L3BuYWNsX3B1YmxpY19wbmFjbF9qc29uIiwicm9vdF9oYXNoIjoiVkNUSHNJVHNUSXVncWNhV2ctWHVpTU1sdWloV1FSTE1sQnpTTGprdGhETSJ9LHsicGF0aCI6Il9wbGF0Zm9ybV9zcGVjaWZpYy94ODZfNjQvcG5hY2xfcHVibGljX3g4Nl82NF9jcnRiZWdpbl9mb3JfZWhfbyIsInJvb3RfaGFzaCI6ImxINWt2a1BvSVZZczZKVHhyOHc5Q2MxXzloVEJCX3lVSlF6VDZseVVNd0kifSx7InBhdGgiOiJfcGxhdGZvcm1fc3BlY2lmaWMveDg2XzY0L3BuYWNsX3B1YmxpY194ODZfNjRfY3J0YmVnaW5fbyIsInJvb3RfaGFzaCI6IkVuLVFQTW1HUm1xbG9Ud1gzOTAzckpsMkw0R25sQmdET1FhZlNKaHJ4Nk0ifSx7InBhdGgiOiJfcGxhdGZvcm1fc3BlY2lmaWMveDg2XzY0L3BuYWNsX3B1YmxpY194ODZfNjRfY3J0ZW5kX28iLCJyb290X2hhc2giOiJkT2lJVzRmdEdGNW9FY0k1UXYyYjBmdXNrUlYyaUVtdmxhbmV6MlpFc3VvIn0seyJwYXRoIjoiX3BsYXRmb3JtX3NwZWNpZmljL3g4Nl82NC9wbmFjbF9wdWJsaWNfeDg2XzY0X2xkX25leGUiLCJyb290X2hhc2giOiIzNEU5QU9EMmpqLWNoMzZQZ0NVV0YtMUpYWVhVdlNGY1I4bks1aWppcWNjIn0seyJwYXRoIjoiX3B

C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_pnacl_json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	507
Entropy (8bit):	4.68252584617246
Encrypted:	false
SSDEEP:	12:TjLJ7qaVgPPd8bdzQBXefosmc5T9+n6e1Cetm1JXcAwA:TJ7jViPOd8wfHmZ6RP15
MD5:	35D5F285F255682477F4C50E93299146
SHA1:	FB58813C4D785412F05962CD379434669DE79C2B
SHA-256:	5424C7B084EC4C8BA0A9C69683E5EE88C325BA28564112CC941CD22E392D8433
SHA-512:	59DF2D5F2684FACC80C72F9C4B7E280F705776076C9D843534F772D5A3D578BEE04289AEE81320F23FB4D743F3969EDF5BA53FEBBAC8A4D27F3BC53BCF271C3E
Malicious:	false
Preview:	{. "COMMENT": [. "This file serves as a template for the resource info description used by ", . "the NaCl Chrome plugin. It is kept in the NaCl repository to prevent ", . "hard-coding of NaCl-specific information inside the Chrome repository.". ], . "abi-version": 1, . "pnacl-arch": "x86-64", . "pnacl-ld-name": "ld.nexe", . "pnacl-llc-name": "pnacl-llc.nexe", . "pnacl-sz-name": "pnacl-sz.nexe", . "pnacl-version": "5dfe030a71ca66e72c5719ef5034c2ed24706c43".}

C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_crtbegin_for_eh_o

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
Category:	dropped
Size (bytes):	2712
Entropy (8bit):	3.4025803725190906
Encrypted:	false
SSDEEP:	48:b/5D5V5PK82aTS6aTTw0Do1DttoyDNsEA:b/hbVic1ZtLDNsE
MD5:	604FF8F351A88E7A1DBD7C836378AE86
SHA1:	9D8D89AE9F13D6306E619A4EAAD51EDE91A5F9F3
SHA-256:	947E64BE43E821562CE894F1AFCC3D09CD7FF614C107FC94250CD3EA5C943302
SHA-512:	85B1EDA4C473E00034EE627B7ABB894A77E521BC6A91A91A4A3744CA7511CB0AF10B9723D9ECC2CE3378DD70B659DF842D8C11875958CB77070CF01EC0A15840
Malicious:	false
Preview:	.ELF..............>.................................@.....@.......................................PH.......,$J.l=....J.$<A[..@.A...M..A..ffffff..................PH......,$J.l=....J.$<A[..D..A...M..A..ffffff..................PH..1..,$J.l=....J.$<A[.......A...M..A..ffffff..................PH..SP..h.........fff...................h.........fff.............J.$<[.,$J.l=....J.$<.....f.....................................................................................................................................................................................NaCl....x86-64...........zR..x......................@....C....C.........8.......@....C....C.........T.......@....C....C.........p.......`....C....C..B...... .......................<...............@.......X.......................t........................clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pna

C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_crtbegin_o

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
Category:	dropped
Size (bytes):	2776
Entropy (8bit):	3.5335802354066246
Encrypted:	false
SSDEEP:	48:b/5D5V5ej5ej5PjDdaTS6aTTw6DV1DtFouoyDOsTy:b/hbEEVJB1ZFhLDOsT
MD5:	88C08CD63DE9EA244F70BFC53BBCADF6
SHA1:	8F38A113A66B18BAA02E2C995099CF1145A29DAA
SHA-256:	127F903CC986466AA5A13C17DFDD37AC99762F81A794180339069F48986BC7A3
SHA-512:	78D2500493A65A23D101EC2420DC5F0CE8C75EFAC425C28547121643E4FB568E9D827EF2C0F7068159E043C86B986F29BF92C6BADC675F160B63C7B3512EB95F
Malicious:	false
Preview:	.ELF..............>.....................X...........@.....@.......................................PH.......,$J.l=....J.$<A[..@.A...M..A..ffffff..................PH......,$J.l=....J.$<A[..D..A...M..A..ffffff..................PH..1..,$J.l=....J.$<A[.......A...M..A..ffffff..................PH..,$J.l=....J.$<A[f........A...M..A..ffffff..................PH..,$J.l=....J.$<A[f........A...M..A..ffffff..................PH..SP..h.........fff.............J.$<[.,$J.l=....J.$<.....f.K...............`.......P.......................z...................................NaCl....x86-64...clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f)............zR..x......................@....C....C.........8.......@....C....C.........T.......@....C....C.........p.......@....C....C.................@....C....C.................@...

C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_crtend_o

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB relocatable, x86-64, version 1 (SYSV), not stripped
Category:	dropped
Size (bytes):	1520
Entropy (8bit):	2.799960074375893
Encrypted:	false
SSDEEP:	12:Bvx/ekjlM/NQQmTfR9yp9396QQmTfR9C6wRqD8MTDDw7lEOkSbfuEAXwX6BX2U8b:bDjO/NbmT3296bmT3Twk8qDwh7b7CD8
MD5:	75E79F5DB777862140B04CC6861C84A7
SHA1:	4DB7BDC80206765461AC68CEC03CE28689BBEE0C
SHA-256:	74E8885B87ED185E6811C23942FD9BD1FBAC9115768849AF95A9DECF6644B2EA
SHA-512:	FE3F86E926759E71494F2060C4ED3C883EBCAF20CB129A5AD7F142766C33FAB10B5FABC3C7C938E0E895E27EA0AC03CBFE8D0EEABF5300A4AD07F67FD96CC253
Malicious:	false
Preview:	.ELF..............>.................................@.....@.........................NaCl....x86-64.......clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f)...text..comment..bss..group..note.GNU-stack..eh_frame..shstrtab..strtab..symtab..data..note.NaCl.ABI.x86-64.......................................................!................................................................................................................................................................................................../../../pnacl/support/crtend.c.__EH_FRAME_END__...............................................................................................@...............................................................H.......................................P.......................H...............................

C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_ld_nexe

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=7511538a3a6a0b862c772eace49075ed1bbe2377, stripped
Category:	dropped
Size (bytes):	2163864
Entropy (8bit):	6.07050487397106
Encrypted:	false
SSDEEP:	24576:HPHonIwYZJ0ykwVO7Owf31yJKzCtxO8RSV4lY+PbeHVxCtjFV4lBNeSAmfGqa+A7:HvSMRwf3SKmlY+PyPvnM2Gq+
MD5:	0BB967D2E99BE65C05A646BC67734833
SHA1:	220A41A326F85081A74C4BB7C5F4E115D1B4B960
SHA-256:	C6C2D0C2FC3E38A9BFA19C78066439C2F745393F1FD1C49C3C6777F697222C76
SHA-512:	8EF8689E00E4B210A30444D18ED6247F364995ABEB2FD272064C3AF671EEDB4D9B8B67CA56F72FEBF8F56896D4EA7EC4B10CB445FFA1C710C1F312E9DA0E4896
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	.ELF..............>..... .......@.........!.........@.8...@......................................................................................................................................................{......W...............................................@.......@...............P.td.....h.......h.......h......4b......4b..............Q.td................................................................NaCl....x86-64..............GNU.u.S.:j..,w...u...#w.......?......Y@.......@......1@......B@......P@.....@X@.....``@......h@.....pp@.....H.@.......@.......@.......@.......@.......@....`..@.......@.......A.......A......................p................@..............?.......A.........5.....?5.5...?.5.....?......P9..............PC.......?......0@................aCoc...?..`.(..?.y.P.D.?<.s..O.u......$@.......@...............@........................................ ... ....... .......@...`...`...`...`...................`...`...`...`...`...`...`...................................`...

C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_libcrt_platform_a

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	40552
Entropy (8bit):	4.127255967843258
Encrypted:	false
SSDEEP:	768:xlP+1fzyUNVU5LmKxeOnjpD5eA/eUnUUxvT:xlP+1ryYMTekpD5eAWjuvT
MD5:	0CE951B216FCF76F754C9A845700F042
SHA1:	6F99A259C0C8DAD5AD29EE983D35B6A0835D8555
SHA-256:	7A1852EA4BB14A2A623521FA53F41F02F8BA3052046CF1AA0903CFAD0D1E1A7B
SHA-512:	7C2F9BF90EB1F43C17B4E14A077759FA9DC62A7239890975B2D6FD543B31289DC3B49AE456CA73B98DE9AC372034F340C708D23D9D3AAB05CCBDABDC56A6314E
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 624 `...................,...8...Z(..e...e...t...t...y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`..y`........................fmod.fmodf.memcmp.memcpy.memmove.memset.__nacl_read_tp.__pnacl_init_irt.longjmp.setjmp.__Sz_fptosi_f32_i64.__Sz_fptosi_f64_i64.__Sz_fptoui_f32_i32.__Sz_fptoui_f32_i64.__Sz_fptoui_f64_i32.__Sz_fptoui_f64_i64.__Sz_sitofp_i64_f32.__Sz_sitofp_i64_f64.__Sz_uitofp_i32_f32.__Sz_uitofp_i32_f64.__Sz_uitofp_i64_f32.__Sz_uitofp_i64_f64.nacl_tp_tdb_offset.nacl_tp_tls_offset.__Sz_bitcast_16xi1_i16.__Sz_bitcast_8xi1_i8.__Sz_bitcast_i16_16xi1.__Sz_bitcast_i8_8xi1.__Sz_fptoui_4xi32_f32.__Sz_uitofp_4xi32_4xf32..e_fmod.o/ 0 0 0 644 2792 `..ELF..............>.....................(...........@.....@.......................................PH..AVAUATSfI.~.M..I.. E....@.A......D..D1.......8fI.~.M.....I.. E..A......D..D..t.D....D..f....D..=....r...Y...^.[A\A]A^..@..,$J.l=....J.$<A[A...M..

C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_libgcc_a

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	132784
Entropy (8bit):	3.6998481247844937
Encrypted:	false
SSDEEP:	384:Hf0mOXYmeKzQUIdedRFvT5p1Ee2HyAlL3O4:Hf7OXdmWRJT5p1R2HyAhO4
MD5:	C37CA2EB468E6F05A4E37DF6E6020D0F
SHA1:	EA787E5EADFB488632EC60D8B80B555796FA9FE9
SHA-256:	C1483ED423FEE15D86E8B5D698B2CDAB89186CE7FF9C4E3D5F3F961FD80D7C6E
SHA-512:	01281DE92B281FB29E1ACA96AA64B740B65CC3A9097307827F0D8DB9E1C164C56AFCDFA0BF138EA670A596D55CE2C8D722760744E9FC9343BB6514417BF333BA
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 942 `....;...\|.......4...x..#...-...4l..E...M...U...]...n...u...~X...4.......................L......................t...p...............`......"...*...1...:...D...K...T...\...d...r\|..\|0.......x...........L.......\...8..........................__clzti2.__compilerrt_fmax.__compilerrt_fmaxf.__compilerrt_logb.__compilerrt_logbf.__ctzti2.__divdc3.__divdi3.__divmoddi4.__divmodsi4.__divsc3.__divsi3.__divti3.__fixdfdi.__fixdfsi.__fixdfti.__fixsfdi.__fixsfsi.__fixsfti.__fixunsdfdi.__fixunsdfsi.__fixunsdfti.__fixunssfdi.__fixunssfsi.__fixunssfti.__floatdidf.__floatdisf.__floatsidf.__floatsisf.__floattidf.__floattisf.__floatundidf.__floatundisf.__floatunsidf.__floatunsisf.__floatuntidf.__floatuntisf.compilerrt_abort_impl.__moddi3.__modsi3.__modti3.__muldc3.__muloti4.__mulsc3.__multi3.__popcountdi2.__popcountsi2.__popcountti2.__powidf2.__powisf2.__udivdi3.__udivmoddi4.__udivmodsi4.__udivmodti4.__udivsi3.__udivti3.__umoddi3.__umodsi3.

C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_libpnacl_irt_shim_a

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	13514
Entropy (8bit):	3.8217211433441904
Encrypted:	false
SSDEEP:	192:uU9v4pXizdrEuxwk3vp20tprpdSGFwDqO:P9v4palvvc0tpFdSGFwmO
MD5:	4E8BEDA73EB7BD99528BF62B7835A3FA
SHA1:	DC0F263A7B2A649D11FF7B56FE9CFAC44F946036
SHA-256:	6B835FD48DF505EB336FF6518CE7B93BB0ED854DADAA5C1EEED48D420291F62C
SHA-512:	46116B8BABC719676D68FD40D2AC82F38A3D13D8A482ADFC6FC32A99170AC3420E52CC33242CCD0FA723ABF4FA5EDBB9CE16A09C729BF04AE4AFBB2F67A1E38B
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 94 `................._pnacl_wrapper_start.__pnacl_real_irt_query_func.__pnacl_wrap_irt_query_func..shim_entry.o/ 0 0 0 644 7392 `..ELF..............>..................... ...........@.....@.........................NaCl....x86-64..................................A.L....A.L...D...........D....A.....t+.. u..t"..A.D..........A... .....A.D...........f..D..<.......................Q.......................V.......................clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f).../../ppapi/native_client/src/untrusted/pnacl_irt_shim/shim_entry.c./mnt/data/b/build/slave/sdk/build/src/out_pnacl/x64.NACL_STARTUP_FINI.NACL_STARTUP_ENVC.NACL_STARTUP_ARGC.NACL_STARTUP_ARGV.NaClStartupInfoIndex.unsigned int.size_t.char.TYPE_na

C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_libpnacl_irt_shim_dummy_a

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	2078
Entropy (8bit):	3.21751839673526
Encrypted:	false
SSDEEP:	24:MOcpdhWE5O/bZbmT3296bmT3TwQwDnvD/+R3:MHuECdaTS6aTTwXDvD/+l
MD5:	F950F89D06C45E63CE9862BE59E937C9
SHA1:	9CFAD34139CC428CE0C07A869C15B71A9632365D
SHA-256:	945B1C8A1666CBF05E8B8941B70D9D044BAAFB59B006F728F8995072DE7C4C40
SHA-512:	F9AFBB800A875EDCC63DEA4986179E73632B3182951A99C8B3D37DB454EFD7CC7192ECA5AC87514918A858BAD6DAEAB59548CA2E90EADA9900EF5B9F08E62CFC
Malicious:	false
Preview:	!<arch>./ 0 0 0 0 30 `........._pnacl_wrapper_start..// 20 `.dummy_shim_entry.o/./0 0 0 0 644 1840 `..ELF..............>.................................@.....@.......................................PH..,$J.l=....J.$<.....f..D......................................NaCl....x86-64...clang version 3.7.0 (https://chromium.googlesource.com/a/native_client/pnacl-clang.git ce163fdd0f16b4481e5cf77a16d45e9b4dc8300e) (https://chromium.googlesource.com/a/native_client/pnacl-llvm.git 7251d5b59fca15195c94a3a7da70f0081724448f)............zR..x...................... ....C....C..... .........................rela.text..comment..bss..group..note.GNU-stack..rela.eh_frame..shstrtab..strtab..symtab..data..note.NaCl.ABI.x86-64.....................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_llc_nexe

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=309d6d3d463e6b1b0690f39eb226b1e4c469b2ce, stripped
Category:	dropped
Size (bytes):	14091416
Entropy (8bit):	5.928868737447095
Encrypted:	false
SSDEEP:	196608:tKVqXp3Qev4dg6ilfHM8KLM2J3jqjnkZ:uqufB
MD5:	9B159191C29E766EBBF799FA951C581B
SHA1:	D1D4BBC63AB5FC1E4A54EB7B82095A6F2CE535EE
SHA-256:	2F4A3A0730142C5EE4FA2C05D27A5DEFC18886A382D45F5DB254B61B28ED642B
SHA-512:	0B4FF60B5428F81B8B1BCF3328CF80CBD88D8CE5E8BDBC236B06D5A54E7CF26168A3ABB348D87423DA613AB3F0B4D9B37CB5180804839F1CA158EC2B315DDF00
Malicious:	false
Antivirus:	Antivirus: Virustotal, Detection: 0%, Browse Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	.ELF..............>..... .......@...................@.8...@...............$.....................................................................................................................!.......!......'......G...............................................@.......@...............P.td............................D.......D...............Q.td................................................................NaCl....x86-64..............GNU.0.m=F>k....&...i........................0C......0C..0C..0E..............0C......0E.-DT.!.?.-DT.!.........................?........-DT.!...-DT.!.?.......?......................?..............?."..."..."..."......@.......`...................... ...@...`...................... ...@...`...................... ...@...`...................... ...@...`.......................................`... ...@...`...........`...`.......@...@....... ....1..`3.. 4..`-..`-...:...:...F..@H..`H...H...F...F...G...H.. H...F..@G...I.. I..@I..@G...G...I...I...J...G..`I..

C:\Users\user\AppData\Local\Temp\5812_2020592197\_platform_specific\x86_64\pnacl_public_x86_64_pnacl_sz_nexe

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=4b15de4ab227d5e46213978b8518d53c53ce1db9, stripped
Category:	dropped
Size (bytes):	1901720
Entropy (8bit):	5.955741933854651
Encrypted:	false
SSDEEP:	12288:gXqUSpBjwQO2o8k+7zjidg4euCAauOILffvCpGy4Wh3BTFmHpq82K2/KsvPyla9d:gafZwcOdNe2auOepCBTFmJq3Kf8ksr
MD5:	9DC3172630E525854B232FF71499D77C
SHA1:	0082C58EDCE3769E90DB48E7C26090CE706AD434
SHA-256:	6AA1DA6C264E0AF4E32A004F4076C7557C6AC6D9C38B0C5DE97302D83FA248C3
SHA-512:	9E9584241A39EED1463D7D4C1B26AE570B839AA315778FF3400C61341EBA43B630307DE9F1532A265CA82EA69BDEA03EC9D963E59A18569C02DA8285449870FE
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	.ELF..............>..... .......@...................@.8...@.............................................................................................0.......0................................................Y......................................................@.......@...............P.td....t^......t^......t^.......W.......W..............Q.td................................................................NaCl....x86-64..............GNU.K..J.'..b......<S...`...`... ...@...@.......@.............................................Y@......................p................@.......?..............?.......A.........5.....?5.5...?.5.....?......P9..............PC.......?......0@................aCoc...?..`.(..?.y.P.D.?<.s..O.u......$@.......@...............@`...`.......@.................................................. ...`... ... .......`................... ... ...@...`.......................@... Z...[...[...e.......... ...@... ...@...`........0...0...2..`4.. 6...7...9...~...~...z...{...{..

C:\Users\user\AppData\Local\Temp\5812_2020592197\manifest.fingerprint

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	66
Entropy (8bit):	3.928261499316817
Encrypted:	false
SSDEEP:	3:STDLGswXEVBcVdBiTDt3zLsW:SPLGLErcVdBiDtf3
MD5:	C00BCE97F21B1AD61EB9B8CD001795EE
SHA1:	8E0392FF3DB267D847711C3F4E0D7468060E1535
SHA-256:	59F06F04230E32E8BC839F45B984D31D611930427B631C963D09E7064A602363
SHA-512:	9930E44A6ECC62505DBADCEED5E05645909FF09816FB12AAC0414E6D2830AC09758366C3B7D4EDD7839C87EB16DFA4C66D8981AE6237D408B37135C3506F4CD2
Malicious:	false
Preview:	1.6f6bc93dcd62dc251850d2ff458fda96083ceb7fbe8eeb11248b8485ef2aea23

C:\Users\user\AppData\Local\Temp\5812_2020592197\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	573
Entropy (8bit):	4.859567579783832
Encrypted:	false
SSDEEP:	12:BLqG6yDJmL4mLDlG9hQ181G46XzrXc+EFfNqpaiOc+T5NqXIOclNqXL:BkylmL4mLDlJ18116XsRNqtZeNqXIZlE
MD5:	1863B86D0863199AFDA179482032945F
SHA1:	36F56692E12F2A1EFCA7736C236A8D776B627A86
SHA-256:	F14E451CE2314D29087B8AD0309A1C8B8E81D847175EF46271E0EB49B4F84DC5
SHA-512:	836556F3D978A89D3FC1F07FCED2732A17E314ED6A021737F087E32A69BFA46FD706EBBDFD3607FF42EDCB75DC463C29B9D9D2F122504F567BB95844F579831B
Malicious:	false
Preview:	{."update_url": "https://clients2.google.com/service/update2/crx",.. "description": "Portable Native Client Translator Multi-CRX",. "name": "PNaCl Translator Multi-CRX",. "manifest_version": 2,. "minimum_chrome_version": "30.0.0.0",. "version": "0.57.44.2492",. "platforms": [. {. "nacl_arch": "x86-32",. "sub_package_path": "_platform_specific/x86_32/". },. {. "nacl_arch": "x86-64",. "sub_package_path": "_platform_specific/x86_64/". },. {. "nacl_arch": "arm",. "sub_package_path": "_platform_specific/arm/". }. ].}.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ld4zpa0i.dum.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ord0zi3t.xib.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\c119d93e-a5ed-495e-9208-6adba0feafa0.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\36993d0a-d052-46f9-8c4f-49e73b36ae2f.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	248531
Entropy (8bit):	7.963657412635355
Encrypted:	false
SSDEEP:	3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
MD5:	541F52E24FE1EF9F8E12377A6CCAE0C0
SHA1:	189898BB2DCAE7D5A6057BC2D98B8B450AFAEBB6
SHA-256:	81E3A4D43A73699E1B7781723F56B8717175C536685C5450122B30789464AD82
SHA-512:	D779D78A15C5EFCA51EBD6B96A7CCB6D718741BDF7D9A37F53B2EB4B98AA1A78BC4CFA57D6E763AAB97276C8F9088940AC0476690D4D46023FF4BF52F3326C88
Malicious:	false
Preview:	Cr24..............0.."0....H.............0...........\7c.<........Fto.8.2'5..qk...%....2...C.F.9.#..e.xQ.......[...L\|....3>/....u.:T.7...(.yM...?V.<?........1.a...O?d.....A.H..'.MpB..T.m..Vn Ip..>k.\|1..n.<Fb..f..Q1.....s..2..{.6....Pp....obM..1.......b1.......(.u^.'z......v.F.W.X4."-eu...b.........\..F!...b...l5....zJ.q.......L].....w[T0.6....E.....r..%Z.vFm.9..5!,.~g5...;.t...']....+A.....u....k...e..&..l.6r[yU...%..f.......N..V.....<+.....l..}.{...z...)y.n..'..).....,.b....5.08K%..O.g..D.S.F5o..<(....>....\f..X..I..2."l...w....7f\|.~.c.4.E.......0..0....H............0.......).'..b.$w\$.q&.]zF_2..;...?.U,...W..L1.2...R..#....W.....c1k.$W..$.J....+M!.Hz.n`U.I)N.\|b.l....{.K@]6.LlP/....](.A..................I...).H....IQ.y.;MG.d..ix..#f.Z$\|..\|.?...0K...t"i..s...Y..%.Ky....0...{.!+.~v.;....J.....Z....).(6..@?v.;~..2..c....[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. .0...\|!..A..L.+.=...kP.!.1..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	796
Entropy (8bit):	4.864931792423268
Encrypted:	false
SSDEEP:	12:1HEJMLkSlwZGGMLkSlwZ+WYpU34f145Gb+dgoxTyO8ZpU34f1L0frhmJ03OyZnLt:1HE7n4gn8WYpYrbhz8ZpotHOGAOf6aD
MD5:	6F8E288A9AD5B1ED8633B430E2B4D4CA
SHA1:	F671D3D4BEFA431D1946D706F4192D44E29B6F08
SHA-256:	A114E2783D0E9B12155017323BA70838F0F82A71C7EE8DC1F115AE36991241F8
SHA-512:	0F87F3F0D115B872288949E59ACD3CD41B1FBC64A622D8FDA6D71FAFC5A900D92ADFBB0E7EB926F2A8759BBAA0896D48728FB719BBF5EF54AC21027328F7700C
Malicious:	false
Preview:	{.. "app_description": {.. "message": "........ . ... ........ .. Chrome".. },.. "app_name": {.. "message": "........ . ... ........ .. Chrome".. },.. "craw_app_unavailable": {.. "message": "........... .... ...... .. .............".. },.. "craw_connect_to_network": {.. "message": "...., ........ .. . ......".. },.. "iap_unavailable": {.. "message": "........... .... ...... .. .......... ....... .. .........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "...., ...... . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	675
Entropy (8bit):	4.536753193530313
Encrypted:	false
SSDEEP:	12:1HEJ0gbbGG0gbb+WYpU34g3YbiLO+dgyGFoO8ZpU34+puiPmb03OyZnLAOfTYABk:1HE5baib6WYpm31Lt0Z8Zp8pxOGAOfKD
MD5:	1FDAFC926391BD580B655FBAF46ED260
SHA1:	C95743C3F43B2B099FEBEBC5BD850F0C20E820AC
SHA-256:	C67898B67F9C9209EAFDA6532B62D5789863CFB855998DD6A70E7775316CEC20
SHA-512:	39D95D45C5746DA3BAA7AE6A3344EA17D7A7C3569C2A56959FF119261DA08C747A320FCF701AC72B8DBDBF8BF06FD8B239017A282CDDA444F3826D4EC672CBB4
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Sistema de pagaments de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagaments de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Ara mateix aquesta aplicaci. no est. disponible.".. },.. "craw_connect_to_network": {.. "message": "Connecteu-vos a una xarxa.".. },.. "iap_unavailable": {.. "message": "La funci. Pagaments a l'aplicaci. no est. disponible actualment.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicieu la sessi. a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	641
Entropy (8bit):	4.698608127109193
Encrypted:	false
SSDEEP:	12:1HEJfZGGfZ+WYpU34OBh+dgN/O8ZpU34j05U03OyZnLAOfTYWc:1HEl4G8WYpdt8Zpq5TOGAOfW
MD5:	76DEC64ED1556180B452A13C83171883
SHA1:	CFB1E56FD587BCDC459C1D9A683B71F9849058F9
SHA-256:	32290D69A90E6BAAC428B10382C99221B12773BB9A184F3B93DFB48A4F6D7A40
SHA-512:	5230A217968D5DC463E2E92D704544311A721E5CEF65C3125CBD8DEB9C0293D3BFB5C820A6011ABF77095FDEE7DAF67D541DC202B0C9CDB0908CBB85D84885CB
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "app_name": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikace v sou.asn. dob. nen. dostupn..".. },.. "craw_connect_to_network": {.. "message": "P.ipojte se pros.m k s.ti.".. },.. "iap_unavailable": {.. "message": "Platby v aplikaci aktu.ln. nejsou k dispozici.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "P.ihlaste se do Chromu.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.5289746475384565
Encrypted:	false
SSDEEP:	12:1HEJJMKKFZGGJMKKFZ+WYpU34OHu+dgxlCZO8ZpU34J4Wu03OyZnLAOfTYzD:1HErMKfqMKVWYpM6lL8ZpDNOGAOfiD
MD5:	238B97A36E411E42FF37CEFAF2927ED1
SHA1:	4E47AC90BA24C8F4724D9293FA40CFD4ADA66FE0
SHA-256:	4977D4A053542FF66967FAED6B06585DD70E68E20BFEB533B66FE3287F9655D9
SHA-512:	FD0742D47B5F5AB9AAD9B4C3D57F63CB693E060EECE123A72036C6E92156D099495C7E9E9CC6DC83EEBCDDCC4B4C81FB47E4C9559DA3EBA024780FFF10C53E0A
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Betalinger i Chrome Webshop".. },.. "app_name": {.. "message": "Betalinger i Chrome Webshop".. },.. "craw_app_unavailable": {.. "message": "Appen er ikke tilg.ngelig i .jeblikket.".. },.. "craw_connect_to_network": {.. "message": "Opret forbindelse til et netv.rk.".. },.. "iap_unavailable": {.. "message": "Betaling i appen er ikke tilg.ngelig i .jeblikket.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Log ind p. Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	651
Entropy (8bit):	4.583694000020627
Encrypted:	false
SSDEEP:	12:1HEJQ1ZGGQ1Z+WYpU34pCEMT+dgJMlCTO8ZpU34p6FK603OyZnLAOfTYJ6K:1HEzWWYp3Bewv8Zp7k4OGAOfQj
MD5:	6B3E916E8C1991AA0453CBA00FEDCAAA
SHA1:	D6366D15912E40CA107FD42BFE9579C3336A51F9
SHA-256:	A62FFAB910E31531758EEE48B2CC71A8857BEC3021DEAD50B668CBA3C8667053
SHA-512:	87EA4311B61F29543B13F3E17DFA919D0C320B4FE370CC152E0B1514BCA79B0ABB526DDCF08621D6EBFA48923EE8FB4C667EFB120A72BD9583EEBEE7BFB80552
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome Web Store-Zahlungen".. },.. "app_name": {.. "message": "Chrome Web Store-Zahlungen".. },.. "craw_app_unavailable": {.. "message": "Die App ist momentan nicht verf.gbar.".. },.. "craw_connect_to_network": {.. "message": "Bitte stellen Sie eine Verbindung zu einem Netzwerk her.".. },.. "iap_unavailable": {.. "message": "In-App-Zahlungen sind momentan nicht m.glich.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Bitte melden Sie sich in Chrome an.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	787
Entropy (8bit):	4.973349962793468
Encrypted:	false
SSDEEP:	24:1HEw+aZ+6WYpbWZe80A08ZpCGyDVWlOGAOf+XD:WguYpCZnpEZbGoD
MD5:	05C437A322C1148B5F78B2F341339147
SHA1:	AB53003A678E44A170E73711FBD9949833BBF3AA
SHA-256:	A052C32B4FCAC61152EB0ADB2C260FB6A8256AD104AA0013DB93E9798D41A070
SHA-512:	C36CB9202A34356DD06D377E2A088F428D0B8EBE7D2E54F8380485E9D94A0598D7F651C1E7A2FD55BE481D49C02B0812F2BA335E08611EC85EE0BD60784A6B40
Malicious:	false
Preview:	{.. "app_description": {.. "message": "........ ... Chrome Web Store".. },.. "app_name": {.. "message": "........ ... Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": ". ........ .... .. ..... ... ..... ..........".. },.. "craw_connect_to_network": {.. "message": ".......... .. ... .......".. },.. "iap_unavailable": {.. "message": ".. ........ ..... ......... ... ..... ..... .. ...... ...........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": ".......... ... Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.483686991119526
Encrypted:	false
SSDEEP:	12:1HEJ6GG6+WYpU34OuFpR+dgGfFZO8ZpU34aEGFpR03OyZnLAOfTYdD:1HEVSWYpVp0JS8Zp5KpaOGAOfuD
MD5:	91F5BC87FD478A007EC68C4E8ADF11AC
SHA1:	D07DD49E4EF3B36DAD7D038B7E999AE850C5BEF6
SHA-256:	92F1246C21DD5FD7266EBFD65798C61E403D01A816CC3CF780DB5C8AA2E3D9C9
SHA-512:	FDC2A29B04E67DDBBD8FB6E8D2443E46BADCB2B2FB3A850BBD6198CDCCC32EE0BD8A9769D929FEEFE84D1015145E6664AB5FEA114DF5A864CF963BF98A65FFD9
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome Web Store Payments".. },.. "app_name": {.. "message": "Chrome Web Store Payments".. },.. "craw_app_unavailable": {.. "message": "App currently unavailable.".. },.. "craw_connect_to_network": {.. "message": "Please connect to a network.".. },.. "iap_unavailable": {.. "message": "In-App Payments is currently unavailable.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Please sign into Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	593
Entropy (8bit):	4.483686991119526
Encrypted:	false
SSDEEP:	12:1HEJ6GG6+WYpU34OuFpR+dgGfFZO8ZpU34aEGFpR03OyZnLAOfTYdD:1HEVSWYpVp0JS8Zp5KpaOGAOfuD
MD5:	91F5BC87FD478A007EC68C4E8ADF11AC
SHA1:	D07DD49E4EF3B36DAD7D038B7E999AE850C5BEF6
SHA-256:	92F1246C21DD5FD7266EBFD65798C61E403D01A816CC3CF780DB5C8AA2E3D9C9
SHA-512:	FDC2A29B04E67DDBBD8FB6E8D2443E46BADCB2B2FB3A850BBD6198CDCCC32EE0BD8A9769D929FEEFE84D1015145E6664AB5FEA114DF5A864CF963BF98A65FFD9
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome Web Store Payments".. },.. "app_name": {.. "message": "Chrome Web Store Payments".. },.. "craw_app_unavailable": {.. "message": "App currently unavailable.".. },.. "craw_connect_to_network": {.. "message": "Please connect to a network.".. },.. "iap_unavailable": {.. "message": "In-App Payments is currently unavailable.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Please sign into Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	661
Entropy (8bit):	4.450938335136508
Encrypted:	false
SSDEEP:	12:1HEJHlbGGHlb+WYpU34ubdDH+dgxbFxTO8ZpU34lPbdlVo03OyZnLAOfTY6xjD:1HEvaC6WYpcDeEFxq8ZpNl5OGAOffD
MD5:	82719BD3999AD66193A9B0BB525F97CD
SHA1:	41194D511F1ACC16C1CA828AC81C18C8C6B47287
SHA-256:	4DB9B2721E625C18B9E05C04B31AF5D9694712F1CAAF6219ABE34BB08E5DB1C7
SHA-512:	D4C49B43427799B6292CEED11CACB1D76F7CE43EBF402B43B638A6EB2B414ED0981E386CB8CDF0B51D1BD9552934FE25B2F6392266BB73D8C9A691F65BCE0128
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Esta aplicaci.n no est. disponible en este momento.".. },.. "craw_connect_to_network": {.. "message": "Con.ctate a una red.".. },.. "iap_unavailable": {.. "message": "Los pagos en la aplicaci.n no est.n disponibles en este momento.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicia sesi.n en Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	637
Entropy (8bit):	4.47253983486615
Encrypted:	false
SSDEEP:	12:1HEJHlbGGHlb+WYpU34ubdDH+dgxbFxTO8ZpU34GLO03OyZnLAOfTYiJD:1HEvaC6WYpcDeEFxq8Zp4LlOGAOfvD
MD5:	6B2583D8D1C147E36A69A88009CBEBC7
SHA1:	4D4DEEB4BE6AA0181825F3371A761ABC5B4D5937
SHA-256:	6659BC3705311D7641A73995DCFEA80C7734F2F4EBBC3787B3892A240348324F
SHA-512:	37F0DBFCC1B5A2B8E4C92C49D2D9DEEF25616421350324F57E0149A45A6CCB437F5E3CBE97412C4B5DBBF2593783C7DF71E9C25A851AEAE6E4764C545723FA53
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "app_name": {.. "message": "Sistema de pagos de Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Esta aplicaci.n no est. disponible en este momento.".. },.. "craw_connect_to_network": {.. "message": "Con.ctate a una red.".. },.. "iap_unavailable": {.. "message": "En este momento, Pagos En-Apps no est. disponible.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Accede a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	595
Entropy (8bit):	4.467205425399467
Encrypted:	false
SSDEEP:	12:1HEJfPGGGfPG+WYpU34Ze7z+dgrW9O8ZpU34ZwZz03OyZnLAOfTYgoLIR:1HEdvqlWYpTeObk8ZpT/OGAOfuLIR
MD5:	CFF6CB76EC724B17C1BC920726CB35A7
SHA1:	14ED068251D65A840F00C05409D705259D329FFC
SHA-256:	C85800BF45942FCC7FD6B1DF929C25F9CC2A977A6678966BD03D4B6B69889AFD
SHA-512:	53D7D01BB30C0306DE65A79FD9551D2E8C1F71F4F45F71906B009071CB3E0F231E6A50FDD78773E9B4DE94085BC7B97F829842FA21A89A2080D33458B745C46F
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome'i veebipoe maksed".. },.. "app_name": {.. "message": "Chrome'i veebipoe maksed".. },.. "craw_app_unavailable": {.. "message": "Rakendus pole praegu saadaval.".. },.. "craw_connect_to_network": {.. "message": "Looge .hendus v.rguga.".. },.. "iap_unavailable": {.. "message": "Rakendusesisesed maksed ei ole praegu saadaval.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Logige Chrome'i sisse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	4.595421267152647
Encrypted:	false
SSDEEP:	12:1HEJRuzGGRuz+WYpU34ujSBu+dgYO8ZpU34J+Bu03OyZnLAOfTY5HN:1HEFcWYpPNa8ZpD+FOGAOfEHN
MD5:	3A01FEE829445C482D1721FF63153D16
SHA1:	F3EAAADDC03F943FC88B30B67F534AA13E3336DD
SHA-256:	0BDE54B20845124113383B6EB81E43A0F05E4EB0C44BEE3C1DFAC4CC5FEC2836
SHA-512:	3B92B6C86D30FD36AA3CEFF8773BA60C3FC5CC19C693540137044C5838A5503895C770C0336A4D0A3DB5E42F3FB36274D8D3F85B9DCA2F3EC0E974FDDB0BEAD8
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome Web Storen maksut".. },.. "app_name": {.. "message": "Chrome Web Storen maksut".. },.. "craw_app_unavailable": {.. "message": "Sovellus ei ole t.ll. hetkell. k.ytett.viss..".. },.. "craw_connect_to_network": {.. "message": "Muodosta verkkoyhteys.".. },.. "iap_unavailable": {.. "message": "Sovelluksen sis.iset maksut eiv.t ole t.ll. hetkell. k.ytett.viss..".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Kirjaudu sis..n Chromeen.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	658
Entropy (8bit):	4.5231229502550745
Encrypted:	false
SSDEEP:	12:1HEJADlbGGADlb+WYpU34hTUT+dgHfZAFFZO8ZpU34hTjzeT03OyZnLAOfTYHfvF:1HEYah6WYp7TUSoxOS8Zp7TOsOGAOfqV
MD5:	57AF5B654270A945BDA8053A83353A06
SHA1:	EEEF7A4F869F97CF471A05D345E74F982D15E167
SHA-256:	EC002ED92359F67818B49455DFC579E140368E6A004080AF022FD4F57F6B03F2
SHA-512:	5F0AE839FCF3F4EA48FF41A76655AE0F3821564AFD5D42FBB9FBB9A38E8D8F7BB5E9B6F71064588CD441261F644095A44A755C134CE546D506D9A21E488BAF52
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Mga Pagbabayad sa Chrome Web Store".. },.. "app_name": {.. "message": "Mga Pagbabayad sa Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Kasalukuyang hindi available ang app.".. },.. "craw_connect_to_network": {.. "message": "Mangyaring kumonekta sa isang network.".. },.. "iap_unavailable": {.. "message": "Kasalukuyang hindi available ang Mga Pagbabayad na In-App.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Mangyaring mag-sign in sa Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	677
Entropy (8bit):	4.552569602149629
Encrypted:	false
SSDEEP:	12:1HEJALf/nbGGALf/nb+WYpU34Owdgbyb+dgdQjO8ZpU34ITQpGnbyb03OyZnLAO8:1HE4Hna1Hn6WYpNdgpY8ZpSTQwnBOGAh
MD5:	8D11C90F44A6585B57B933AB38D1FFF8
SHA1:	3F9D44EA8807069A32AACA2AAAD02FD892E6CC90
SHA-256:	599491F8C52B945C16C441ADF45BFD45AFAE046DA07757D97C56AF4DE75ED3B5
SHA-512:	D7EF7F5AD7EF1A1595825D79B69E2B1E988AD3CF1F3881496FCCD30F241E4E9C6E457F9F5D0F855DE3536DB7A40C3E1C55946B50D3F556F4A35285066A0CD6F7
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Paiements via le Chrome.Web.Store".. },.. "app_name": {.. "message": "Paiements via le Chrome.Web.Store".. },.. "craw_app_unavailable": {.. "message": "Application indisponible pour le moment.".. },.. "craw_connect_to_network": {.. "message": "Veuillez vous connecter . un r.seau.".. },.. "iap_unavailable": {.. "message": "Les paiements via l'application ne sont pas disponibles pour le moment.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Veuillez vous connecter . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	835
Entropy (8bit):	4.791154467711985
Encrypted:	false
SSDEEP:	24:1HEs07J0JWYp9vnCSVLP8Zp6CsOGAOf8SLm:Wh7qgYp1CMLUph1GiSLm
MD5:	E376D757C8FD66AC70A7D2D49760B94E
SHA1:	1525C5B1312D409604F097768503298EC440CC4D
SHA-256:	8106D98C4F8DA16DB698444409558E29CC96735E188BFA303C333A5D99231C1D
SHA-512:	673F3F259AF2946E4F49BBED14A2A70D44BF9FDA9D7A71DC9172BA9B7B3C7F7062B16D29682B638D485B0520ED6F99E7A735F28C7C719B539559005B69FA7555
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome ... ..... ......".. },.. "app_name": {.. "message": "Chrome ... ..... ......".. },.. "craw_app_unavailable": {.. "message": "......... .. ... ...... .... ...".. },.. "craw_connect_to_network": {.. "message": "..... ....... .. ...... .....".. },.. "iap_unavailable": {.. "message": "..-.. ...... ... ...... .... ...".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "..... Chrome ... .... .. .....".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	618
Entropy (8bit):	4.56999230891419
Encrypted:	false
SSDEEP:	12:1HEJGiimxmbZGGGiimxmbZ+WYpU34OBOEuhopIO+dgcapZO8ZpU34GiiZrMrQphK:1HE4H4TH8WYpNjTta28ZpQVLP0SOGAOK
MD5:	8185D0490C86363602A137F9A261CC50
SHA1:	5BD933B874441CEACB9201CCC941FF67BAED6DC0
SHA-256:	A2B2EC359A9DD9DCCCE02859CE1E738BD30FAA4A05F1DC522893FFDF722BBC15
SHA-512:	D7629978FC031EA5F716F9C1065FB2FEAB48C15F10CD68830DC966FA1002C03DDC7ACDE314C7D075F9F3A0A68552A6ACBCCDEE24CF20B6C3DD1BCE6562D0396E
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Pla.anja u web-trgovini Chrome".. },.. "app_name": {.. "message": "Pla.anja u web-trgovini Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikacija trenuta.no nije dostupna.".. },.. "craw_connect_to_network": {.. "message": "Pove.ite se s mre.om.".. },.. "iap_unavailable": {.. "message": "Pla.anje u aplikaciji trenuta.no nije dostupno.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prijavite se na Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	683
Entropy (8bit):	4.675370843321512
Encrypted:	false
SSDEEP:	12:1HEJVJiGGVJi+WYpU34Hpo9O+dgMmfgijO8ZpU34Huo9O03OyZnLAOfTYBIAYm:1HEVrk5WYpQzTUg/8ZpwoXOGAOfYIAd
MD5:	85609CF8623582A8376C206556ED2131
SHA1:	1E16EB70DB5E59BB684866FF3E3925C2DEF25A12
SHA-256:	32A249749F12ADB6A220BF9ADC272C7E5D9AD5497A38B0086D961E3ABA17FBC6
SHA-512:	27883430865D3CFA6EDFE8C6CE1442BD96150B5CE520CCF7D556A330CAA6392C712B47BD86F7350E174876BC681F6DEC94D1312402655B0AF90883A2899EC78B
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome Internetes .ruh.z Fizet.si rendszere".. },.. "app_name": {.. "message": "Chrome Internetes .ruh.z Fizet.si rendszere".. },.. "craw_app_unavailable": {.. "message": "Az alkalmaz.s jelenleg nem .rhet. el.".. },.. "craw_connect_to_network": {.. "message": "K.rj.k, csatlakozzon egy h.l.zathoz.".. },.. "iap_unavailable": {.. "message": "Az alkalmaz.son bel.li fizet.s jelenleg nem .rhet. el.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Jelentkezzen be a Chrome-ba.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	604
Entropy (8bit):	4.465685261172395
Encrypted:	false
SSDEEP:	12:1HEJs25bGGs25b+WYpU34ORBHAeSJ+dgkmO8ZpU34s22C/SzFAs03OyZnLAOfTYR:1HEBaA6WYpaHFH8ZptOYOGAOf2D
MD5:	EAB2B946D1232AB98137E760954003AA
SHA1:	60BDC2937905B311D2C9844DF2D639D7AC9F7F67
SHA-256:	C6E8800450602DE0F39FE9F6854472383813FB454B08ABAE7E25A9167CE004C3
SHA-512:	970FEC9A9EF0BAF7F693C4C5977F3B47914579C5B5414FCE9DBB5E4574659A5BB9AD2DE0CC886B368F49C019785AF7D2D7FE82F71341F039EADC399ED776CA12
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Pembayaran Chrome Webstore".. },.. "app_name": {.. "message": "Pembayaran Chrome Webstore".. },.. "craw_app_unavailable": {.. "message": "Aplikasi tidak tersedia saat ini.".. },.. "craw_connect_to_network": {.. "message": "Sambungkan ke jaringan.".. },.. "iap_unavailable": {.. "message": "Pembayaran Dalam Aplikasi saat ini tidak tersedia.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Harap masuk ke Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	603
Entropy (8bit):	4.479418964635223
Encrypted:	false
SSDEEP:	12:1HEJsqd/bGGsqd/b+WYpU34OcX4+dgUvIO8ZpU34vq703OyZnLAOfTYsD:1HEXd/aKd/6WYpZrv58ZpskOGAOfzD
MD5:	A328EEF5E841E0C72D3CD7366899C5C8
SHA1:	2851ED658385804E87911643F5A4200B1FB26E13
SHA-256:	CD891C45F7586FB4A2514205A11F260E4A6D4482FA03D901909DD9F57BE0536D
SHA-512:	E47297896E981774EC3B59D41B89D6BA9333F6B4435EB9727D8645A46B10C7D408ADE06844871FA757382FBE7E645276449DB7B1B23BC59C9A71A5CB5A5ECC57
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Pagamenti Chrome Web Store".. },.. "app_name": {.. "message": "Pagamenti Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "App al momento non disponibile.".. },.. "craw_connect_to_network": {.. "message": "Collegati a una rete.".. },.. "iap_unavailable": {.. "message": "La funzione Pagamenti In-App non . al momento disponibile.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Accedi a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	697
Entropy (8bit):	5.20469020877498
Encrypted:	false
SSDEEP:	12:1HEJ07uGG07u+WYpU34DB+dgnsVztO8ZpU34MwiB03OyZnLAOfTYmSH:1HEcnDNWYp1kxU8Zp2wiqOGAOfpSH
MD5:	9B3A5D473C3F2BBFAEECE94A07A940B8
SHA1:	61BACA342CF766BBA15C7B4D892A0E7DAC9405AA
SHA-256:	706312A4A2AEF3317223F141EB2B82685345B7EED444F16BB4DF3A272716DA1F
SHA-512:	94F6FEE9A11BD890AB8211C98D1CC142348961EBCF756F66477A3E3A76519804B70BE0AE4E551739F8AFE32D7ADE6EDE04EF6B9B9EED03E3A857E6058EEDD4C6
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome ........".. },.. "app_name": {.. "message": "Chrome ........".. },.. "craw_app_unavailable": {.. "message": ".................".. },.. "craw_connect_to_network": {.. "message": "................".. },.. "iap_unavailable": {.. "message": ".......................".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Chrome ............".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	631
Entropy (8bit):	5.160315577642469
Encrypted:	false
SSDEEP:	12:1HEJ1GG1+WYpU34K3aT+dgh8d0HTO8ZpU34KaNkaT03OyZnLAOfTY/YeHx:1HEajWYpc3aSl0Hq8Zpc6kasOGAOfyYA
MD5:	9F6B4D82A70C74CA751E2EAE70FAB5CF
SHA1:	0534F125FFCE8222277CF2BE3401C59DAF9217F8
SHA-256:	D1467B8D037114403E8F4EFC52E88C4A7FEB96126BE4CFF883FEFF1084EF7E68
SHA-512:	ED9319830314385D09C06F62EE34186E8CA576C857981205E4468A28B3ACD2AB03384E77B866032C324ABDD97A56EFD08E2D6E0C79D563578B3EC52517819BD8
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome . ... ..".. },.. "app_name": {.. "message": "Chrome . ... ..".. },.. "craw_app_unavailable": {.. "message": ".. .. ... . .....".. },.. "craw_connect_to_network": {.. "message": "..... ......".. },.. "iap_unavailable": {.. "message": ".. .. ... ... . .....".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Chrome. .......".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	665
Entropy (8bit):	4.66839186029557
Encrypted:	false
SSDEEP:	12:1HEJpqHnkGGpqHnk+WYpU346M+dgV6O8ZpU34WzSWz03OyZnLAOfTYx:1HELqHtKqHPWYpM3A8ZpwGzOGAOfg
MD5:	4CA644F875606986A9898D04BDAE3EA5
SHA1:	722A10569E93975129D67FBDB75B537D9D622AD1
SHA-256:	7C311AB751D840D750C11553C083785813E079C1D464FE568A98C9E3EF3DB96C
SHA-512:	E575E3D0622F5BD4B6C0EE79128A1B1F1882195670139D1983F4377D847141B8FB8EBB8BCED82AF3A220ED07D3577AFBE085BADC0E9C7678292B80E3EC5D3444
Malicious:	false
Preview:	{.. "app_description": {.. "message": ".Chrome. internetin.s parduotuv.s mok.jimo sistema".. },.. "app_name": {.. "message": ".Chrome. internetin.s parduotuv.s mok.jimo sistema".. },.. "craw_app_unavailable": {.. "message": "Programa .iuo metu negalima.".. },.. "craw_connect_to_network": {.. "message": "Prisijunkite prie tinklo.".. },.. "iap_unavailable": {.. "message": "Mok.jimai programoje .iuo metu negalimi.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prisijunkite prie .Chrome..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	671
Entropy (8bit):	4.631774066483956
Encrypted:	false
SSDEEP:	12:1HEJFhVbGGFhVb+WYpU34wDoz+dgGedBO8ZpU34wF03OyZnLAOfTYGYID:1HENQKkWYp2Doy/em8Zp2WOGAOfRYID
MD5:	C5CE2C51391EAFD3DA9E4C71549A3C28
SHA1:	1F67FF6EF6E90C0CE3AAF56ED543A3EFD381574D
SHA-256:	1FA1DF2CA8516DEF490FB8484E9AA498ACFF80EEF5C9258FFE42D3678E6C7DED
SHA-512:	C85F6281E682F52BC2147DEA7E2F3BB4DC48D98BADA8687B05C6C7271C78EA7F5431CD51671A4184C9AE004FC53C016E3C594697F483195CCBA08A93821EEF70
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome interneta veikala maks.jumu sist.ma".. },.. "app_name": {.. "message": "Chrome interneta veikala maks.jumu sist.ma".. },.. "craw_app_unavailable": {.. "message": "Lietotne pagaid.m nav pieejama.".. },.. "craw_connect_to_network": {.. "message": "L.dzu, izveidojiet savienojumu ar t.klu.".. },.. "iap_unavailable": {.. "message": "Maks.jumi lietotn.s pa.laik nav pieejami.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "L.dzu, pierakstieties p.rl.k. Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\nb\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	624
Entropy (8bit):	4.555032032637389
Encrypted:	false
SSDEEP:	12:1HEJhiOGGhiO+WYpU34OHSN+dgFjdGFZO8ZpU34JgdN03OyZnLAOfTYiD:1HEDiHIitWYpCYJ8ZpD1OGAOfRD
MD5:	93C459A23BC6953FF744C35920CD2AF9
SHA1:	162F884972103A08ADB616A7EB3598431A2924C5
SHA-256:	2CD700AEB57D89C2E73333D0702556EE3FF3863516170F85669BC680FCBDC4E0
SHA-512:	F76E6E8D8499306883C3EC1E774F7E8BB6B601096DA5A14D17D3E7D5732829542041E42B7350466589291ADCC83FB065FD591B4E20CFCF8EDC586E128ECBFCB5
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome Nettmarked-betalinger".. },.. "app_name": {.. "message": "Chrome Nettmarked-betalinger".. },.. "craw_app_unavailable": {.. "message": "Appen er utilgjengelig for .yeblikket.".. },.. "craw_connect_to_network": {.. "message": "Du m. koble til et nettverk.".. },.. "iap_unavailable": {.. "message": "Betaling i app er ikke tilgjengelig for .yeblikket.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Du m. logge p. Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	615
Entropy (8bit):	4.4715318546237315
Encrypted:	false
SSDEEP:	12:1HEJJQGkbGGJQGkb+WYpU34OQKJT+dgiXUmvFZO8ZpU34g7JT03OyZnLAOfTYMD:1HErxkaqxk6WYptndXI8ZpTOGAOfbD
MD5:	7A8F9D0249C680F64DEC7650A432BD57
SHA1:	53477198AEE389F6580921B4876719B400A23CA1
SHA-256:	92BE7C2DC9CFBE5A65E9CE6488D364C8D7EC19E7B67A31E4D43C1CB2B169671C
SHA-512:	969AB979546A741C0F3EDBEEB21BABA375FA8870D4FB9248CDD4C305736E332E10CAB7B64C5C078E60EC0CD73848101B390BE8F44B89C310058AF4C1CA3C8AA7
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Betalingen via Chrome Web Store".. },.. "app_name": {.. "message": "Betalingen via Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "App momenteel niet beschikbaar.".. },.. "craw_connect_to_network": {.. "message": "Maak verbinding met een netwerk.".. },.. "iap_unavailable": {.. "message": "In-app-betalingen is momenteel niet beschikbaar.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Log in bij Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	636
Entropy (8bit):	4.646901997539488
Encrypted:	false
SSDEEP:	12:1HEJbiVbGGbiVb+WYpU34OBHlBi9+dgQUg6O8ZpU34bdbfiIu03OyZnLAOfTYR5k:1HE5iVauiV6WYpIAYr8ZpxFiaOGAOfIC
MD5:	0E6194126AFCCD1E3098D276A7400175
SHA1:	E8127B905A640B1C46362FA6E1127BE172F4A40F
SHA-256:	E2699F98C511B18A2AFB82EAE9A4804B646C4FF1077D80E77C17A3943A6373C2
SHA-512:	A71F7C7BFBBF1E37E699601AF2E095C56CBA91F90CB7556477DF31D01B83ADFB1271E1775C9BA299FF6875BBFC2B6AB47488CC88E33DEF2F6F2E0E5AC687B777
Malicious:	false
Preview:	{.. "app_description": {.. "message": "P.atno.ci w sklepie Chrome Web Store".. },.. "app_name": {.. "message": "P.atno.ci w sklepie Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Aplikacja jest obecnie niedost.pna.".. },.. "craw_connect_to_network": {.. "message": "Po..cz si. z sieci..".. },.. "iap_unavailable": {.. "message": "P.atno.ci w ramach aplikacji s. teraz niedost.pne.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Zaloguj si. w Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	636
Entropy (8bit):	4.515158874306633
Encrypted:	false
SSDEEP:	12:1HEJsc/bGGsc/b+WYpU34OLw+dgn/KzO8ZpU34FjIBMwGRO03OyZnLAOfTYN+KcY:1HEb/a8/6WYp4mZ8Zp7cKlOGAOf2tD
MD5:	86A2B91FA18B867209024C522ED665D5
SHA1:	63DEC245637818C76655E01FCB6D59784BC7184E
SHA-256:	6374880FDD1F8AF1EE8AEA6A06B73BE0AB265AFCEB4FE6F08BDE3B3989264B21
SHA-512:	DA6DBDE5028756421C2904F605632EE98831A25A1247E6238A931629B94CE8A00FD76F4235F118D2167304BD60F2C06B2AD78E54FF6CE53F8C38DF8C7B5AFCE4
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Pagamentos da Chrome Web Store".. },.. "app_name": {.. "message": "Pagamentos da Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Aplicativo indispon.vel no momento.".. },.. "craw_connect_to_network": {.. "message": "Conecte-se a uma rede.".. },.. "iap_unavailable": {.. "message": "No momento, os Pagamentos no aplicativo n.o est.o dispon.veis.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Fa.a login no Google Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	622
Entropy (8bit):	4.526171498622949
Encrypted:	false
SSDEEP:	12:1HEJsZUkbGGsZUkb+WYpU34OAE+dgqxKzO8ZpU34rEpBfvPO03OyZnLAOfTYLD:1HEmUka5Uk6WYpFvdxZ8ZpSTnPlOGAOS
MD5:	750A4800EDB93FBE56495963F9FB3B94
SHA1:	8BFB915488A4EB3CB33D68E2E59F1F8447DB7D61
SHA-256:	C1C94F65FABAF17DEF98A8587711A56D61B1E5607500E9B01F2824DB109F9E83
SHA-512:	2AEDEF5793406221BE76AF22031CE8C30AB5FAEAED09BB394C153E2EBE990C89C1A2A73B40D8A92842641AFCA8C77FFD808A2058602D3646FD8DAE2844406F24
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Pagamentos via Chrome Web Store".. },.. "app_name": {.. "message": "Pagamentos via Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Aplica..o atualmente indispon.vel.".. },.. "craw_connect_to_network": {.. "message": "Ligue-se a uma rede.".. },.. "iap_unavailable": {.. "message": "Os Pagamentos na app est.o atualmente indispon.veis.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Inicie sess.o no Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	641
Entropy (8bit):	4.61125938671415
Encrypted:	false
SSDEEP:	12:1HEJqJrJZGGqJrJZ+WYpU344HIx2Z+dgrVPlZO8ZpU34qT7hI3O03OyZnLAOfTYU:1HEC4D8WYpKow8WV68ZpKhoOGAOfoVGD
MD5:	98D43E4B1054A65DF3FA3CC40AB6FB6D
SHA1:	46E0A21C4DA2BB5D4D8F837AE211C1B6FA26E7E2
SHA-256:	113A13900CBA62FE8AED06751971C23A80A99B47F9BE219CF884D57DB19611D9
SHA-512:	A76DC53912A4F46714926B9EA2B22E909540E447F61F6DD72607AB7B3BB5D4A9B39E525B04C33AEC53BA813D14AC1FB5827275B2524E52B693E83171E1CD1466
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Pl..i prin Magazinul web Chrome".. },.. "app_name": {.. "message": "Pl..i prin Magazinul web Chrome".. },.. "craw_app_unavailable": {.. "message": ".n prezent, aplica.ia nu este disponibil..".. },.. "craw_connect_to_network": {.. "message": "Conecteaz.-te la o re.ea.".. },.. "iap_unavailable": {.. "message": "Pl..ile .n aplica.ie nu sunt disponibile momentan.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Conecteaz.-te la Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	744
Entropy (8bit):	4.918620852166656
Encrypted:	false
SSDEEP:	12:1HEJ7OJHZMSl3ZGG7OJHZMSl3Z+WYpU34zWJ2F+dgVtLSv/TO8ZpU347NWjT03On:1HElOJHZMq4uOJHZMq8WYpdWJ/YGHq8m
MD5:	DB2EDF1465946C06BD95C71A1E13AE64
SHA1:	FB4F3ECE9ECECEBBC6CA2A592A15FB9C1FDFB811
SHA-256:	FBAF22CE6E16DE174CED8CB5EA3098CCA1C3426A2111FF33BD3E64DA64ED67AB
SHA-512:	4E0CF00BAEF1757548DEB17BBE1AF55770A0A0F7351779EF55C7DEFA6D112D0227B8865C2C22E0EC62E6E2F1C8E1632A2D0CE6828D25C5ABBF143C990116F632
Malicious:	false
Preview:	{.. "app_description": {.. "message": "......... ....... ........-........ Chrome".. },.. "app_name": {.. "message": "......... ....... ........-........ Chrome".. },.. "craw_app_unavailable": {.. "message": ".......... ...........".. },.. "craw_connect_to_network": {.. "message": "............ . .....".. },.. "iap_unavailable": {.. "message": "....... ..... .......... ...........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "....... . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	4.640777810668463
Encrypted:	false
SSDEEP:	12:1HEJfZGGfZ+WYpU34ORO+dgmmCO8ZpU34yH7u2Z03OyZnLAOfTYCUAi0D:1HEl4G8WYpetPmD8ZpcH7aOGAOfzUeD
MD5:	8DF215D1EFBDABB175CCDD68ED8DCB0A
SHA1:	2B374462137A38589A73FDD00A84CBDC7E50F9F4
SHA-256:	7FA16AF97E6CFC52EC6008EB679D3F30E7E0C24F9EF2D18A9228EAF4DED9D63B
SHA-512:	C0E623343BDAEB4731800D183B59F2FCFE285F0C7153EC99641FD84F2F2DCFE47D21E73F3D28B1240340453C5668EB0AFFBE087AAB62F1C88CD2A40CC44E599D
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "app_name": {.. "message": "Platby Internetov.ho obchodu Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplik.cia moment.lne nie je dostupn..".. },.. "craw_connect_to_network": {.. "message": "Pripojte sa k sieti.".. },.. "iap_unavailable": {.. "message": "Platby v aplik.cii moment.lne nie s. k dispoz.cii.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prihl.ste sa do prehliada.a Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	4.5101656584816885
Encrypted:	false
SSDEEP:	12:1HEJGcyvmbZGGGcyvmbZ+WYpU34OBOEtf+dgca1ZO8ZpU34GcQArERff03OyZnLh:1HE4cyY4TcyY8WYpNoWa1w8ZpQcQ6AfK
MD5:	3943FA2A647AECEDFD685408B27139EE
SHA1:	0129DD19D28373359530B3B477FE8A9279DABB7D
SHA-256:	18AFF072EE0DF7C3495045435C752A805606E6D5D462EF2321C443F1773F4B3A
SHA-512:	42E62B3855611FF2E1D39C11404CB1A09825EE4CA6A8ACB3FF538B4574388F549E3BD79137DD4DC128A8DC44DD270D7D878E4AAD20DA8250A5C25297B0DEC09D
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Pla.ila v spletni trgovini Chrome".. },.. "app_name": {.. "message": "Pla.ila v spletni trgovini Chrome".. },.. "craw_app_unavailable": {.. "message": "Aplikacija trenutno ni na voljo.".. },.. "craw_connect_to_network": {.. "message": "Pove.ite se z omre.jem.".. },.. "iap_unavailable": {.. "message": "Pla.ila v aplikacijah trenutno niso na voljo.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Prijavite se v Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	743
Entropy (8bit):	4.913927107235852
Encrypted:	false
SSDEEP:	12:1HEJssbdOGGssbdO+WYpU347xBP+dgcucO8ZpU34s1muP03OyZnLAOfTYzDYD:1HEKsb59sbTWYplx4Xud8Zpy1mNOGAOv
MD5:	D485DF17F085B6A37125694F85646FD0
SHA1:	24D51D8642CDC6EFD5D8D7A4430232D8CDE25108
SHA-256:	7FFDE34C58E7C376C042DE64DEF6481DAE32BE8B70F0B18EDF536290CBE0C818
SHA-512:	0DDECFD860E99290B6C3AAA04F510272AE081CF2D93ED5832D9D6378EC9D36177FFBE213471247FB94721EA34A83E7665669200047091D0FDE134E3D763217E7
Malicious:	false
Preview:	{.. "app_description": {.. "message": "....... . Chrome ...-..........".. },.. "app_name": {.. "message": "....... . Chrome ...-..........".. },.. "craw_app_unavailable": {.. "message": ".......... .. ........ ...........".. },.. "craw_connect_to_network": {.. "message": "........ .. .......".. },.. "iap_unavailable": {.. "message": "....... . .......... .. ........ ...........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "......... .. . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	630
Entropy (8bit):	4.52964089437422
Encrypted:	false
SSDEEP:	12:1HEJJMkbGGJMkb+WYpU34OACwz+dgNPGFZO8ZpU34JgpXLSb03OyZnLAOfTYLdID:1HErMkaqMk6WYpTOcb8ZpDgdZOGAOf8Y
MD5:	D372B8204EB743E16F45C7CBD3CAAF37
SHA1:	C96C57219D292B01016B37DCF82E7C79AD0DD1E8
SHA-256:	B8BA77E0089B0676545EC16D32468B727812B444F90B33A7A5B748E6C36C4388
SHA-512:	33640529E0D5DCC5CA4BDB0615A2818E8D26C6FCB7B3474C08AC3EB67B9DB40E1F0A79954ED20728CD47A686D2533DCBC76ABCBDB917F8530C8DE8BBA687352E
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Betalning via Chrome Web Store".. },.. "app_name": {.. "message": "Betalning via Chrome Web Store".. },.. "craw_app_unavailable": {.. "message": "Appen .r inte tillg.nglig f.r tillf.llet.".. },.. "craw_connect_to_network": {.. "message": "Anslut till ett n.tverk.".. },.. "iap_unavailable": {.. "message": "Betalning i appen .r inte tillg.ngligt f.r n.rvarande.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Logga in i Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	945
Entropy (8bit):	4.801079428724355
Encrypted:	false
SSDEEP:	24:1HEKa1dDa1/WYp6UFi72SmlG8ZpyactrW2SAOGAOfvSLD:WK2DNYp6U4y3bpyLxwGFW
MD5:	83E2D1E97791A4B2C5C69926EFB629C9
SHA1:	429600425CB0F196DDD717F940E94DBD8BFF2837
SHA-256:	2FECA577F43D97BAEEA464741D585892103585208FD0A935B810A03BDCE83C88
SHA-512:	60A5928DAA8CB4341487F477C56B5A98B83EDE50E5F4F55A802E01FDDAB86F3E795D391953D3D9214552D14D3F58C5A183693C613720FC12FC387D7B8F9B9AB6
Malicious:	false
Preview:	{.. "app_description": {.. "message": "............... Chrome .........".. },.. "app_name": {.. "message": "............... Chrome .........".. },.. "craw_app_unavailable": {.. "message": ".............................".. },.. "craw_connect_to_network": {.. "message": ".........................".. },.. "iap_unavailable": {.. "message": "...............................................".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "................. Chrome".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	631
Entropy (8bit):	4.710869622361971
Encrypted:	false
SSDEEP:	12:1HEJ9Y8GG9Y8+WYpU34wWT+dgGb0GO8ZpU34wryd7T03OyZnLAOfTYGbPKG:1HE0jWYpyRnG8Zpyr/OGAOfFPn
MD5:	2CEAE0567B6BB1D240BBAD690A98CA3B
SHA1:	5944346FBD4A0797B13223895995CAB58E9ECD23
SHA-256:	A7CB86F30C9C31FE5540282C308BA96ADB4EC16EF98C87129EB88105E5BEF5FC
SHA-512:	108A07C6D03D7178E8D0FFEF5349E0249A898D864964FED8757BD8A08BC1C6D9613F2A6C01AA34A6606127D1C6CE14C229FA02586677DBB060B85E3E845950E1
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome Web Ma.azas. .demeleri".. },.. "app_name": {.. "message": "Chrome Web Ma.azas. .demeleri".. },.. "craw_app_unavailable": {.. "message": "Uygulama .u anda kullan.lam.yor.".. },.. "craw_connect_to_network": {.. "message": "L.tfen bir a.a ba.lan.n.".. },.. "iap_unavailable": {.. "message": "Uygulama ..i .demeler .u anda kullan.lamaz.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "L.tfen Chrome'da oturum a..n.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	720
Entropy (8bit):	4.977397623063544
Encrypted:	false
SSDEEP:	12:1HEJ7wILkSlXZGG7wILkSlXZ+WYpU34zb1Oy2P+dgSV1EjiTO8ZpU347qtfP2CTW:1HElwEkK4uwEkK8WYpd/dTV1e8Zptq5S
MD5:	AB0B56120E6B38C42CC3612BE948EF50
SHA1:	8B3F520E5713D9F116D68E71DAEED1F6E8D74629
SHA-256:	68ABA284751EB9C856032062EF9B1651E2A1E5CE5FDA0977FFC97D63BA7BED9E
SHA-512:	CD852A58217F739C1CD58567FF432D31A7AD3F68C884ABBA1DA95799BCD1545C6A5D3B06F319681C12B78AD0A709828DE4B22736316F148D21F5DB76A5BCCBEF
Malicious:	false
Preview:	{.. "app_description": {.. "message": "....... ...-........ Chrome".. },.. "app_name": {.. "message": "....... ...-........ Chrome".. },.. "craw_app_unavailable": {.. "message": "........ ......... ...........".. },.. "craw_connect_to_network": {.. "message": "............. .. .......".. },.. "iap_unavailable": {.. "message": "....... ..... ........ ..... .. .........".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "........ . Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	695
Entropy (8bit):	4.855375139026009
Encrypted:	false
SSDEEP:	12:1HEJMAZrSFZGGMAZrSFZ+WYpU34WFHoz+dgdklzoO8ZpU34NFHoz03OyZnLAOfTU:1HEI4B8WYpAKytFZ8ZpXKMOGAOfd6D
MD5:	7EBB677FEAD8557D3676505225A7249A
SHA1:	F161B4B6001AEAEAB246FF8987F4D992B48D47BE
SHA-256:	051F96ED874C11C4A13589B5F68964E4F5B03B52DDA223D56524F2CA23760C04
SHA-512:	74FD267CF7E299FB8E7054605C3F651F057F676FF865082FA24F4916755456768DB0DA62DBC515D829B48AB1F9CFC8AD3E841DCBF1F194D5CB14C5335A192A0D
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Thanh to.n tr.n c.a h.ng Chrome tr.c tuy.n".. },.. "app_name": {.. "message": "Thanh to.n tr.n c.a h.ng Chrome tr.c tuy.n".. },.. "craw_app_unavailable": {.. "message": ".ng d.ng hi.n kh.ng kh. d.ng.".. },.. "craw_connect_to_network": {.. "message": "Vui l.ng k.t n.i v.i m.ng.".. },.. "iap_unavailable": {.. "message": "Thanh to.n trong .ng d.ng hi.n kh.ng kh. d.ng.".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "Vui l.ng ..ng nh.p v.o Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	595
Entropy (8bit):	5.210259193489374
Encrypted:	false
SSDEEP:	12:1HEJ01GG01+WYpU34zeHz+dgfO8ZpU34YKiO03OyZnLAOfTYB6U:1HEpIWYpISv8Zp+JOGAOfa6U
MD5:	BB73BF561BB79F89D9BF7C67C5AE5C65
SHA1:	2FADD3A1959B29C44830033A35C637D0311A8C9C
SHA-256:	D804F2A040D21D7511EFD5213D8E1721D64964A1A0DBB48E21622CEEDC9D967E
SHA-512:	627D44CEF1FE5C5ABD598BD47FF5E22B9EFC1CF98DDE3868FA9E5896C134A0C9C055AC34EDDADAE56B6690E51AEA89965D38F770552A85C732CC796795DC68D2
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome .........".. },.. "app_name": {.. "message": "Chrome .........".. },.. "craw_app_unavailable": {.. "message": ".........".. },.. "craw_connect_to_network": {.. "message": ".......".. },.. "iap_unavailable": {.. "message": "............".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "... Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	634
Entropy (8bit):	5.386215984611281
Encrypted:	false
SSDEEP:	12:1HEJ2j62GG2j62+WYpU34m7T+dgc8nOO8ZpU34mvIO03OyZnLAOfTYAuH:1HEuSZCWYpsStwP8ZpROGAOfCH
MD5:	5FF50C673CC0C661D615F0CFD0E6DCA0
SHA1:	60DFF98DEAB9C4746B288BDD9C94B3BCAE5EAA85
SHA-256:	C6F8C640F3353A7B9B1432A0C139C1AEEC40133800E6C9B467B63991AD660308
SHA-512:	361D62D91F4931C5F34092C9F2C6A5323D5EEB82A24E7ABE11F7817D8D66341C0ECAD4DCB4B10873920C8D6A3CC9F5704889E178EB2549001A9F62BEDF6C8019
Malicious:	false
Preview:	{.. "app_description": {.. "message": "Chrome ............".. },.. "app_name": {.. "message": "Chrome ............".. },.. "craw_app_unavailable": {.. "message": ".............".. },.. "craw_connect_to_network": {.. "message": "......".. },.. "iap_unavailable": {.. "message": "................".. },.. "jwt_retrieve_failed": {.. "message": "The transaction could not be completed.".. },.. "please_sign_in": {.. "message": "... Chrome.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	7780
Entropy (8bit):	5.791315351651491
Encrypted:	false
SSDEEP:	192:RktDNJ2UzsL5KcASyoH+CouKP/iNGRo/oRHMIT:AZQflcsU
MD5:	0834821960CB5C6E9D477AEF649CB2E4
SHA1:	7D25F027D7CEE9E94E9CBDEE1F9220C8D20A1588
SHA-256:	52A24FA2FB3BCB18D9D8571AE385C4A830FF98CE4C18384D40A84EA7F6BA7F69
SHA-512:	9AEAFC3ECE295678242D81D71804E370900A6D4C6A618C5A81CACD869B84346FEAC92189E01718A7BB5C8226E9BE88B063D2ECE7CB0C84F17BB1AF3C5B1A3FC4
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiZHUtdGRPdUNWcmxDY254Q0poRkg2NXpLU05vb1RiUE56bDNHbzdRMGJ3SSJ9LHsicGF0aCI6Il9sb2NhbGVzL2NhL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJ6ZGtWaF9XdkxJWlhkck5xWHBvSHNRMGh1ZGtSM2d1QlMzb2VsTEZLNklVIn0seyJwYXRoIjoiX2xvY2FsZXMvY3MvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6Ik9nUkNIZlVoam9xOU93NHFfaEhvTTQxNzNMelJyYkVpUVdsRXNRSzhscFkifSx7InBhdGgiOiJfbG9jYWxlcy9kYS9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiN2JVWW1LYkhQUUNRMXBGcmUzTHJySEhwWk9xN1c2Zk5hT0laWmdKUERTTSJ9LHsicGF0aCI6Il9sb2NhbGVzL2RlL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJOV3FkU3Rfc1NFMm9KT2VuSUZtM0pMRm9iOGtBZ3ZTa3RtZGpCRGJWazdBIn0seyJwYXRoIjoiX2xvY2FsZXMvZWwvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6ImgyaEZ0YUJoLXJQUEtoUm00QkFWM0VEZmhFbnh5MElGOVhYT3Z0aHhlNjAifSx7InBhdGgiOiJfbG9jYWxlcy9lbi9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoid0pSZDFmM3NxMERFVTJHLXd

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\craw_background.js

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	544643
Entropy (8bit):	5.385396177420207
Encrypted:	false
SSDEEP:	6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
MD5:	6EEBED29E6A6301E92A9B8B347807F5F
SHA1:	65DFB69B650560551110B33DCBA50B25E5B876DE
SHA-256:	04CD9494B0ED83924DAD12202630B20D053D9E2819C8E826A386C814CC0A1697
SHA-512:	FEDE6DB31F2AD242E7BC7B52A8859BA7F466A0B920A8DADCB32DCFB5B2A2742E98B767FF22E0C5BC5C11FEC021240AA9E458486C9039EB4EBE5CF6AF7BE97BF2
Malicious:	false
Preview:	/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var d,e=e\|\|{};e.scope={};e.arrayIteratorImpl=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};e.arrayIterator=function(a){return{next:e.arrayIteratorImpl(a)}};e.ASSUME_ES5=!1;e.ASSUME_NO_NATIVE_MAP=!1;e.ASSUME_NO_NATIVE_SET=!1;e.SIMPLE_FROUND_POLYFILL=!1;e.ISOLATE_POLYFILLS=!1;e.FORCE_POLYFILL_PROMISE=!1;e.FORCE_POLYFILL_PROMISE_WHEN_NO_UNHANDLED_REJECTION=!1;.e.defineProperty=e.ASSUME_ES5\|\|"function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};e.getGlobal=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");};e.global=e.getGlobal(this);.e.IS_SYMBOL_NATIVE="func

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\craw_window.js

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	261316
Entropy (8bit):	5.444466092380538
Encrypted:	false
SSDEEP:	3072:I5vU7I6s2M9duIWFCbmYJ4tnFWdqpMad2vywhIp81QFv9F9nNsZgiDdOFlV/mZmc:I5vqFCb2p8Gx9FNNsZ9Dd/ceR
MD5:	1709B6F00A136241185161AA3DF46A06
SHA1:	33DA7D262FFED1A5C2D85B7390E9DBC830CBE494
SHA-256:	5721A4B3F8E09C869A629EFFD350B51C9D46F0AC136717D4DB6265C0EE6F9AC8
SHA-512:	26835B4C050F53AD2DDB84469DF9A84BBB2786A655AB52DFC20B54BEDCB81D1ECD789198D5B7D8B940242E5CEAC818A177444D402397AE82C203438C4B1D19CB
Malicious:	false
Preview:	/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var b,k=k\|\|{};k.scope={};k.createTemplateTagFirstArg=function(a){return a.raw=a};k.createTemplateTagFirstArgWithRaw=function(a,c){a.raw=c;return a};k.arrayIteratorImpl=function(a){var c=0;return function(){return c<a.length?{done:!1,value:a[c++]}:{done:!0}}};k.arrayIterator=function(a){return{next:k.arrayIteratorImpl(a)}};k.makeIterator=function(a){var c="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];return c?c.call(a):k.arrayIterator(a)};.k.arrayFromIterator=function(a){for(var c,d=[];!(c=a.next()).done;)d.push(c.value);return d};k.arrayFromIterable=function(a){return a instanceof Array?a:k.arrayFromIterator(k.makeIterator(a))};k.ASSUME_ES5=!1;k.ASSUME_NO_NATIVE_MAP=!1;k.ASSUME_NO_NATIVE_SET=!1;k.SIMPLE_FROUND_POLYFILL=!1;k.ISOLATE_POLYFILLS=!1;k.FORCE_POLYFILL_PROMISE=!1;k.FORCE_POLYFILL_PROMISE_WHEN_NO_UNHANDLED_REJECTION=!1;.k.objectCreate=k.ASSUME_ES5\|\|"function"==typeof Object.cre

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\css\craw_window.css

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	4.912380256743454
Encrypted:	false
SSDEEP:	24:LalZ74H+rMwJHwIodHRmxt3jiu1iu1RDpfeWlMl548wJHwDwCapt/VMYXj8Eq27K:Z+rMm71le88S1tWYXmrVZFH
MD5:	67BF9AABE17541852F9DDFF8245096CD
SHA1:	A4AC74DD258E8E0689034FAA1B15A5C7C56DC3BB
SHA-256:	10DFBD2D98950B79EE12F6B8E3885AABE31543048DE56AD4FC0A5E34D0D9D4EC
SHA-512:	298FA132C6F122798FDB9BC6DE8024915147ADC20355B56A92F0ED9ACCE4549BE6E7F42212E07DCA166E31624D4E66E299565845D4BA1C51CA935050641B61FE
Malicious:	false
Preview:	html, body {. margin: 0;. overflow: hidden;.}..webview {. width: 100%;. height: 100%;. min-height: 100%;. position: absolute;.}...craw_overlay {. position: absolute;.. left: 0;. top: 0;. right: 0;. bottom: 0;.. background-color: white;.. -webkit-transition: opacity 250ms linear;.. display: -webkit-flex;. -webkit-flex-direction: column;. -webkit-flex: 1 0%;. -webkit-align-items: center;. -webkit-justify-content: center;.. -webkit-app-region: drag;.}...craw_overlay img {. margin: 16px;.}..#loading_overlay {. opacity: 1;.}..#offline_overlay {. opacity: 0;. display: none;.}..#offline_overlay > img {. -webkit-filter: saturate(0%);.}..#offline_overlay > span {. font-family: 'Open Sans', 'Deja Vu Sans', Arial, sans-serif;. font-size: 15px;. line-height: 21px;. color: #8d8d8d;. display: block;.}..#loading_splash {. width: 128px;. height: 128px;.}..#drag_overlay {. position: absolute;. left: 0;. top: 0;. right: 0;. bottom: 0;. pointer-events: none;. -webkit

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\html\craw_window.html

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	810
Entropy (8bit):	4.723481385335562
Encrypted:	false
SSDEEP:	12:hYenuEJIig5fRpvV4AEdN2sAAuzg/7RwQuLYpUH9KfRnQBGgZKy3QGgjPSWZDQL:hYeLJKTVNEuLAuzg/twQucpS9bj3
MD5:	34A839BC40DEBC746BBD181D9EF9310C
SHA1:	8B4EAA74D31EED5B0BABA3CA5460201F6B10DA46
SHA-256:	BB8742615E4CD996AE5D0200E443AE6A6F0B473255F03AFFDB8FB4660DE4554D
SHA-512:	EE81E5509CBC2CB2B6C834224688C1E1B1AA9AA3866C52F8EAED040D5C390653C52D8D681E2E2CF62906643962ABAC823D5B622385B983B21E0DCCAFDF281EFF
Malicious:	false
Preview:	<!DOCTYPE html>.<html>. <head>. <link href="/css/craw_window.css" rel="stylesheet">. <script src="/craw_window.js"></script>. </head>. <body>. <webview></webview>. <div class="craw_overlay" id="loading_overlay">. <img src="/images/icon_128.png" />. <img src="/images/flapper.gif" />. </div>. <div class="craw_overlay" id="offline_overlay">. <img src="/images/icon_128.png" />. <span id="app_unavailable"></span>. <span id="connect_to_network"></span>. </div>. <div id="drag_overlay"></div>. <div id="top_bar">. <div id='close_button'>. <img src='/images/topbar_floating_button_close.png'/>. </div>. <div id='maximize_button'>. <img src='/images/topbar_floating_button_maximize.png'/>. </div>. </div>. </body>.</html>.

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\images\flapper.gif

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 30 x 30
Category:	dropped
Size (bytes):	70364
Entropy (8bit):	7.119902236613185
Encrypted:	false
SSDEEP:	768:g5TXOSBAqNIPmA8NcjCWdM0VFMJEwavTeElfWupav5TXg7wV+irIPny9MTVQHydi:g5KSmiIPmAhZWiMsDfWug7DmqM6HybkF
MD5:	398ABB308EEBC355DA70BCE907B22E29
SHA1:	CFFB77B8A1724B8F81D98C6D6AD0071D10162252
SHA-256:	2B73533F47A99FFEA9CC405FFAFA9C4C53623F62487AEBFBA415945120B22040
SHA-512:	FC7A56FC8A61A582161874B54ADBAD30A84840190008EDB0B6FBF84F91393CA58E988E3FE446F11A0C3C691C18249B93AEC2904B3D0C4F0857D79034F662385A
Malicious:	false
Preview:	GIF89a.......................................................!.......!..NETSCAPE2.0.....,.............9.:.h0.bT(6.!l.&..("gk..JL1.[....o. .(:..B(.6."...Z.CUyh0.....j.C.z8..S....2.T'...Q..4 g\|]$ueW.NyQ.IoL!AoF#9h>7.0t..%..,.@.m4..7..!.......,.............9.:.h0.bT(6.!l.&..("gk..JL1.[....o. .(:..B(.6."...Z.CUyh0.....j.C.z8..S....2.T'...Q..4 g\|]$ueW.NyQ.IoL!AoF#9h>7.0t..%..,.@.m4..7..!.......,............................................................................................................'..w=.....\.)._6.k..OF...n.#\~"....2b3..I.)..eu.Q.`.e......gr.?>.s.I0.....@.~.Tr.[8.+.,.;..EE....S.*f.....,.....B8/D..;.9.q......ukC...r.I.....j......BGY...o2J....+O4....X4.....cH%7....I.....0H!.!.....!.,.............................................................................................................................................................................................................p8.a$....hh@.4....X,A.0L..(....JX.j...,..........z.X.Q....jB.d....B..

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\images\icon_128.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4364
Entropy (8bit):	7.915848007375225
Encrypted:	false
SSDEEP:	96:YjlLDJjTvXUtNvX8dgb9HT6y8nviyHG5iCRYtIP:YtNTfUzvX8KM+MGRsIP
MD5:	4DBC9F9E6F5A08D299BAC9E54DF07694
SHA1:	BB38F5DE34B1E0BE1109220BA55271087A4D9EA5
SHA-256:	91C2718DD23B4356D71F88F6146868369033291086DF327534546DFA459BEB0E
SHA-512:	A5F2B1F47502836130D8083F757B7773C1E1CB36B76AD298CC29AB2B428C8002D2F15BD839838FC326DAC3681C2F48AB25A3E7631D33726C4B25E8EC14170912
Malicious:	false
Preview:	.PNG........IHDR..............>a.....IDATx..yp.....gF#.:,[H.l.l..8...`/.k....,!a7Km...E...Te..T.....J...p....%.(....+...3....eY.e...L.o...5....h4...\....{?....~.u.`0.....`0.....`0.....`.Y......[(.......).4....ai..w38.+....Bf././..]...{......8...3.....3W~OJ.. /...u6V.C..U.0.+._=.c..9.X.?....L....S@.L...m.0..>.C...L\|TF.p5..f4M.,.V....8..a.<...RP..@)E,..E"...h.....!...-....,I..T..........m..._[[{w{{....{.^......M.x..h4.h.....\.R.E....j).7.....h4.A.E....,. ...iii.Vj?2...=/.B.FK9P..@)=Rj..D".Y...2.B..x.}0...&J...2.......f.O..e.H.....!.J)'I..R....B............QJ;K..L...L.l".L~mhh.R.@).FFF~.L&...~.B.......u.........}.....~.....f..yUU...........^M...6......].,w.e..~.!$.C.R.....E(%e9.,....k..@...W8.........@...........O..@%.~..@.S..P.....`Tp...."...?ME..c......s...`..S1...7.b..aNE..k...3.yP.}.Ch.}......B..........IPE..C.<....T....k......Z..o_......g........P..A=y.J.)h..@.q.-.].AU.4...F.M.....y%B]+ .\.~..9......:..=...r.....E].o...F..P........i...\|....

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\images\icon_16.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	558
Entropy (8bit):	7.505638146035601
Encrypted:	false
SSDEEP:	12:6v/7vyVgSKYsfFzXxXsrPfA+b0YX+5IOUWCQKznuow7:6yVnKYsfFzhXsrIq0YXmgQGn6
MD5:	FB9C46EA81AD3E456D90D58697C12C06
SHA1:	5FC450F7D73CCFAC8F0D818CB3392BA4D91B69DE
SHA-256:	016CA659BA080E194FBFC0929602B16506ED60AA6019FAA51410C4FD93B583E8
SHA-512:	ADD810EE9EB7CAEC505B5FD90A1F184CE39D8F8C689DCC240F188FE353B9575489492E07D572A3B1C11A1555CE66AFCA5134903E4C1AA3D54BC7C5ED3E65B50C
Malicious:	false
Preview:	.PNG........IHDR................a....IDAT8...Mk.Q...;... .....F..QW.....F....J.?.w..7~......'.Q..B]... .QS...M&_w..b&.\|`......p...f.?.D$.y^..........y...\..Z..t6..oRj.@&.u..G.qN).t.-V.>(.N.Ep]wFk.60o.]0.`Y..cT..Y.Tb.`DF.d..s.Z..E..9.4._C.._...%..*.^....4.l...Y..X..R..../...Wj+w0[.].._B.k.${.\.>.%...........lz .w.ALxo.2;..a...".p..S..&..uXS...<..6..[..zD.._.N+w.WbM7ye6X<...'(,=.r}........$f..5..P....k..."..8.s.<zgSm@.....).Y.....:e..\|.....F...I..A$.....T?.....m....8.........N...z.....V..vd.h'....C.?.....H.;]..C.M.....9.b......IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\images\topbar_floating_button.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.475799237015411
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZtnAkx/RPJDmV7bScsP4a9zln94FptVp:6v/lhPKM4nDspnAkZJNmgPdln2TTp
MD5:	8803665A6328D23CC1014A7B0E9BE295
SHA1:	9DA6EE729D5A6E9F30658B8EC954710F107A641F
SHA-256:	D5F9234DC36E7FFA85F35B2359A4F82276F8395EFA76E4553507EA990B27FC6C
SHA-512:	ECD9E71B8BA1ED8BD4CA5A0936CB66A83611C4ABCBDA76C250F4CDF4AD80320212E8F5EEB79A38910718F8346ECC1AD580A3FA835EC2B22BE497F36899FB5930
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...Q..0......2...(p...~Z.}'.>I%O...V!s..................../...`.<..`.....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\images\topbar_floating_button_close.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	252
Entropy (8bit):	6.512071394066515
Encrypted:	false
SSDEEP:	6:6v/lhPKM4nDsp7q1hKVlomsj9rxKNgtmN0VZ+GFYep:6v/7iMXVq1ylxemNgtmKVnYM
MD5:	0599DFD9107C7647F27E69331B0A7D75
SHA1:	3198C0A5F34DB67F91A0035DBC297354CBC95525
SHA-256:	131817CD9311C03DF22D769DD2AD7FA2E6E9558863A89F7E5E1657424031A937
SHA-512:	0076ACB9D6A886BD987876E49495038F9388B292A9EFE5C9093CCA64CA3692E3A5D24E35172C7697F6AAE34B86CA217EE59C003423E46D9499BD27EC7D77A649
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...... ..Pp.X....H...b@...\|.^LC_.E.BP+......X.P..........q..~..p/. ..s.....%D^...$......@.!...<...).?.4{.k.G3...4..[cH..0..l.8.!r..m.R..{..........`.f...#.x.....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\images\topbar_floating_button_hover.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.423186859407619
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZtnAkx/9lVtEHxrPLyN+ltNPhv/l2up:6v/lhPKM4nDspnAkZHVtERrPLygltNPn
MD5:	7CB6B9DC1A30F63B8BD976924B75AD96
SHA1:	0C40B0C496D2F2B5F2021C117EC8610AC03AB469
SHA-256:	721B7AAA9A42A54A349881615A12E3A26983ACA48E173FD2F66E66AA0D725735
SHA-512:	4764937364E355956B242B84010AC56102536D2AACBE4227F0E88E4DE7AB468571957EA6C33012539156E5349AE4F777115615AE3361F60ADDF9CD227424F76A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...A..0...+B.z.s...*.....$.<u..[...................h.......C.CA).....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\images\topbar_floating_button_maximize.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	166
Entropy (8bit):	5.8155898293424775
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZttd//HmnFz1P/ZjXlUTqyCIc30ItK1p:6v/lhPKM4nDsptF/HOP/ZjXlUeyCo/p
MD5:	232CE72808B60CBE0F4FA788A76523DF
SHA1:	721A9C98C835D2CD734153BBE07833C6637ECD68
SHA-256:	AFA4EA944CBDEC8543242E627EF46D5BFD3766DCAC664E7E50CDEEF2B352740C
SHA-512:	4048EEA5A78DD569521C488C4CE4F7B77AC0454C92EE9107A81A1B3AF91A4EE036039AC1A0A6B8DD26B12E7F1595DB80B7FAA7B6A25D9032BF385528A81A8654
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...HIDATx......0.CQS.......~..."..........m.v+Sq....<!...M8m...'...@$..0....E........IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\images\topbar_floating_button_pressed.png

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	160
Entropy (8bit):	5.46068685940762
Encrypted:	false
SSDEEP:	3:yionv//thPl3xWrA4RthwkBDsTBZtnAkx/9lVtEXIyN+ltN1/lsg1p:6v/lhPKM4nDspnAkZHVtEZgltN1eup
MD5:	E0862317407F2D54C85E12945799413B
SHA1:	FA557F8F761A04C41C9A4BA81994E43C6C275DBB
SHA-256:	5C10CE0589EB115600F77381130B70AE0B7B3752614D86D4C89E857658AA222B
SHA-512:	07CB69327961FD0019BEF8EF7590B5524905AC373A815F73F6D9E0B26840929F919A96CAA977D4B5656704DACD0F352D568FB3997F80EE6BB94C95B58839DBFE
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....tEXtSoftware.Adobe ImageReadyq.e<...BIDATx...A..0...+B..@wu...*.....$.<u..[...................h.........M..x(....IEND.B`.

C:\Users\user\AppData\Local\Temp\scoped_dir5812_895958328\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1322
Entropy (8bit):	5.449026004350873
Encrypted:	false
SSDEEP:	24:1HEis7ViC/yox/fiqeUoLFlmF1s80FKrGfd0d3NZNZx1Fq7eY7nfj1B:WL7V2opiV1mvs8rxTZRczhB
MD5:	01334FB9D092AF2AA46C4185E405C627
SHA1:	47AD3C0E82362FFE5B881DF8D71D6F79AB7F5796
SHA-256:	F52714812D68C577A445169D11E84DF6751C2D6886BC429643072BB5D61C6C27
SHA-512:	888D96ADB7A847ABE472145258C8C46950EB2FA3BA7D596C2E90A17C8FB06FD0155C56CC8ABA5D076D89368417464BCB2D236F9E40E53241950A01F9F8ED548F
Malicious:	false
Preview:	{.. "app": {.. "background": {.. "scripts": [ "craw_background.js" ].. }.. },.. "default_locale": "en",.. "description": "__MSG_APP_DESCRIPTION__",.. "display_in_launcher": false,.. "display_in_new_tab_page": false,.. "icons": {.. "128": "images/icon_128.png",.. "16": "images/icon_16.png".. },.. "key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrKfMnLqViEyokd1wk57FxJtW2XXpGXzIHBzv9vQI/01UsuP0IV5/lj0wx7zJ/xcibUgDeIxobvv9XD+zO1MdjMWuqJFcKuSS4Suqkje6u+pMrTSGOSHq1bmBVh0kpToN8YoJs/P/yrRd7FEtAXTaFTGxQL4C385MeXSjaQfiRiQIDAQAB",.. "manifest_version": 2,.. "minimum_chrome_version": "29",.. "name": "__MSG_APP_NAME__",.. "oauth2": {.. "auto_approve": true,.. "client_id": "203784468217.apps.googleusercontent.com",.. "scopes": [ "https://www.googleapis.com/auth/sierra", "https://www.googleapis.com/auth/sierrasandbox", "https://www.googleapis.com/auth/chromewebstore", "https://www.googleapis.com/auth/chromewebstore.readonly" ].. },.

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	5.188225635500728
Encrypted:	false
SSDEEP:	48:hjSvCGFCGbFCGFCGpjCGqCGFCGpvCGb3CGgCG9CGuCGFCGyCGFCGDCGdCGmCGZ4V:hJBaVt
MD5:	5B6399BF70BE3AD203DB62B09F70F5BB
SHA1:	3F7A112C1C9EE7D8FC0EB1EC9D77086EAA247D26
SHA-256:	3BF82D68242DA9679941F0628376830BCA581A223D46B297788967C3D20F1B3D
SHA-512:	9CD1A7523DBC7D0ADC4161D188D39BD57D701C8568FAB206C12C0A1D0F76B5C9D43CF1CAB0E065FB0A03D50BF454FDFA12794AE29861039ACDB715CC184AC1C2
Malicious:	false
Preview:	07/26/2022 2:58 PM: Unpack: C:\Users\user\Downloads\TXRTN_2636021.zip..07/26/2022 2:58 PM: Tmp dir: C:\Users\user\AppData\Local\Temp\3lluphv4.sov..07/26/2022 2:58 PM: Use custom PW: abc321..07/26/2022 2:58 PM: Received from standard out: ..07/26/2022 2:58 PM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..07/26/2022 2:58 PM: Received from standard out: ..07/26/2022 2:58 PM: Received from standard out: Scanning the drive for archives:..07/26/2022 2:58 PM: Received from standard out: 1 file, 703611 bytes (688 KiB)..07/26/2022 2:58 PM: Received from standard out: ..07/26/2022 2:58 PM: Received from standard out: Extracting archive: C:\Users\user\Downloads\TXRTN_2636021.zip..07/26/2022 2:58 PM: Received from standard out: --..07/26/2022 2:58 PM: Received from standard out: Path = C:\Users\user\Downloads\TXRTN_2636021.zip..07/26/2022 2:58 PM: Received from standard out: Type = zip..07/26/2022 2:58 PM: Received from standard out: Physica

C:\Users\user\Documents\20220726\PowerShell_transcript.621365.56n0f2gV.20220726145835.txt

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.209183412427786
Encrypted:	false
SSDEEP:	24:BxSAD7vBZEYzx2DOXikR9fSAnyLWnHjeTKKjX4CIym1ZJXYR9fSAnyTnxSAZC:BZHvjVoOx7SSnqDYB1Zq7SDZZC
MD5:	3E3F069BDE289A1290032CD95065B636
SHA1:	F3334E8AAA53FF4A0D64E8240A30641DB8CCD802
SHA-256:	82B36C45E18A5AA25AFE4D7399A8478F9F9A9D08999B63E327517471D2EFAEF1
SHA-512:	A399F8385A6442AA9B9F10B96BA12DCE5699DE4A84D1388BD85C14BA18D32619C5E55D3F6AF4BC5867289D29F99147D5BDE15C344FE6D3717C910EECADA6770F
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220726145837..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 621365 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell.exe -ex bypass -command Mount-DiskImage -ImagePath C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso..Process ID: 5772..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220726145837..******************..PS>Mount-DiskImage -ImagePath C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso..******************..Command start time: 20220726150338..******************..PS>$global:?..True..********************..Windows Pow

C:\Users\user\Downloads\105d0a3f-7073-480c-aa5b-fa814cdc529f.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v1.0 to extract
Category:	dropped
Size (bytes):	703611
Entropy (8bit):	7.999750047253857
Encrypted:	true
SSDEEP:	12288:li8N8iWl2/4JpONlgNDCjcFLiUCVaRRexRXLtyo/lnRpJHmLG:XLWlnbWcCIFeUCORexjL/lnR3GLG
MD5:	A61219832554D574A0B5E17C0E82F2EF
SHA1:	5B1B6C692FA5E574162CB0A11C4F3BC76027E9D9
SHA-256:	D663BFF6E11A5D029190B814E8BBB7DCC9D439035F3ED6B041F96DE8384E451B
SHA-512:	93F461E09AC401CB3BBDB8866396E973C10617E9E7AA6EF9FE1D1A4D67B5B5CD88420A144B2D427323B1E74092D0B383A8EB79583997FCF73C48042A4CCDF77C
Malicious:	false
Preview:	PK........]..T................2518/SDq........u...cd`i.a``0`... fd.3YE.DIsl..2.c.d.-......P.....`..(.....U... ...D.."..U..A.E.".- ..Q....DJ.\...Y..UT....F.b.F.b.F.bPK........H..T$.t!b.....*...}.2518/TXRTN_2636021.isoSDh.........g.ucd`i.a``0`... fd.3YE.DIsl..2.c.d.-............`..(.....U... ...D.."..U..A.E."T.~Fa.Zn ..UT....D.b.F.b.F.b..us.J(-U....9........."_j..C.Xu....h.....$..L.%..:....H=O.o.o.J`-y.i...._}.k.T-.J.....J.?E'0{....x[....0..7a.[[.<D.C.z.Q....c.C..mdc.,........&.9.....a[.......5.x.o...8/.Q.Y Z;\.s..H.{).K......W._.....^.S1.+..4.w../...........6.A...(H.......+..yQ.[.OP`....}..{..u.....J....~>{..V.\.B.5N...h....... ..R..~.z..+.5..F.....u...2....bm.m.....H23..s....K$.+.-.}.Y.\|K{eP.V..k.....&.o.=h,.gQ....{.~....X....%..\|r......30.T.DbZ.......U.B.....4B^..fX....1..$.w.m..~.oMF...._./....]{u#....?8.(-T.i..........E.vP...^.../...\...Z. .)...h...@..s.2P0..8y2..6?.y...M(.dl.....ruCC..5-...!.[.:...a.....Yk.hA.y..Z....A....,.9...Q.d.07..2.

C:\Users\user\Downloads\TXRTN_2636021.zip.crdownload (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v1.0 to extract
Category:	dropped
Size (bytes):	703611
Entropy (8bit):	7.999750047253857
Encrypted:	true
SSDEEP:	12288:li8N8iWl2/4JpONlgNDCjcFLiUCVaRRexRXLtyo/lnRpJHmLG:XLWlnbWcCIFeUCORexjL/lnR3GLG
MD5:	A61219832554D574A0B5E17C0E82F2EF
SHA1:	5B1B6C692FA5E574162CB0A11C4F3BC76027E9D9
SHA-256:	D663BFF6E11A5D029190B814E8BBB7DCC9D439035F3ED6B041F96DE8384E451B
SHA-512:	93F461E09AC401CB3BBDB8866396E973C10617E9E7AA6EF9FE1D1A4D67B5B5CD88420A144B2D427323B1E74092D0B383A8EB79583997FCF73C48042A4CCDF77C
Malicious:	false
Preview:	PK........]..T................2518/SDq........u...cd`i.a``0`... fd.3YE.DIsl..2.c.d.-......P.....`..(.....U... ...D.."..U..A.E.".- ..Q....DJ.\...Y..UT....F.b.F.b.F.bPK........H..T$.t!b.....*...}.2518/TXRTN_2636021.isoSDh.........g.ucd`i.a``0`... fd.3YE.DIsl..2.c.d.-............`..(.....U... ...D.."..U..A.E."T.~Fa.Zn ..UT....D.b.F.b.F.b..us.J(-U....9........."_j..C.Xu....h.....$..L.%..:....H=O.o.o.J`-y.i...._}.k.T-.J.....J.?E'0{....x[....0..7a.[[.<D.C.z.Q....c.C..mdc.,........&.9.....a[.......5.x.o...8/.Q.Y Z;\.s..H.{).K......W._.....^.S1.+..4.w../...........6.A...(H.......+..yQ.[.OP`....}..{..u.....J....~>{..V.\.B.5N...h....... ..R..~.z..+.5..F.....u...2....bm.m.....H23..s....K$.+.-.}.Y.\|K{eP.V..k.....&.o.=h,.gQ....{.~....X....%..\|r......30.T.DbZ.......U.B.....4B^..fX....1..$.w.m..~.oMF...._./....]{u#....?8.(-T.i..........E.vP...^.../...\...Z. .)...h...@..s.2P0..8y2..6?.y...M(.dl.....ruCC..5-...!.[.:...a.....Yk.hA.y..Z....A....,.9...Q.d.07..2.

C:\Users\user\Downloads\TXRTN_2636021.zip:Zone.Identifier

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	76
Entropy (8bit):	4.387096223936192
Encrypted:	false
SSDEEP:	3:gAWY33AtwXJYuKQYJMUWuKQS6J:qY33AtjqTqtJ
MD5:	69E83F9D3CB6935E49F17D53ACD5E926
SHA1:	4D55EA6C76A18B4D0422526CF9BF96F365CD9C97
SHA-256:	DAD13936797FF6BDC7D72B90E86DC893BE7C1053DEE08A07D3BE48E5957E1B7D
SHA-512:	0D086AD07D923FCD901D821CBAEEA03A4A9ABF03D2453D188805CB0760228742146376B3CF5ADFDC89855B50CDEAC7DA0B68B79BCD28351571267E274D433797
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..ReferrerUrl=about:client..HostUrl=about:internet..

Static File Info

General

File type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Entropy (8bit):	6.13502616653846
TrID:	HyperText Markup Language (13003/1) 100.00%
File name:	X18flXFlh9.html
File size:	1174226
MD5:	5cb20a0bfc5e3e2ae8398b1840adf7ae
SHA1:	fdae22f8af65bb0af48d3f4413e9ed4d6e815f9c
SHA256:	f5c16248418a4f1fd8dff438b26b8da7f587b77db9e180a82493bae140893687
SHA512:	fbbbd2143277eaf97a241340f2640fe7afe0c6212de81edd5e0f306d91c9871c4622c41cec6459ec3b1593f5b2b5cf3f2bbdb06558a58e1703d9382184522706
SSDEEP:	24576:FamJ0rrcL6O4nJ2+GMAmV62Ulvo+/djmwcE:4Y40+VF+FNcE
TLSH:	8245F1EAF9C1241E9A63C21D94D17FFD6D2B9947D3425AABB01B7B60CB492C30523E4C
File Content Preview:	..<html class="wf-adobeclean-n9-active wf-adobeclean-n4-active wf-adobeclean-i4-active wf-adobeclean-n7-active wf-adobeclean-n3-active wf-adobeclean-n8-inactive wf-active" lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-w

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2022 14:58:02.664953947 CEST	49757	443	192.168.2.4	142.250.185.205
Jul 26, 2022 14:58:02.665004969 CEST	443	49757	142.250.185.205	192.168.2.4
Jul 26, 2022 14:58:02.665102959 CEST	49757	443	192.168.2.4	142.250.185.205
Jul 26, 2022 14:58:02.665843964 CEST	49758	443	192.168.2.4	142.250.186.110
Jul 26, 2022 14:58:02.665877104 CEST	443	49758	142.250.186.110	192.168.2.4
Jul 26, 2022 14:58:02.665971994 CEST	49758	443	192.168.2.4	142.250.186.110
Jul 26, 2022 14:58:02.666410923 CEST	49757	443	192.168.2.4	142.250.185.205
Jul 26, 2022 14:58:02.666445971 CEST	443	49757	142.250.185.205	192.168.2.4
Jul 26, 2022 14:58:02.666663885 CEST	49758	443	192.168.2.4	142.250.186.110
Jul 26, 2022 14:58:02.666676044 CEST	443	49758	142.250.186.110	192.168.2.4
Jul 26, 2022 14:58:02.721388102 CEST	443	49757	142.250.185.205	192.168.2.4
Jul 26, 2022 14:58:02.725832939 CEST	443	49758	142.250.186.110	192.168.2.4
Jul 26, 2022 14:58:02.783941984 CEST	49757	443	192.168.2.4	142.250.185.205
Jul 26, 2022 14:58:02.788240910 CEST	49758	443	192.168.2.4	142.250.186.110
Jul 26, 2022 14:58:02.823339939 CEST	49758	443	192.168.2.4	142.250.186.110
Jul 26, 2022 14:58:02.823379993 CEST	443	49758	142.250.186.110	192.168.2.4
Jul 26, 2022 14:58:02.823734999 CEST	49757	443	192.168.2.4	142.250.185.205
Jul 26, 2022 14:58:02.823776007 CEST	443	49757	142.250.185.205	192.168.2.4
Jul 26, 2022 14:58:02.824471951 CEST	443	49758	142.250.186.110	192.168.2.4
Jul 26, 2022 14:58:02.824512005 CEST	443	49758	142.250.186.110	192.168.2.4
Jul 26, 2022 14:58:02.824621916 CEST	49758	443	192.168.2.4	142.250.186.110
Jul 26, 2022 14:58:02.826714039 CEST	443	49758	142.250.186.110	192.168.2.4
Jul 26, 2022 14:58:02.826831102 CEST	49758	443	192.168.2.4	142.250.186.110
Jul 26, 2022 14:58:02.826857090 CEST	443	49757	142.250.185.205	192.168.2.4
Jul 26, 2022 14:58:02.826858044 CEST	443	49758	142.250.186.110	192.168.2.4
Jul 26, 2022 14:58:02.826930046 CEST	443	49757	142.250.185.205	192.168.2.4
Jul 26, 2022 14:58:02.826955080 CEST	49757	443	192.168.2.4	142.250.185.205
Jul 26, 2022 14:58:02.884854078 CEST	49757	443	192.168.2.4	142.250.185.205
Jul 26, 2022 14:58:02.885376930 CEST	49758	443	192.168.2.4	142.250.186.110
Jul 26, 2022 14:58:03.249330044 CEST	49757	443	192.168.2.4	142.250.185.205
Jul 26, 2022 14:58:03.249614954 CEST	443	49757	142.250.185.205	192.168.2.4
Jul 26, 2022 14:58:03.249722958 CEST	49758	443	192.168.2.4	142.250.186.110
Jul 26, 2022 14:58:03.249984026 CEST	443	49758	142.250.186.110	192.168.2.4
Jul 26, 2022 14:58:03.250086069 CEST	49757	443	192.168.2.4	142.250.185.205
Jul 26, 2022 14:58:03.250123024 CEST	443	49757	142.250.185.205	192.168.2.4
Jul 26, 2022 14:58:03.250423908 CEST	49758	443	192.168.2.4	142.250.186.110
Jul 26, 2022 14:58:03.250447989 CEST	443	49758	142.250.186.110	192.168.2.4
Jul 26, 2022 14:58:03.281197071 CEST	443	49758	142.250.186.110	192.168.2.4
Jul 26, 2022 14:58:03.281332016 CEST	49758	443	192.168.2.4	142.250.186.110
Jul 26, 2022 14:58:03.281369925 CEST	443	49758	142.250.186.110	192.168.2.4
Jul 26, 2022 14:58:03.281404972 CEST	443	49758	142.250.186.110	192.168.2.4
Jul 26, 2022 14:58:03.281481028 CEST	49758	443	192.168.2.4	142.250.186.110
Jul 26, 2022 14:58:03.284003019 CEST	49758	443	192.168.2.4	142.250.186.110
Jul 26, 2022 14:58:03.284030914 CEST	443	49758	142.250.186.110	192.168.2.4
Jul 26, 2022 14:58:03.297103882 CEST	443	49757	142.250.185.205	192.168.2.4
Jul 26, 2022 14:58:03.297215939 CEST	49757	443	192.168.2.4	142.250.185.205
Jul 26, 2022 14:58:03.297262907 CEST	443	49757	142.250.185.205	192.168.2.4
Jul 26, 2022 14:58:03.297288895 CEST	443	49757	142.250.185.205	192.168.2.4
Jul 26, 2022 14:58:03.297347069 CEST	49757	443	192.168.2.4	142.250.185.205
Jul 26, 2022 14:58:03.309504986 CEST	49757	443	192.168.2.4	142.250.185.205
Jul 26, 2022 14:58:03.309554100 CEST	443	49757	142.250.185.205	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 26, 2022 14:58:02.620763063 CEST	54800	53	192.168.2.4	8.8.8.8
Jul 26, 2022 14:58:02.626812935 CEST	64454	53	192.168.2.4	8.8.8.8
Jul 26, 2022 14:58:02.646658897 CEST	53	54800	8.8.8.8	192.168.2.4
Jul 26, 2022 14:58:02.652628899 CEST	53	64454	8.8.8.8	192.168.2.4
Jul 26, 2022 14:58:02.952686071 CEST	64277	53	192.168.2.4	8.8.8.8
Jul 26, 2022 15:01:24.825313091 CEST	61030	53	192.168.2.4	8.8.8.8
Jul 26, 2022 15:01:26.358573914 CEST	62468	53	192.168.2.4	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 26, 2022 14:58:02.620763063 CEST	192.168.2.4	8.8.8.8	0xbed1	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)
Jul 26, 2022 14:58:02.626812935 CEST	192.168.2.4	8.8.8.8	0xdfd1	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)
Jul 26, 2022 14:58:02.952686071 CEST	192.168.2.4	8.8.8.8	0xf53c	Standard query (0)	use.typekit.net	A (IP address)	IN (0x0001)
Jul 26, 2022 15:01:24.825313091 CEST	192.168.2.4	8.8.8.8	0x439b	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)
Jul 26, 2022 15:01:26.358573914 CEST	192.168.2.4	8.8.8.8	0x6d0f	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 26, 2022 14:58:02.646658897 CEST	8.8.8.8	192.168.2.4	0xbed1	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jul 26, 2022 14:58:02.646658897 CEST	8.8.8.8	192.168.2.4	0xbed1	No error (0)	clients.l.google.com		142.250.186.110	A (IP address)	IN (0x0001)
Jul 26, 2022 14:58:02.652628899 CEST	8.8.8.8	192.168.2.4	0xdfd1	No error (0)	accounts.google.com		142.250.185.205	A (IP address)	IN (0x0001)
Jul 26, 2022 14:58:02.974118948 CEST	8.8.8.8	192.168.2.4	0xf53c	No error (0)	use.typekit.net	use-stls.adobe.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)
Jul 26, 2022 15:01:24.854285955 CEST	8.8.8.8	192.168.2.4	0x439b	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Jul 26, 2022 15:01:26.379899025 CEST	8.8.8.8	192.168.2.4	0x6d0f	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)

HTTP Request Dependency Graph

accounts.google.com

clients2.google.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49757	142.250.185.205	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-26 12:58:03 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-07-26 12:58:03 UTC	0	OUT	Data Raw: 20 Data Ascii:
2022-07-26 12:58:03 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 26 Jul 2022 12:58:03 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: script-src 'report-sample' 'nonce-rXlAwiZ3hOwOYbOW842cQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'nonce-rXlAwiZ3hOwOYbOW842cQQ' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-07-26 12:58:03 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2022-07-26 12:58:03 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49758	142.250.186.110	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-26 12:58:03 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=85.0.4183.121&lang=en-GB&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1&x=id%3Dpkedcjkdefgpdelpbcmbmeomcjbeemfm%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda,pkedcjkdefgpdelpbcmbmeomcjbeemfm X-Goog-Update-Updater: chromecrx-85.0.4183.121 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
2022-07-26 12:58:03 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-VfZpOkqZNwubLnSzlJjKBg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 26 Jul 2022 12:58:03 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5685 X-Daystart: 21483 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2022-07-26 12:58:03 UTC	2	IN	Data Raw: 33 31 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 36 38 35 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 32 31 34 38 33 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 31b<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5685" elapsed_seconds="21483"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2022-07-26 12:58:03 UTC	2	IN	Data Raw: 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 2e 63 72 78 22 20 66 70 3d 22 31 2e 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 61 Data Ascii: mmhkkegccagdldgiimedpiccmgmieda.crx" fp="1.81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app><a
2022-07-26 12:58:03 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	14:57:57
Start date:	26/07/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff7964c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	14:57:59
Start date:	26/07/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1536,3277957915204753751,12551285156102164536,131072 --lang=en-GB --service-sandbox-type=network --enable-audio-service-sandbox --mojo-platform-channel-handle=1920 /prefetch:8
Imagebase:	0x7ff7964c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	14:57:59
Start date:	26/07/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\X18flXFlh9.html
Imagebase:	0x7ff7964c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	14:58:05
Start date:	26/07/2022
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1536,3277957915204753751,12551285156102164536,131072 --lang=en-GB --service-sandbox-type=none --enable-audio-service-sandbox --mojo-platform-channel-handle=5360 /prefetch:8
Imagebase:	0x7ff7964c0000
File size:	2150896 bytes
MD5 hash:	C139654B5C1438A95B321BB01AD63EF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	14:58:08
Start date:	26/07/2022
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\TXRTN_2636021.zip
Imagebase:	0xc70000
File size:	13312 bytes
MD5 hash:	9DE2E060A2985A232D8B96F9EC847A19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	8
Start time:	14:58:16
Start date:	26/07/2022
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pabc321 -y -o"C:\Users\user\AppData\Local\Temp\3lluphv4.sov" "C:\Users\user\Downloads\TXRTN_2636021.zip
Imagebase:	0x12d0000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	9
Start time:	14:58:17
Start date:	26/07/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	19
Start time:	14:58:31
Start date:	26/07/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso
Imagebase:	0x1190000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	20
Start time:	14:58:33
Start date:	26/07/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	21
Start time:	14:58:34
Start date:	26/07/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\3lluphv4.sov\2518\TXRTN_2636021.iso"
Imagebase:	0x3e0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Target ID:	25
Start time:	14:58:49
Start date:	26/07/2022
Path:	C:\Windows\System32\drivers\udfs.sys
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff6204c0000
File size:	324608 bytes
MD5 hash:	6A442723D4D05D9F15D24C9942CDA00D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Target ID:	26
Start time:	14:58:54
Start date:	26/07/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /q /c calc.exe
Imagebase:	0x1190000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	27
Start time:	14:58:54
Start date:	26/07/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	28
Start time:	14:58:55
Start date:	26/07/2022
Path:	\Device\CdRom1\calc.exe
Wow64 process (32bit):	true
Commandline:	calc.exe
Imagebase:	0xdf0000
File size:	776192 bytes
MD5 hash:	60B7C0FEAD45F2066E5B805A91F4F0FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	29
Start time:	14:58:56
Start date:	26/07/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\regsvr32.exe 102755.dll
Imagebase:	0x240000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 0000001D.00000002.514585055.0000000002C90000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 0000001D.00000002.514467624.0000000002C40000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 0000001D.00000002.514983912.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 0000001D.00000002.514983912.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Target ID:	31
Start time:	14:59:13
Start date:	26/07/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7338d0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	37
Start time:	15:00:06
Start date:	26/07/2022
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x110000
File size:	3611360 bytes
MD5 hash:	166AB1B9462E5C1D6D18EC5EC0B6A5F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000025.00000000.512646528.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Execution Graph

Execution Coverage:	21.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 018002C8 Relevance: 4.6, Strings: 3, Instructions: 892
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0r+q, xrefs: 018008F6
0r+q, xrefs: 018008E0
m]-q^, xrefs: 01800387, 0180038C

Memory Dump Source

Source File: 00000006.00000002.363832759.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_unarchiver.jbxd

Similarity

API ID:
String ID: 0r+q$0r+q$m]-q^
API String ID: 0-3605043475
Opcode ID: 1985b40962f620bca6f80d6df80c76190f75db7445f9084dadc37c986774cc16
Instruction ID: 1192cfcca0f2f6b17d536c22d570e032ce6e4bc43d7524d791695ecefe82afdd
Opcode Fuzzy Hash: 1985b40962f620bca6f80d6df80c76190f75db7445f9084dadc37c986774cc16
Instruction Fuzzy Hash: 7392E334901228DFDB69CF64C944BAEBBB2FB89305F1095E9D409AB394CB359E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0117B29A Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0117B2CC

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 7517f90e9de32b4120013b1688dccdf138bb51b35cdf1cb58717b6c5c722d71a
Instruction ID: 97884188a0ccb8210223026e8411014e00b92aef27cb82ebc37dcf7fcf0c2431
Opcode Fuzzy Hash: 7517f90e9de32b4120013b1688dccdf138bb51b35cdf1cb58717b6c5c722d71a
Instruction Fuzzy Hash: A20181718092409FDB15CF59D889766FFA4EF44720F08C4ABDD498F316D379A448CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0180172F Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363832759.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1329be9883ac57508227fbb7f7bbcbcc74397ad01bb17278d4aa9f75853a190
Instruction ID: 02ff6953ca93ba5219f5a13479fe3c6837b3e7f9f33f01f9991758e5abe8cc53
Opcode Fuzzy Hash: e1329be9883ac57508227fbb7f7bbcbcc74397ad01bb17278d4aa9f75853a190
Instruction Fuzzy Hash: 10510870E02209DFCB19DFB4D580AAEBBB2FF8A304F209469D405A7394DB359E45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0117B30A Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0117B3B7

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9be10174e51cd5115a3099acf820964df83aadfd50f86d2137b9303e04bf8616
Instruction ID: fc7903837f16c4295ed8ae83acbbee8bea80c3de08738e3bc65684086f702537
Opcode Fuzzy Hash: 9be10174e51cd5115a3099acf820964df83aadfd50f86d2137b9303e04bf8616
Instruction Fuzzy Hash: 79319271404384AFEB228B65DC45FA6BFBCEF45310F0884AEE985CB152D225A919CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0117ADC8 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0117AE6B

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: fd15927265dd169e01f063ae23ff266c77756d60ab524ef19c1b183001cb1e43
Instruction ID: e56a1e53769f4d289a2f14b966dd06609ac575c59098964d047d3f18ad19137c
Opcode Fuzzy Hash: fd15927265dd169e01f063ae23ff266c77756d60ab524ef19c1b183001cb1e43
Instruction Fuzzy Hash: AA31B372504344AFEB228F65DC44FA7BFACEF45710F0888AEE985CB152D224A919CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0117AC3A Relevance: 1.6, APIs: 1, Instructions: 91
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 0117ACFA

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: ae51db8fec6b6fa64e54af98444c06cc2a0abc605cbafee6f67b64b6c2159609
Instruction ID: dccc5e7ae78ed12f4b01b951dd82c60b3ecb2714e6803fd985a96a824c301f44
Opcode Fuzzy Hash: ae51db8fec6b6fa64e54af98444c06cc2a0abc605cbafee6f67b64b6c2159609
Instruction Fuzzy Hash: 88316E7240E3C05FD3138B758C65A95BFB4AF47610F1E85DBD8C48F1A3D2696809C762

Uniqueness

Uniqueness Score: -1.00%

Function 0117A4E8 Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0117A589

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 68e6197fe0370ee81ac7ee8c60757292a4cd8cd28d567e1575a0d79e7398e683
Instruction ID: 04dd64cf67a532e13962943082814c68602729dfce02ff23d67d413fddee358a
Opcode Fuzzy Hash: 68e6197fe0370ee81ac7ee8c60757292a4cd8cd28d567e1575a0d79e7398e683
Instruction Fuzzy Hash: 99316D71505380AFE722CF69DC44F66BFE8EF45620F0884AEE9858B252D375E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0117A120 Relevance: 1.6, APIs: 1, Instructions: 82
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 0117A1C2

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: ca5776d671f17b7d45e6e8ad0d816582532a8a07807a926f614c398ac4748c39
Instruction ID: 123fc8ec5fa04b222cc29f35d175b2a4c66dfee11457a67ffac2fd8360de7db0
Opcode Fuzzy Hash: ca5776d671f17b7d45e6e8ad0d816582532a8a07807a926f614c398ac4748c39
Instruction Fuzzy Hash: 5E219C7140D3C06FD7128B258C51BA6BFB4EF87620F1981DBD8848F293D225A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0117A9EC Relevance: 1.6, APIs: 1, Instructions: 82
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,1392D834,00000000,00000000,00000000,00000000), ref: 0117AA8C

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 054fb45e2e868be19d80c9d43ac82937a39ed5f41d06d2be48e3001545fa70e7
Instruction ID: 3bdd2c0b1818aeb501909d424b2edd2c2bde735cdfbfe893d40b20a6f6cbebb1
Opcode Fuzzy Hash: 054fb45e2e868be19d80c9d43ac82937a39ed5f41d06d2be48e3001545fa70e7
Instruction Fuzzy Hash: 5B216D72505740AFE722CF25DC44FA6BFF8EF45710F08849AE985CB252D364E948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0117B33A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0117B3B7

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 21e6ad4999d3ca2a1550a0766417847cae8b56ff0b8905cc5eb7ae5b05da4a93
Instruction ID: d447f9a22f84cddc0ca58cbb570c97820cae41152da028c716ecdc2a7805526e
Opcode Fuzzy Hash: 21e6ad4999d3ca2a1550a0766417847cae8b56ff0b8905cc5eb7ae5b05da4a93
Instruction Fuzzy Hash: 9221B072504204AFEB21DF69DC45FABBBACEF04310F04886EED858B651D371A548CB75

Uniqueness

Uniqueness Score: -1.00%

Function 0117ADEE Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 0117AE6B

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 290c520f122502bf4a64a93c1e53ae43e36f88e81d09039356d266d21b6ba1c7
Instruction ID: cb8c537d5a5098660f932e2b8a00ce5889c1a26cd10130b9437daa8039db48cb
Opcode Fuzzy Hash: 290c520f122502bf4a64a93c1e53ae43e36f88e81d09039356d266d21b6ba1c7
Instruction Fuzzy Hash: 1021B072500204AFEB21DF69DC44FABBBACEF04310F08886EED858B251D671A5088B71

Uniqueness

Uniqueness Score: -1.00%

Function 0117A75C Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E2C,1392D834,00000000,00000000,00000000,00000000), ref: 0117A7EA

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 39bf9938ac45463da1ecb09126aa4828678fe2a0789a6271185614567c92cd69
Instruction ID: 25333b25bc2e259326bef99819c082992b285950cd05d14d561546a5bd141c74
Opcode Fuzzy Hash: 39bf9938ac45463da1ecb09126aa4828678fe2a0789a6271185614567c92cd69
Instruction Fuzzy Hash: B421A171409380AFE722CB25DC40FA6BFB8EF46724F0884EAED848F153D265A809C771

Uniqueness

Uniqueness Score: -1.00%

Function 0117A83F Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,1392D834,00000000,00000000,00000000,00000000), ref: 0117A8CD

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 82a8332ff50bb9c826c3c74ad6f8e5c2e31e9916bf677ba7c16c21c9c2c072c1
Instruction ID: 7f897d3c48066c98e891350f95cf5373390a3145d6c37d717b19cda1cdc279f4
Opcode Fuzzy Hash: 82a8332ff50bb9c826c3c74ad6f8e5c2e31e9916bf677ba7c16c21c9c2c072c1
Instruction Fuzzy Hash: 9A21AE71409380AFDB22CF65DC44F96BFB8EF06310F08849AE9849F162D265A408CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0117AAE2 Relevance: 1.6, APIs: 1, Instructions: 77
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,?,?), ref: 0117AB7E

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 5a96c4eed14a11922f043eb0803196710c9acc4f8089ff17a77331da1408d87d
Instruction ID: 7be209751ae7881996c80a37772f7dc7040c20981cab5331e4a4bb07956239ab
Opcode Fuzzy Hash: 5a96c4eed14a11922f043eb0803196710c9acc4f8089ff17a77331da1408d87d
Instruction Fuzzy Hash: CA21D6754093C06FD3138B25CC51B62BFB4EF87A10F0981CBE8848B653D2256919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0117A50A Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0117A589

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 26fde5dcf02034babedb7ef61ff3cf3c85741ad8b144cc989f62c7de570f283f
Instruction ID: f579199d4e0b1a7855a52f68579c40e1e9f2a9433e7b7f5a750825bbcfd6780b
Opcode Fuzzy Hash: 26fde5dcf02034babedb7ef61ff3cf3c85741ad8b144cc989f62c7de570f283f
Instruction Fuzzy Hash: 77217C71504200AFEB25DF69DC85B6AFBE8EF08710F08846EE9898B752D771E504CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0117A69B Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E2C,1392D834,00000000,00000000,00000000,00000000), ref: 0117A721

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 05b1af947e2f39e1aa7d43fd473e0e2388130e31a33dd510c7292ddda1f9384a
Instruction ID: 42612e6da1b1003d1fcde11d2e6f892c656688698b5028057bd5c5dc3d3759e5
Opcode Fuzzy Hash: 05b1af947e2f39e1aa7d43fd473e0e2388130e31a33dd510c7292ddda1f9384a
Instruction Fuzzy Hash: DB21D2B54097806FE712CB25DC40BA6BFB8EF46720F1880DBED848B293D265A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 0117A5E0 Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0117A654

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: a926ffa08ad2c220cd92713eab517359777707af7d778a68d6af2a8a416c7994
Instruction ID: 13850f4176f456c53da5631c7b97cc269dcb097683ee53314704c6b6d042bbd7
Opcode Fuzzy Hash: a926ffa08ad2c220cd92713eab517359777707af7d778a68d6af2a8a416c7994
Instruction Fuzzy Hash: 5321C27540A3C05FDB138B25DC95692BFB8AF07224F0D84EBED858F2A3D2655908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0117A917 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0117A997

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 00f5b459fe785cc8f64d672e2a54b58728da92257c53aefeccf51cf6bf7b8f8a
Instruction ID: 78d4f5a82b68f5672883ed977f8f373593207a34c4bb05c25d507b4dbff5fd45
Opcode Fuzzy Hash: 00f5b459fe785cc8f64d672e2a54b58728da92257c53aefeccf51cf6bf7b8f8a
Instruction Fuzzy Hash: ED21AF765093C45FEB12CB29DC55B96BFE8AF06214F0D80EAE984CF253E324D949CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0117AA12 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,1392D834,00000000,00000000,00000000,00000000), ref: 0117AA8C

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 53df0c9339b80764b025395bfe1580f445726e44207e777a33425abfc735e740
Instruction ID: 20f5f53fdb6da242d7cba7e0f1cf3f087efbbc63c02a29a95826ba287803ba2e
Opcode Fuzzy Hash: 53df0c9339b80764b025395bfe1580f445726e44207e777a33425abfc735e740
Instruction Fuzzy Hash: 81218C71600600AFE721DF19DD84FAABBECEF04710F08846AED498B352D360E908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0117A86E Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,1392D834,00000000,00000000,00000000,00000000), ref: 0117A8CD

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f4d32e018861af8a4bc80fe9a429bc04e05b9fe84bfbde07857e048341eb1092
Instruction ID: f0897a579cdab333624046facfa747d253ea810b44e169d5e04aed95e00eeced
Opcode Fuzzy Hash: f4d32e018861af8a4bc80fe9a429bc04e05b9fe84bfbde07857e048341eb1092
Instruction Fuzzy Hash: F111C471400200AFEB21CF55DC40FAAFFA8EF04710F18846EED498B251D375A404CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0117A78E Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E2C,1392D834,00000000,00000000,00000000,00000000), ref: 0117A7EA

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 8ac495c374077eee34405d2aa68aea555385cbc19202cf830e9fac052857d78d
Instruction ID: 2dbeb707ccb08d7fbd77123ba2de6f6fc250b20543338cfdf290353d161c5462
Opcode Fuzzy Hash: 8ac495c374077eee34405d2aa68aea555385cbc19202cf830e9fac052857d78d
Instruction Fuzzy Hash: 1511A771504200AFEB21CF59DC45FAAFFA8EF44720F18C46AED499B241D375A404CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0117A2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0117A30C

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 28767ecf6d556945ac5c3a7a7bc73fd64a8d7bd523e7d11a3c6f0e7274d113fb
Instruction ID: 161cde77409a77e8c7b108baf74e1be84e058415414ca830834772ee42617c7d
Opcode Fuzzy Hash: 28767ecf6d556945ac5c3a7a7bc73fd64a8d7bd523e7d11a3c6f0e7274d113fb
Instruction Fuzzy Hash: 60118C7580D3C09FD7238B25DC54A96BFB4DF06220F0D80DBED848F263D265A848CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0117A952 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 0117A997

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d4c01dde837f26345ba8f092d3ea6e009db4973a2798e6bef8cb0c42fb653218
Instruction ID: 2916356628a41a73a4bcae06acfa1b04e186a9063200e8e28f0bad71ea143c80
Opcode Fuzzy Hash: d4c01dde837f26345ba8f092d3ea6e009db4973a2798e6bef8cb0c42fb653218
Instruction Fuzzy Hash: 2011A1756002408FDB54CF29E8847AAFBE8EF04220F0DC0AADD49CB342E374E454CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0117B04F Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0117B0A8

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 03e1b0f7549f541532cec3631b843edcf6a568c163fbf0985582880463cb1743
Instruction ID: 65bfa59b1a766514eda7c193ed9b80e35aa6d57e43a2d0962649ac75ffc74e03
Opcode Fuzzy Hash: 03e1b0f7549f541532cec3631b843edcf6a568c163fbf0985582880463cb1743
Instruction Fuzzy Hash: BE11A0715093C09FD7128B29DC45A56FFB4EF06220F0984EFED858B263C375A848CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0117A6CE Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,1392D834,00000000,00000000,00000000,00000000), ref: 0117A721

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 0400fe863b58ad9bb655b31be39a10c934e5669a1b2807b2d9b39bd00c492135
Instruction ID: 7ce1c66d771b077685e0d680bfc7d0cefe174db95e14f19c9189cc4a55d5122f
Opcode Fuzzy Hash: 0400fe863b58ad9bb655b31be39a10c934e5669a1b2807b2d9b39bd00c492135
Instruction Fuzzy Hash: 0501D271500600AEE720CB19DC85BAAFFB8DF44720F1880AAED499B342D275A504CAB6

Uniqueness

Uniqueness Score: -1.00%

Function 0117B278 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 0117B2CC

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 6c4f8babd4f86d6326a0dc1b7fa0eadf20cd9df5d5d450df7534c231524ea5f3
Instruction ID: 4dc018d81012fa4f1a01f9822073029299f79b8fd53300b6ad55b5d5a484ae7d
Opcode Fuzzy Hash: 6c4f8babd4f86d6326a0dc1b7fa0eadf20cd9df5d5d450df7534c231524ea5f3
Instruction Fuzzy Hash: 11115E714093809FD7128F25DC44B56BFB4DF46224F0884EAED848F253D275A548CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0117ACAA Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 0117ACFA

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 8efa3415064c0658897c8748aee538a7a21adbd0c02986f82c88a18c318e7eb8
Instruction ID: 9dfb91df0ab900cce415877a9642de0171c7d332ae19e19b225bc18c4210a22c
Opcode Fuzzy Hash: 8efa3415064c0658897c8748aee538a7a21adbd0c02986f82c88a18c318e7eb8
Instruction Fuzzy Hash: 5901BC71900200AFD310DF1ADC82B26FBA8FB88B20F14812AED088B741E231B915CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0117A172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 0117A1C2

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 83ce31f0b08d59c3b09d314740dcccc322b5d700b633c7bc3197ccf875123fdb
Instruction ID: 74503e6942d9816e605df01982ea45200a672bdef35cf8a89949a3c6a2e3ba7c
Opcode Fuzzy Hash: 83ce31f0b08d59c3b09d314740dcccc322b5d700b633c7bc3197ccf875123fdb
Instruction Fuzzy Hash: 1D01BC71900200AFD710DF1ADC82B26FBA8EB88A20F14816AED088B741E231B915CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0117A622 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0117A654

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: af7343e630444e8a92321668b8311835dfa8519a2f201f2f8ffe72478bc5d5b1
Instruction ID: 87bc0459def64c6c503aae3ce49ffd34bb0e623141b5cadbe3ad1b86d3ef6b22
Opcode Fuzzy Hash: af7343e630444e8a92321668b8311835dfa8519a2f201f2f8ffe72478bc5d5b1
Instruction Fuzzy Hash: BA018F759042409FDB158F29EC857AAFBA4EF44220F08C4AFED098F356D275A448CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0117AB2E Relevance: 1.5, APIs: 1, Instructions: 43registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,?,?), ref: 0117AB7E

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: d96b06b2bc4a1901fd822006a3178b819080261aad56a6fa623f09c127bb4d5c
Instruction ID: 87b1749d67d4b5a8d5e01e4a16f0deb929e6301e8a7b4b5c04263cbb4a95ae02
Opcode Fuzzy Hash: d96b06b2bc4a1901fd822006a3178b819080261aad56a6fa623f09c127bb4d5c
Instruction Fuzzy Hash: 1A01AD71540600ABD210DF1ADC82F26FBA8FBC8B20F14811AED084B741E371F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 0117B076 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 0117B0A8

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: b30d92ff39ff6f65652b2df211a59940cd5a6129e57ba06897a5eb3725c4b274
Instruction ID: bd32d1a4a5010ce35dbfa96ac993321d33d58fb67467971264a961a4eea2ed3b
Opcode Fuzzy Hash: b30d92ff39ff6f65652b2df211a59940cd5a6129e57ba06897a5eb3725c4b274
Instruction Fuzzy Hash: 3301D1355082408FDB158F19D88476AFBB4DF04220F08C0AEDD198B352D375A448CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0117A2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0117A30C

Memory Dump Source

Source File: 00000006.00000002.363277233.000000000117A000.00000040.00000800.00020000.00000000.sdmp, Offset: 0117A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_117a000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 462166c3b970a2f181de449b793e43895f563668c11197a0f0a108bcf5c6ded4
Instruction ID: 481f258e4d1d162137465646f5f7434565a8403528dd23d96620fa8bbc84ffbe
Opcode Fuzzy Hash: 462166c3b970a2f181de449b793e43895f563668c11197a0f0a108bcf5c6ded4
Instruction Fuzzy Hash: 32F04F35908644DFDB248F19E88576AFFB4EF44720F0CC0AADD494B356D3B5A548CA62

Uniqueness

Uniqueness Score: -1.00%

Function 01801419 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

M]-q^, xrefs: 0180158A, 0180158F

Memory Dump Source

Source File: 00000006.00000002.363832759.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_unarchiver.jbxd

Similarity

API ID:
String ID: M]-q^
API String ID: 0-1558019382
Opcode ID: 8f11d1cdbd16f2ea3c588e4171f88f6ee9b550e0e4e33ec77c11e2d8ba64f706
Instruction ID: 3853a554255507a972186d4f1ff3362563c94f32f4b0b749c237300915986c4c
Opcode Fuzzy Hash: 8f11d1cdbd16f2ea3c588e4171f88f6ee9b550e0e4e33ec77c11e2d8ba64f706
Instruction Fuzzy Hash: BD511874E02219DFCB19DFB5D880AAEBBB3FF8A300F249569D405A7390CB359942CB54

Uniqueness

Uniqueness Score: -1.00%

Function 02F3086F Relevance: 1.0, Instructions: 978COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363880250.0000000002F30000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f30000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7839b69557337c9fcd3ec18d64b9907a6c21d558688b4361a223a0b52f224bc8
Instruction ID: a3c6402c981415e7ea160e97807294091ec922f2739fcec96da1dccf9ec5ebe6
Opcode Fuzzy Hash: 7839b69557337c9fcd3ec18d64b9907a6c21d558688b4361a223a0b52f224bc8
Instruction Fuzzy Hash: 37118FA294E3C04FDB0357285CA55E57FB0DE93120B1D86DBD8C48F5A3E61D091BC3A2

Uniqueness

Uniqueness Score: -1.00%

Function 01801988 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363832759.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807d87d03ed3b32b4f94a980c6b4c91a2000b71cf0fc1a971af4a069284a2c2e
Instruction ID: df59c10ba32b9f29d43c7ebd5b094632a7ab6ef1f0cc043948f46374a762f3d6
Opcode Fuzzy Hash: 807d87d03ed3b32b4f94a980c6b4c91a2000b71cf0fc1a971af4a069284a2c2e
Instruction Fuzzy Hash: 4481B274D01209DFCB08DFA9C580AAEBBB2BF89304F249569C415B7394DB359E82CF95

Uniqueness

Uniqueness Score: -1.00%

Function 018012E8 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363832759.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 574d3f5a41bee68d1044fd4a28e5f9782b65cd70a257ccd71de0aa4e9b9cff65
Instruction ID: fedb86677486efd313f6a3979b0cdd6700c6ce4429b789a9fb4fbb86f17d5f39
Opcode Fuzzy Hash: 574d3f5a41bee68d1044fd4a28e5f9782b65cd70a257ccd71de0aa4e9b9cff65
Instruction Fuzzy Hash: DB114971D11208AFCB45DFA4E8509FFBBB6FF8A310F10156AE501B7264DA316E16CB90

Uniqueness

Uniqueness Score: -1.00%

Function 018012F8 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363832759.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dc31a9fe040378c50dd9b973ed5ede548107ed45f49c26bcaf9b4366527c44a
Instruction ID: 16ad1c6c5a8d8e7344c42b7a930ebf31697911245a32c6792de2ec154453a20e
Opcode Fuzzy Hash: 8dc31a9fe040378c50dd9b973ed5ede548107ed45f49c26bcaf9b4366527c44a
Instruction Fuzzy Hash: 8D110631D11218AFCB05DFA4E9809EEBBB6FB8A310F101529E501B3264DB316D56CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02F307F8 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363880250.0000000002F30000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f30000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33bf3c1a9b7cf4392c9a28bc6e4404be70ab1a75b0f74357b728736cd6a133ce
Instruction ID: 7b7c4efde97e15757f6f457fec0c1a13a35bba3565df5d461786cf918606314d
Opcode Fuzzy Hash: 33bf3c1a9b7cf4392c9a28bc6e4404be70ab1a75b0f74357b728736cd6a133ce
Instruction Fuzzy Hash: 7701B5B28096406FD301CF19EC41D57FBF8DF86610F05C5AAEC488B201E266B9188BB2

Uniqueness

Uniqueness Score: -1.00%

Function 01801620 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363832759.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23d50219375b27b124751557fc393bc2deab0f2a3143e2613bb35176690e5f24
Instruction ID: 2c41d9cdf10e4200123f8c7a20abe4623cca8a4184d0f6a5df50704ea6625996
Opcode Fuzzy Hash: 23d50219375b27b124751557fc393bc2deab0f2a3143e2613bb35176690e5f24
Instruction Fuzzy Hash: 85115370C01249DFCB15EFB8C8446AEBFB1EF06305F2499AEC011A7291D7389A80CB85

Uniqueness

Uniqueness Score: -1.00%

Function 02F305CF Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363880250.0000000002F30000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f30000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 301e2d787f4346374ef32ccb56a72e803a03c8dda41eaaac78139157f68bf618
Instruction ID: fbf8edf771f7c7ae9ae50e55850b797eb7fd3339d9eac1134e3716e171a70342
Opcode Fuzzy Hash: 301e2d787f4346374ef32ccb56a72e803a03c8dda41eaaac78139157f68bf618
Instruction Fuzzy Hash: 510184B55097806FD7028B19DC418A3FFE8DF46630B0980ABEC888B212D265A919CB72

Uniqueness

Uniqueness Score: -1.00%

Function 01801630 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363832759.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e03d266ba8a254b9e26bd21524b919e5be7b5347f013a62c4e1b6bb1fdf4f00
Instruction ID: 5b41a1d05f5e982e02f7ceacd25161b7c43e63c32b20b6b0dbd265db262c7f0a
Opcode Fuzzy Hash: 2e03d266ba8a254b9e26bd21524b919e5be7b5347f013a62c4e1b6bb1fdf4f00
Instruction Fuzzy Hash: 6F011270C01219DFCB04EFA8C8456AEBBB1EB45301F2099A9C025A3280DB789A80CF89

Uniqueness

Uniqueness Score: -1.00%

Function 018013A8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363832759.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c243fef00b3f6300012f89ecf6707c42db7efe5387499eca5fd5a9415f8e76c0
Instruction ID: 1a09e131b31663bd25333ab07aff2105c7513543eae4ef54e44af12d0df09604
Opcode Fuzzy Hash: c243fef00b3f6300012f89ecf6707c42db7efe5387499eca5fd5a9415f8e76c0
Instruction Fuzzy Hash: BC0119B4D05209DFCB45DFA9C9805EEBBF1BF49300F2094A6D854A7255D6305B12DB51

Uniqueness

Uniqueness Score: -1.00%

Function 02F3081E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363880250.0000000002F30000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f30000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7253129fc30f56127c1b9312c3bf946f10eef2095fea46ae216eda084041da94
Instruction ID: 7d242a42404b3c2cee11fdfe8e9d489080ef8b48b2e3fa04ff3759ce60a65ed6
Opcode Fuzzy Hash: 7253129fc30f56127c1b9312c3bf946f10eef2095fea46ae216eda084041da94
Instruction Fuzzy Hash: FAF08CB28456046FD240DF09EC418A6FBECDFC4621B18C52FEC488B301E276AA148AE2

Uniqueness

Uniqueness Score: -1.00%

Function 02F305F6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363880250.0000000002F30000.00000040.00000020.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2f30000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7046543b91fc605db03ca24b71de40e00bd0221a503057b1286be11462b3e533
Instruction ID: 929edb76fb06cc3d13e307c681d1f4f21ffeb0bbbba123b0ef19d45a554c0ffa
Opcode Fuzzy Hash: 7046543b91fc605db03ca24b71de40e00bd0221a503057b1286be11462b3e533
Instruction Fuzzy Hash: 7BE092766016004BD750CF0AEC41492FBD8EB84630B18C07FDC1D8B711E175B504CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 011723F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363265719.0000000001172000.00000040.00000800.00020000.00000000.sdmp, Offset: 01172000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1172000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3780a5cef4974f0d6ea074babab7df3b36bc23832f2d76eb26c6cfad7a199ad7
Instruction ID: fd35447dbeb42a3c596b22e5ddc571f5de602594f79f6d4069936199cb9177ff
Opcode Fuzzy Hash: 3780a5cef4974f0d6ea074babab7df3b36bc23832f2d76eb26c6cfad7a199ad7
Instruction Fuzzy Hash: 81D05E79315A818FE32A8A1CD1A8B953FF4AB52B04F5644FDE8008B763C368D582D600

Uniqueness

Uniqueness Score: -1.00%

Function 011723BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363265719.0000000001172000.00000040.00000800.00020000.00000000.sdmp, Offset: 01172000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1172000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9fb342b72fe96afb1e4e1ec52f99218a3148abb08503191b802523b43cd0ad
Instruction ID: 2832e77b239b9fc18dfe1da8c29b9534eef94042064e737c8661740f30badb29
Opcode Fuzzy Hash: 9c9fb342b72fe96afb1e4e1ec52f99218a3148abb08503191b802523b43cd0ad
Instruction Fuzzy Hash: 92D05E342046814BD719DB0CC294F593BE4AB49B00F0644EDAC008B362C7B4D8C2C600

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 018002B9 Relevance: 1.6, Strings: 1, Instructions: 353COMMON

Download Yara Rule

Strings

m]-q^, xrefs: 01800387, 0180038C

Memory Dump Source

Source File: 00000006.00000002.363832759.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_unarchiver.jbxd

Similarity

API ID:
String ID: m]-q^
API String ID: 0-2635878962
Opcode ID: 3c6ea21065c348b37febbdf89f451a1b5148a532ef7b88d18002afe464d10fa5
Instruction ID: 9245fc2601e547d5cda512add3ab0eb3a6cf2ee873bfeb8b8ed4584779c3273d
Opcode Fuzzy Hash: 3c6ea21065c348b37febbdf89f451a1b5148a532ef7b88d18002afe464d10fa5
Instruction Fuzzy Hash: 57F1F334901618EFEB29CF64D944BAABBB6FF89301F1095E9D509AB354CB354E89CF10

Uniqueness

Uniqueness Score: -1.00%

Function 01800AB7 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363832759.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b3e54cfe5c463da9bb49a874ded19d11039ba24118c20aea38a8e3c0e524aa
Instruction ID: 7900a78b261bfc77bda40c2a33437fe6f5fe79518aabfad9f04ea11533077922
Opcode Fuzzy Hash: 99b3e54cfe5c463da9bb49a874ded19d11039ba24118c20aea38a8e3c0e524aa
Instruction Fuzzy Hash: 2FF0D431E4511CCFCB11CE94D8806FCF779FB4A359F60A255D40AA7246C735DA85CA44

Uniqueness

Uniqueness Score: -1.00%

Function 01800A7C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.363832759.0000000001800000.00000040.00000800.00020000.00000000.sdmp, Offset: 01800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1800000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20b6e96a8687a6cdf67b9a7eee673b58766f7431002729ff9edb13c63664ba9
Instruction ID: 20f82cea13667d4b144401e9a058e88095883417a808a7ea2d17c0bdd4211659
Opcode Fuzzy Hash: e20b6e96a8687a6cdf67b9a7eee673b58766f7431002729ff9edb13c63664ba9
Instruction Fuzzy Hash: F1F0C935E4511CCFCB11CE94D8806FCF379FB4A359F60A655D40AB7245C736DA45CA44

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 7140, Parent PID: 5940COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	33
Total number of Limit Nodes:	1

Executed Functions

Function 04BE0120 Relevance: 3.2, APIs: 2, Instructions: 195
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 04BE016B
VirtualProtect.KERNELBASE(?,?,00000000), ref: 04BE0312

Memory Dump Source

Source File: 0000001D.00000002.514983912.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_4bc0000_regsvr32.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 908ff1232115a672daceacccd1e388f79e6961393f0a3edebe41de14d0d5fad2
Instruction ID: 7897e7528e1871f4c6baf23e4642161c63641057ad3563c6a70a4e073de7052b
Opcode Fuzzy Hash: 908ff1232115a672daceacccd1e388f79e6961393f0a3edebe41de14d0d5fad2
Instruction Fuzzy Hash: 9191CA75A00109DFCB48DF89D590EAEB7B6FF88304F148199E815AB346D775EA42CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04BE0540 Relevance: 3.1, APIs: 2, Instructions: 86
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,00000004,00000040,?), ref: 04BE05DB
VirtualProtect.KERNELBASE(?,00000004,?,?), ref: 04BE0613

Memory Dump Source

Source File: 0000001D.00000002.514983912.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_4bc0000_regsvr32.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0a894fec6175854ae8b2712809d142e72fa9094a0c42227173d89027c1b642ac
Instruction ID: f587e047160638397e371f6a8e83eba16eed5bea7a5a049f4a5e200e63dda77c
Opcode Fuzzy Hash: 0a894fec6175854ae8b2712809d142e72fa9094a0c42227173d89027c1b642ac
Instruction Fuzzy Hash: 98418474A00219EFCB08DF89C890BEDB7B1FF88314F148199E919AB351D775AA45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04BDFBD0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 46
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 04BDFC54

Strings

VirtualAlloc, xrefs: 04BDFC39, 04BDFC3C

Memory Dump Source

Source File: 0000001D.00000002.514983912.0000000004BC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_4bc0000_regsvr32.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: VirtualAlloc
API String ID: 4275171209-164498762
Opcode ID: 0a7b03ca3328d8d5ce176abfae7b90b625f1715e0bfc58100f669a5480e56ec7
Instruction ID: d859d179504278b5bda6dc222c94802560d464f5087bf60dfb924101e214928c
Opcode Fuzzy Hash: 0a7b03ca3328d8d5ce176abfae7b90b625f1715e0bfc58100f669a5480e56ec7
Instruction Fuzzy Hash: 0B113060D08289EAFB01DBE884097FEBFB55B11708F0840D8D5456A282D2BA575887A6

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorer.exePID: 6792, Parent PID: 7140COMMON

Execution Graph

Execution Coverage:	14.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	50

Executed Functions

Function 0259BBFE Relevance: 6.1, APIs: 4, Instructions: 71
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008), ref: 0259BC1F
GetLastError.KERNEL32 ref: 0259BC29

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: CreateErrorLastSnapshotToolhelp32
String ID:
API String ID: 4136412728-0
Opcode ID: 4cbb9e2dd4362c3b05cbc83e2120dc4f2a3a675eb979caffad7db64ecbd1f61a
Instruction ID: e9c9a98b9873cfd2926d5154973ba5b8df1aee0d9839f1eb7978ab7dce4419ef
Opcode Fuzzy Hash: 4cbb9e2dd4362c3b05cbc83e2120dc4f2a3a675eb979caffad7db64ecbd1f61a
Instruction Fuzzy Hash: 01219371900423AFEB10EBB8EC89F9A37ECFF09224F2006A0E525D7190DB31D945CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0259F175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(.dll,?,00000138,00000000), ref: 0259F245
GetProcAddress.KERNEL32(00000000,?), ref: 0259F251

Strings

.dll, xrefs: 0259F241, 0259F244

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll
API String ID: 2574300362-2738580789
Opcode ID: 8888b14416fc87a26ef7fb02841c3a35a5173944ff3d4f668675f61253774298
Instruction ID: a362a263aa65ddb2814201161fbcd5d1e6b804518fa1a6d7a0166f6e36fefbbd
Opcode Fuzzy Hash: 8888b14416fc87a26ef7fb02841c3a35a5173944ff3d4f668675f61253774298
Instruction Fuzzy Hash: 6831AD35A002159BCF24CFADD880BAEBBE5BF44308F28446AC805E7641D730D951DBE8

Uniqueness

Uniqueness Score: -1.00%

Function 0259E03B Relevance: 3.0, APIs: 2, Instructions: 45COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(025C0000,025C0000,?,02593BA4), ref: 0259E0AE
GetCurrentProcessId.KERNEL32(?,02593BA4), ref: 0259E0B4

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: CurrentProcessVersion
String ID:
API String ID: 2809935031-0
Opcode ID: 2a895f899bbcb0d23b5d1bd9376c76625b9a42ebbc34d30f88180af0d3c08c93
Instruction ID: ef2dda2be39228de4855912b53f0ef607b61b28970792608c1f4f6cb455e634b
Opcode Fuzzy Hash: 2a895f899bbcb0d23b5d1bd9376c76625b9a42ebbc34d30f88180af0d3c08c93
Instruction Fuzzy Hash: 3A01DE71941B019BDB20AF70D84AFEA7BE5FF88320F00082DE59A87240EB75A544CF98

Uniqueness

Uniqueness Score: -1.00%

Function 025936B2 Relevance: 1.6, APIs: 1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7030bc2aa4566b58995c888ec1f3bccb8523b9df549acdff5802082b1c5f763
Instruction ID: 3a4d2c152e86adf47d89a45b651406e1fe3033973794b7cf180e6c3dcc43fe47
Opcode Fuzzy Hash: c7030bc2aa4566b58995c888ec1f3bccb8523b9df549acdff5802082b1c5f763
Instruction Fuzzy Hash: 2221AA71A05116FADF14AB7ADC45F6A3AE9FB45670B20066AE432D61D0EA329600CB58

Uniqueness

Uniqueness Score: -1.00%

Function 02596015 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL(00000001,02595FBA,025961E4), ref: 02596021

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 7a4f92c1076f969a62679ebef7f93c83bdc5c4cddb33f8c2f53bda31d43ab634
Instruction ID: b7ff71358e52df389d44bccf32643d604996cab859dcb67876526e68e93fe1c5
Opcode Fuzzy Hash: 7a4f92c1076f969a62679ebef7f93c83bdc5c4cddb33f8c2f53bda31d43ab634
Instruction Fuzzy Hash: 40B092712851029BEB466B70C80BFC63391FB40B12F5004B0720A95091EAA294609A19

Uniqueness

Uniqueness Score: -1.00%

Function 02598A0D Relevance: 33.5, APIs: 11, Strings: 11, Instructions: 463
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?,00000138,?,025ACA50), ref: 02598A6A
lstrlenW.KERNEL32(?,?,025ACA50), ref: 02598ABE
lstrlenW.KERNEL32(?,?,025ACA50), ref: 02598B36
lstrlenW.KERNEL32(?,?,025ACA50), ref: 02598B8E
lstrlenW.KERNEL32(?,?,025ACA50), ref: 02598BDB
lstrlenW.KERNEL32(?,?,025ACA50), ref: 02598C33
lstrlenW.KERNEL32(?,?,025ACA50), ref: 02598C8A
lstrlenW.KERNEL32(?,?,025ACA50), ref: 02598CE1
lstrlenW.KERNEL32(?,?,025ACA50), ref: 02598D3B
lstrlenW.KERNEL32(?,?,025ACA50), ref: 02598DB2
lstrlenW.KERNEL32(?,?,025ACA50), ref: 02598E02

Strings

Cofkjowiejfijrfjrnstant, xrefs: 02598B45
OihihHIt, xrefs: 02598C4B
Constant, xrefs: 02598B94
Conddfsdsfsdtant, xrefs: 02598A16
Constodfksdkfdkfsant, xrefs: 02598AEF
GetCurrentDirectory, xrefs: 02598DC7
UHuHUygYGYg, xrefs: 02598C9A
CUuhicid, xrefs: 02598A75
Coisjfidjfidjfid, xrefs: 02598BEC
ConsUHhUGHuGHUHtant, xrefs: 02598CF3
Constaodjdaifisdjfdsant, xrefs: 02598D6E

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: CUuhicid$Cofkjowiejfijrfjrnstant$Coisjfidjfidjfid$Conddfsdsfsdtant$ConsUHhUGHuGHUHtant$Constant$Constaodjdaifisdjfdsant$Constodfksdkfdkfsant$GetCurrentDirectory$OihihHIt$UHuHUygYGYg
API String ID: 1659193697-4164926346
Opcode ID: e82d05a21cbfe948b9f18ffe898aa3849c10d55a84f7030035b0eaf21de9c045
Instruction ID: 3e090345fb0ccc6e2c8fbf4f9beecca095230307271142767dc56507939bbd33
Opcode Fuzzy Hash: e82d05a21cbfe948b9f18ffe898aa3849c10d55a84f7030035b0eaf21de9c045
Instruction Fuzzy Hash: 87E1B575F01649AFEF04CEB8D4585EEBFA2BF4E200B24487DD951EB241DB709949CB48

Uniqueness

Uniqueness Score: -1.00%

Function 025950BE Relevance: 9.2, APIs: 6, Instructions: 250
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 025950E0
lstrcpyW.KERNEL32 ref: 0259534B
lstrcatW.KERNEL32(00000000,?), ref: 02595369
lstrcatW.KERNEL32(00000000,00000000), ref: 0259536D
lstrcatW.KERNEL32(00000000,025AC9B0), ref: 02595375

Part of subcall function 02598F40: RtlFreeHeap.NTDLL(00000000,00000000), ref: 02598F86

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: lstrcat$FreeHeaplstrcpymemset
String ID:
API String ID: 911671052-0
Opcode ID: 57968d36abf6180571f9f49ee2faa633ab1171221fba21a0803ee7da223e88ba
Instruction ID: 3ed67165fb2ef5198d2f1ca1565a59eccf7ccf7ea839a6d7ecbefc5acdd6a7de
Opcode Fuzzy Hash: 57968d36abf6180571f9f49ee2faa633ab1171221fba21a0803ee7da223e88ba
Instruction Fuzzy Hash: 27810E71604302AFDF15EF24D885B7F77EAFBC8720F54492EE4459B280EB70D8088A99

Uniqueness

Uniqueness Score: -1.00%

Function 02593787 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 306
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ConnectNamedPipe.KERNELBASE(00000000), ref: 025937B0
GetLastError.KERNEL32 ref: 025937BA

Part of subcall function 0259D465: FlushFileBuffers.KERNEL32(000003BC,?,02593ACE,00000000,00000004), ref: 0259D4AB

DisconnectNamedPipe.KERNEL32 ref: 02593B0B

Strings

%u.%u.%u.%u:%u, xrefs: 02593A6E

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: NamedPipe$BuffersConnectDisconnectErrorFileFlushLast
String ID: %u.%u.%u.%u:%u
API String ID: 2389948835-3858738763
Opcode ID: 004efc6333630a7386c2bc06443a6c2026ab0552cce06df498396378dc174fb6
Instruction ID: 340ae0543c08a4e35a0481611d584e647bc74b5110ff10025adbc9e854bc8253
Opcode Fuzzy Hash: 004efc6333630a7386c2bc06443a6c2026ab0552cce06df498396378dc174fb6
Instruction Fuzzy Hash: FAA1CEB2508302EFDB14EF68D885A6BBBE9FBC4324F00496EF55596180EB35D904CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 02598E10 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 92
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(?), ref: 02598E99

Strings

ore, xrefs: 02598E61
Rest, xrefs: 02598E57
ore, xrefs: 02598EC8
Z, xrefs: 02598E22

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: Rest$Z$ore$ore
API String ID: 1659193697-3809950477
Opcode ID: ccaf9d4bfd66d67ce8b6bc1bb4517e79685aa65156b2510c4e06f39f57fc2a8f
Instruction ID: 59094b30510048ee494a21b78483fa44360eb78df28802f9dee4011f16419bdd
Opcode Fuzzy Hash: ccaf9d4bfd66d67ce8b6bc1bb4517e79685aa65156b2510c4e06f39f57fc2a8f
Instruction Fuzzy Hash: 24212935B007559FDF10CFADC8582AEBBAAFF8A250F288439D991D7341D770D9068B94

Uniqueness

Uniqueness Score: -1.00%

Function 025A3943 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 025A3960
LoadLibraryA.KERNELBASE(00000000), ref: 025A39F9

Strings

kernel32.dll, xrefs: 025A395B
GetProcAddress, xrefs: 025A3969

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: GetProcAddress$kernel32.dll
API String ID: 4133054770-1584408056
Opcode ID: 85d07a37b13534244f9243e02138c833c5a3fd6a8aa6947447597ab26a644980
Instruction ID: ce058f29fd83f8c6fe45f7fba51e654734420d3dc4374f7bface63cdc834810e
Opcode Fuzzy Hash: 85d07a37b13534244f9243e02138c833c5a3fd6a8aa6947447597ab26a644980
Instruction Fuzzy Hash: 10618E75D00219EFDB00CF98C596BADBBF1FF08319F248599E816AB291D774AA80CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0259C943 Relevance: 6.1, APIs: 4, Instructions: 83
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 025990C4: memset.MSVCRT ref: 025990D6

lstrcpynW.KERNEL32(?,?,00000100), ref: 0259C98A
GetVolumeInformationW.KERNELBASE(00000000,?,00000100,00000000,00000000,00000000,?,00000100), ref: 0259C9BC

Part of subcall function 0259A1A8: _vsnwprintf.MSVCRT ref: 0259A1C5

lstrcatW.KERNEL32(?,00000114), ref: 0259C9F5
CharUpperBuffW.USER32(?,00000000), ref: 0259CA07

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: BuffCharInformationUpperVolume_vsnwprintflstrcatlstrcpynmemset
String ID:
API String ID: 455400327-0
Opcode ID: b551ddf85dc6b2d017b1d328cd90fe640e31bf169f52c5b276609d83bb4af864
Instruction ID: 1f3d9e306ebf97eb9667da90b125d08528d7c25e09ad134741c631bbef7129f6
Opcode Fuzzy Hash: b551ddf85dc6b2d017b1d328cd90fe640e31bf169f52c5b276609d83bb4af864
Instruction Fuzzy Hash: F721B6B2D40214BFEB10ABB4DC8AFEE77BDFB84310F104465B506D2181EA759E088F64

Uniqueness

Uniqueness Score: -1.00%

Function 0259D11F Relevance: 6.1, APIs: 4, Instructions: 72
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000002,00000000,00000000,00020019,00000000,00000000,?,?,02593103,00000000), ref: 0259D146
RegQueryValueExW.KERNELBASE(00000000,02593103,00000000,?,00000000,02593103,00000000,?,?,02593103,00000000), ref: 0259D16A
RegQueryValueExW.KERNELBASE(00000000,02593103,00000000,00000000,00000000,02593103,?,?,02593103,00000000), ref: 0259D198
RegCloseKey.KERNELBASE(00000000,?,?,02593103,00000000,?,?,?,?,?,?,?,00000191,?), ref: 0259D1CD

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 7e6b13e2558886a20130134c6a32009eae4e8b9e4d6fdbdbfec162137112b422
Instruction ID: bf0fc5771f42a6d09d3dc8b137f499c91dbab810b32f87e7a6a1fcbc7a003bf8
Opcode Fuzzy Hash: 7e6b13e2558886a20130134c6a32009eae4e8b9e4d6fdbdbfec162137112b422
Instruction Fuzzy Hash: B121F372A00109FFDF10AFA9DC49EAEBBF9FB88650B2444A9F505E6110D7319A10EB64

Uniqueness

Uniqueness Score: -1.00%

Function 0259D083 Relevance: 6.1, APIs: 4, Instructions: 69
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(?,00000000,00000000,00020019,?,00000000,046CFA50,?,00000001), ref: 0259D0A6
RegQueryValueExA.KERNELBASE(?,00000001,00000000,?,00000000,00000001,?,00000001), ref: 0259D0C9
RegQueryValueExA.KERNELBASE(?,00000001,00000000,?,00000000,00000001,?,00000001), ref: 0259D0F6
RegCloseKey.KERNELBASE(?,?,00000001), ref: 0259D116

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 192f73631e5852a3391cd6ac264ef3deeedbdada77526d4cf9748f376ee3279d
Instruction ID: 60b4a95a870f6aa65015ba06795f52fec71f85232b016bca9480d4af79212a4a
Opcode Fuzzy Hash: 192f73631e5852a3391cd6ac264ef3deeedbdada77526d4cf9748f376ee3279d
Instruction Fuzzy Hash: DA21F776A01109FF8F14EEA9EC45DAEBFB8FB89750B144099F801D7210E3309A04EB54

Uniqueness

Uniqueness Score: -1.00%

Function 025933B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 025990C4: memset.MSVCRT ref: 025990D6

RegisterClassExA.USER32(00000030), ref: 02593427
CreateWindowExA.USER32(00000000,?,?,00CF0000,80000000,80000000,000001F4,00000064,00000000,00000000,00000000,00000000), ref: 02593454

Strings

0, xrefs: 0259340A

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: ClassCreateRegisterWindowmemset
String ID: 0
API String ID: 2030675355-4108050209
Opcode ID: b6ccc9499d269afeed79b15bfdc46e71e4401f1da89632adf528bb5294394b87
Instruction ID: c09cb0f7af66190bd4059ba52f895db4fee310f2254c4bc2bea30660ab5af5f9
Opcode Fuzzy Hash: b6ccc9499d269afeed79b15bfdc46e71e4401f1da89632adf528bb5294394b87
Instruction Fuzzy Hash: 3E3117B1980109AFEB04DF68EC89EAA7BFCFB08354F1044A5B505D7151E731DD59CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0259A98A Relevance: 4.8, APIs: 3, Instructions: 251
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02598F2A: RtlAllocateHeap.NTDLL(00000008,?,?,025998F4,00000100,?,02596534), ref: 02598F38

Part of subcall function 02598F40: RtlFreeHeap.NTDLL(00000000,00000000), ref: 02598F86

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,0259A978,?,?,00000001), ref: 0259ABB6
RegCreateKeyA.ADVAPI32(80000001,00000000,00000000,?,?,00000001), ref: 0259ABCD
RegCloseKey.KERNELBASE(0259A978,?,?,00000001), ref: 0259ABF7

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseCreateFreeOpen
String ID:
API String ID: 3570936880-0
Opcode ID: 6ed15030b9ebfd44b534ada0dd920e585ddcea968c640225e74ce62ad6bea1aa
Instruction ID: 65c6da73b54f7037463e0c756e88b4b597431c26fc5b8ec28c4154e5c1051b0a
Opcode Fuzzy Hash: 6ed15030b9ebfd44b534ada0dd920e585ddcea968c640225e74ce62ad6bea1aa
Instruction Fuzzy Hash: D8914D71D0020AAFDF11DFA9DC85EAEBFBAFF49310F140599E515AB250D7319A00DB68

Uniqueness

Uniqueness Score: -1.00%

Function 025966F4 Relevance: 4.6, APIs: 3, Instructions: 145
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 02596712

Part of subcall function 02598F2A: RtlAllocateHeap.NTDLL(00000008,?,?,025998F4,00000100,?,02596534), ref: 02598F38

RegOpenKeyExW.KERNELBASE(?,?,00000000,0002001F,?,?,?,00000001), ref: 0259676C
RegCloseKey.KERNELBASE(00000000,?,?,00000001), ref: 02596881

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateCloseHeapOpenmemset
String ID:
API String ID: 4244679422-0
Opcode ID: 18c069f34c2f552789f46bd806f5b3afdf2da0adbf6cbb23f48a4d51b21c209d
Instruction ID: 953dafcefa2271d7ce8e22abb9a3b8b4b28fb99dbae35919eb9a664a4ea4b982
Opcode Fuzzy Hash: 18c069f34c2f552789f46bd806f5b3afdf2da0adbf6cbb23f48a4d51b21c209d
Instruction Fuzzy Hash: E6513871A0020AAFDF11EFA4DC85FAE7BBDBF08754F244469E504A6141D7759A088FA8

Uniqueness

Uniqueness Score: -1.00%

Function 0259AFA2 Relevance: 4.6, APIs: 3, Instructions: 143
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 025A38AC: lstrlenW.KERNEL32(?,000000B0,000000B0,?,00000000,000000B0,00000228), ref: 025A38F3
Part of subcall function 025A38AC: _ftol2_sse.MSVCRT ref: 025A3936

Part of subcall function 02598F2A: RtlAllocateHeap.NTDLL(00000008,?,?,025998F4,00000100,?,02596534), ref: 02598F38

RegOpenKeyExA.KERNELBASE(?,00000000,00000000,00000002,00000000), ref: 0259B0D0

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateHeapOpen_ftol2_sselstrlen
String ID:
API String ID: 15040926-0
Opcode ID: 40ea88d3148762e573d12c8a35f1e775b6cfdc42194cf111e170773dcdc9ca56
Instruction ID: 9383b7c20319eb441531b31fffcfe26ac323433f46dd6a793582233b5ef00873
Opcode Fuzzy Hash: 40ea88d3148762e573d12c8a35f1e775b6cfdc42194cf111e170773dcdc9ca56
Instruction Fuzzy Hash: 6F41807290021AAFDF11DF94EC85FEEBBB9BF44324F144166E514AB290EB709644CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0259BCC1 Relevance: 4.6, APIs: 3, Instructions: 66
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000011,?,00000010), ref: 0259BCDF

Part of subcall function 025990C4: memset.MSVCRT ref: 025990D6

Process32First.KERNEL32(00000000,?), ref: 0259BD0F
Process32Next.KERNEL32(00000000,?), ref: 0259BD42

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32memset
String ID:
API String ID: 3349827152-0
Opcode ID: e3996a963a31d1e5f062021daf644aa63d38cdc624acb245dff01ebc13eafdd3
Instruction ID: 8370d734d91ed6be2aad3dbbfea95b727ec08175ce5b9296236e06da9d5c7f27
Opcode Fuzzy Hash: e3996a963a31d1e5f062021daf644aa63d38cdc624acb245dff01ebc13eafdd3
Instruction Fuzzy Hash: AA1198725047065FE710DE79EC49F9B7BECFF85264F240A19F624C7180EB25D5088769

Uniqueness

Uniqueness Score: -1.00%

Function 0259CB51 Relevance: 4.6, APIs: 3, Instructions: 54COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,00000000,00001644,02590000,00000000,00000000,?,0259CBD2,00000000,00000000,?,0259CBFB), ref: 0259CB6C
GetLastError.KERNEL32(?,0259CBD2,00000000,00000000,?,0259CBFB,00001644,?,0259E288), ref: 0259CB73

Part of subcall function 02598F2A: RtlAllocateHeap.NTDLL(00000008,?,?,025998F4,00000100,?,02596534), ref: 02598F38

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,?,?,0259CBD2,00000000,00000000,?,0259CBFB,00001644,?,0259E288), ref: 0259CBA2

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: InformationToken$AllocateErrorHeapLast
String ID:
API String ID: 2499131667-0
Opcode ID: ab793435ee9f1be79bb414a99a7cf4d83784055a4bd0924b08d2fb48f4fe307e
Instruction ID: 05746f7c4383466ed930b3e03417a8cab637d1bae7bd1122d56a4fa84779270f
Opcode Fuzzy Hash: ab793435ee9f1be79bb414a99a7cf4d83784055a4bd0924b08d2fb48f4fe307e
Instruction Fuzzy Hash: C7016276A00115BFCF249AA5EC49EAB7FAEFE4D6A1B5005A7F905E6100E630D900D7B4

Uniqueness

Uniqueness Score: -1.00%

Function 02595EF7 Relevance: 4.5, APIs: 3, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE(00000000,00000001,00000000,00000000,00000000,?,02595F59,?,Global,025ACA40,?,00000000,?,00000001), ref: 0259B455
GetLastError.KERNEL32(?,02595F59,?,Global,025ACA40,?,00000000,?,00000001), ref: 0259B461

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: c176888326600ce98c41b7baed3889a28a2c6a042a286b6d5e591efbcbc34fd9
Instruction ID: c7b18636c511102af869cd250e3623ff7ed8ddf22df12c8be5c05bd8985c671a
Opcode Fuzzy Hash: c176888326600ce98c41b7baed3889a28a2c6a042a286b6d5e591efbcbc34fd9
Instruction Fuzzy Hash: C8F0F43164051197EE20DA78B809B7A3B9AFF52BBDF500E60F52DCA2C1DB21C400A299

Uniqueness

Uniqueness Score: -1.00%

Function 0259B3ED Relevance: 4.5, APIs: 3, Instructions: 30synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE(00000000,00000001,?,00000000,00000000,0259504F,?,?,?,?,?,?,025953C5,00000000,00000000), ref: 0259B3FB
GetLastError.KERNEL32(?,?,?,?,?,?,025953C5,00000000,00000000), ref: 0259B407
GetLastError.KERNEL32(?,?,?,?,?,?,025953C5,00000000,00000000), ref: 0259B411

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: ErrorLast$CreateMutex
String ID:
API String ID: 200418032-0
Opcode ID: a2670d931ab7e688639d1960c67eafefa8201f85923bbd9a7e27973fb6850f73
Instruction ID: 45e8b538c4bb8d2a6e8f3c590341c8921fb4411f465dd09f5f63c21f7b20e7a3
Opcode Fuzzy Hash: a2670d931ab7e688639d1960c67eafefa8201f85923bbd9a7e27973fb6850f73
Instruction Fuzzy Hash: 6FF0E531B404225BEA209B34B949BAB3696FF957A4F950960F50DDF100D730C8456798

Uniqueness

Uniqueness Score: -1.00%

Function 025953A2 Relevance: 4.1, APIs: 3, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: HandleModule$AttributesCodeExitFileFreeHeapProcess_vsnwprintf
String ID:
API String ID: 2149621965-0
Opcode ID: d87bfbf0655824c326ca9cfc01c8970cd2217772ee56864a8cfe26fe4f872e7d
Instruction ID: 680e884a72f06a84c581808ce773292d857527fc166a34be3fc5142635a63861
Opcode Fuzzy Hash: d87bfbf0655824c326ca9cfc01c8970cd2217772ee56864a8cfe26fe4f872e7d
Instruction Fuzzy Hash: 5FD1F272504302AFDB10EF68DC85F6B77EABBC9310F54092AF594D7280EB35D9148B69

Uniqueness

Uniqueness Score: -1.00%

Function 0259C193 Relevance: 3.8, APIs: 3, Instructions: 72stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0259C1B8
memset.MSVCRT ref: 0259C1C6

Part of subcall function 0259CAFA: GetCurrentThread.KERNEL32 ref: 0259CB0D
Part of subcall function 0259CAFA: GetLastError.KERNEL32(?,?,0259CC3F,00000000,02590000), ref: 0259CB1B

lstrcpynW.KERNEL32(?,?,00000104,?,?,?,?,?,00000000), ref: 0259C251

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: memset$CurrentErrorLastThreadlstrcpyn
String ID:
API String ID: 2264569553-0
Opcode ID: 725db62225c75316cb0c7e5a11a1550741ce332eee2f305e92f6533be7bc2765
Instruction ID: 43848ee9d08543266781803b3d1bea7671d34bd60689ae8187119f06f3bbe315
Opcode Fuzzy Hash: 725db62225c75316cb0c7e5a11a1550741ce332eee2f305e92f6533be7bc2765
Instruction Fuzzy Hash: 14218EB2900118AFDB10EFA4DC89EEA77ACEB49354F1044A5F606E7141EB71DE458BA4

Uniqueness

Uniqueness Score: -1.00%

Function 02592FBB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02598F2A: RtlAllocateHeap.NTDLL(00000008,?,?,025998F4,00000100,?,02596534), ref: 02598F38

lstrcatA.KERNEL32(00000000,025AC9B8,62DFE59D,-00000020,00000001,?,00000001), ref: 0259300E

Strings

%u;%u;%u, xrefs: 0259302A

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateHeaplstrcat
String ID: %u;%u;%u
API String ID: 3011335133-2973439046
Opcode ID: f0f39b9321e9551270c040d68e43f6ea7470624ba192f9553d0a926ed0b8511a
Instruction ID: 05a25176f899c961b0f8b26c7732fa064909350169203ddbe51c6bc87fb2c633
Opcode Fuzzy Hash: f0f39b9321e9551270c040d68e43f6ea7470624ba192f9553d0a926ed0b8511a
Instruction Fuzzy Hash: FE11D332E00205FFCF14DFA9E885A6A7BAAFB84314B10856AE800D7144DB31D9009B58

Uniqueness

Uniqueness Score: -1.00%

Function 02595F00 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,00000001), ref: 02595F69

Strings

Global, xrefs: 02595F3F

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID: Global
API String ID: 2591292051-4020866741
Opcode ID: a3d31b9e7b3eefb6342d66cd565da65d593fde4fe44dea2b738336248a0a57e2
Instruction ID: 227a7e7e3297b3ee5365289de82ef747db98e9c00c26d52435bd8177e07352ff
Opcode Fuzzy Hash: a3d31b9e7b3eefb6342d66cd565da65d593fde4fe44dea2b738336248a0a57e2
Instruction Fuzzy Hash: BB1182B2E04105EBDF14EBA8E945DED77F9FB84320B6000A6F416E3254EF319A14DB18

Uniqueness

Uniqueness Score: -1.00%

Function 0259A55C Relevance: 3.1, APIs: 2, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af98f01d521183da709cf63180d7df1d334994ded9634ca85061f8d54739a7a5
Instruction ID: 8c6d45d175364505627ce4c2da252a86c3beb877a5daf35b4d4e3bf31c905048
Opcode Fuzzy Hash: af98f01d521183da709cf63180d7df1d334994ded9634ca85061f8d54739a7a5
Instruction Fuzzy Hash: A7418C71A41600EFDF69CF18E881926B7FAFF89318310881DE80693755EB32AC55DF69

Uniqueness

Uniqueness Score: -1.00%

Function 0259F316 Relevance: 3.0, APIs: 2, Instructions: 35libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,?,?,025ACA50,?,02596558,?), ref: 0259F338
LoadLibraryA.KERNELBASE(00000000,?,?,?,025ACA50,?,02596558,?), ref: 0259F345

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID:
API String ID: 4133054770-0
Opcode ID: 64cf0b5a16018054994e1c35a2fbb24032ae0626296bfc9aed417a3a1d1e8007
Instruction ID: 2e3ef3f848ea58be34fdd19499d52abbfe4db824212cbb753ae73de6d08c313f
Opcode Fuzzy Hash: 64cf0b5a16018054994e1c35a2fbb24032ae0626296bfc9aed417a3a1d1e8007
Instruction Fuzzy Hash: DFF0A732700114ABDF04AF6CD84596EB7EDBF84395710442AE506D3140EBB4DD008AA8

Uniqueness

Uniqueness Score: -1.00%

Function 0259B71E Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,?,025A0DF3,00000000,00000000,025BEFE0,025AC9A0,00000000,025AC9A0,00000000,00000000,?,0000000F,00000000,046CF6B0,00000400), ref: 0259B796

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: c7bb19139eb7145c7f0b34f03d7b5c458af08f8274d9f48d843c62d277778ff0
Instruction ID: c6ade5cd2ffaea1a8a47d04eb040160fca7c033ffdaae75ebfa8c698ec3d3575
Opcode Fuzzy Hash: c7bb19139eb7145c7f0b34f03d7b5c458af08f8274d9f48d843c62d277778ff0
Instruction Fuzzy Hash: 4511B636604616ABEF10CF65E854F6A7BEDFF44668F20056AE901D7241DB32D9008B98

Uniqueness

Uniqueness Score: -1.00%

Function 0259602F Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 02598F2A: RtlAllocateHeap.NTDLL(00000008,?,?,025998F4,00000100,?,02596534), ref: 02598F38

GetDriveTypeW.KERNELBASE(?), ref: 0259607F

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateDriveHeapType
String ID:
API String ID: 414167704-0
Opcode ID: 93b516caf49bf53afbdde0d69e97224623ea31fa0fb12c18cb9ddfb3a467031b
Instruction ID: 6e41defa4ccffcf47a41a041e201ade27650d2d0dc05f3fbe8ed50d5d62db2ad
Opcode Fuzzy Hash: 93b516caf49bf53afbdde0d69e97224623ea31fa0fb12c18cb9ddfb3a467031b
Instruction Fuzzy Hash: 3A119439A002029ADF10EFB5E8486BA77E9FF88314F10452DD955D72D0EB75D40ACB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0259B6C3 Relevance: 1.5, APIs: 1, Instructions: 45fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0259B778,00000000,00000000,?,025A0DF3,00000000), ref: 0259B701

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 31c66f6053bda79692fef893e4db29f37e7645a1b3bb21c93d14d38dd8cb9983
Instruction ID: 051d058da6c99e2bc15625cfd48403cd813835d5a1de66fd4c8fe5dfb7a7c0ee
Opcode Fuzzy Hash: 31c66f6053bda79692fef893e4db29f37e7645a1b3bb21c93d14d38dd8cb9983
Instruction Fuzzy Hash: CA01FF72600219FFEB11CF95DD45BAB7BACFB44699F104465A805D7100E271EA00DAA4

Uniqueness

Uniqueness Score: -1.00%

Function 0259F703 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 02598F2A: RtlAllocateHeap.NTDLL(00000008,?,?,025998F4,00000100,?,02596534), ref: 02598F38

ObtainUserAgentString.URLMON(00000000,00000000,00000100,000000AF,?,0259F7AA,02595C7F,?,0259602C), ref: 0259F734

Part of subcall function 02598F40: RtlFreeHeap.NTDLL(00000000,00000000), ref: 02598F86

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: Heap$AgentAllocateFreeObtainStringUser
String ID:
API String ID: 471734292-0
Opcode ID: 3f985b0d44a9e9fc2d01b231aa03b1a53af99126f3dea0fc86e08fc573134660
Instruction ID: 707ba6956a2ae88a13daa9e8b672ab12c087aa119d7eeb6991ab6d5203f1728b
Opcode Fuzzy Hash: 3f985b0d44a9e9fc2d01b231aa03b1a53af99126f3dea0fc86e08fc573134660
Instruction Fuzzy Hash: 6DF0F671A45201EFEF04EFB4E806B9977E6FB84324F200258E411D76D0EFB19A00DA2C

Uniqueness

Uniqueness Score: -1.00%

Function 0259CBD5 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe208a774f47a0a740f9852163301c743deef8476c369dfbe50bd60b7ba44edd
Instruction ID: 12c9bc00ec076619af9e7ab03d5d91f64ae3d5d25d55b7454f3a48883db48157
Opcode Fuzzy Hash: fe208a774f47a0a740f9852163301c743deef8476c369dfbe50bd60b7ba44edd
Instruction Fuzzy Hash: F2F03A31A50115EBCF20EFA5D906A9D7BF8FB08396F600495E512E7260D731DA00EB98

Uniqueness

Uniqueness Score: -1.00%

Function 02598F40 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000), ref: 02598F86

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 6752ce39c914a50bae3dda5220d07aad140a2d9b12e3306c386cf79a731e10c7
Instruction ID: af7bc8c6aa76e272c12a955a70bcb44ba28f2474fb02c5fd70f4cfc980ecd97c
Opcode Fuzzy Hash: 6752ce39c914a50bae3dda5220d07aad140a2d9b12e3306c386cf79a731e10c7
Instruction Fuzzy Hash: 40F0E531A01524AFDF112A24DC49FAE3B6ABF42B30F180300F915AB1D0D735984086EC

Uniqueness

Uniqueness Score: -1.00%

Function 0259B611 Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000001,00000080,00000000,00000000,00000000,00000000,025998A9), ref: 0259B62C

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 66ea6d32ed952860350264ba0cc04153b902772272f4ec114d4b712c82ceb1ee
Instruction ID: 23cd738702cdb524f75cbfaea609f8f586d1027ed9929339236987db5510dc3e
Opcode Fuzzy Hash: 66ea6d32ed952860350264ba0cc04153b902772272f4ec114d4b712c82ceb1ee
Instruction Fuzzy Hash: 94E09AB27001147EFA206A79ACC8FAB269CE7856B9F210630F625D3180C622AC548278

Uniqueness

Uniqueness Score: -1.00%

Function 0259C4BB Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,?,00000001,025942E9), ref: 0259C4EE

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 534b5cbad46656ef58f9b178f027c20e645e45482605adcac4108b363643d70f
Instruction ID: 55ff4c2f52ad8e6ab4ef0044693f12c762ad64073112e211632350eaacd27d16
Opcode Fuzzy Hash: 534b5cbad46656ef58f9b178f027c20e645e45482605adcac4108b363643d70f
Instruction Fuzzy Hash: C8E048327015215BD2204B79AC4DFB77EA8FB8A972B250169F509D7140CB11C456D7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0259A45F Relevance: 1.5, APIs: 1, Instructions: 23synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE(00000000,00000000,00000000,00000001,02595C92,?,0259602C), ref: 0259A46A

Part of subcall function 02598F2A: RtlAllocateHeap.NTDLL(00000008,?,?,025998F4,00000100,?,02596534), ref: 02598F38

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateCreateHeapMutex
String ID:
API String ID: 3814785936-0
Opcode ID: 30508eb608497434b204d358927bd847d48120509403c2c0252e34162dff0b89
Instruction ID: 9a627355b5429695b41a6983f53a98fecb380ca0899499ca88c21ac067d39758
Opcode Fuzzy Hash: 30508eb608497434b204d358927bd847d48120509403c2c0252e34162dff0b89
Instruction Fuzzy Hash: 0CE08C319466226EEB619FB9B809BD33E94FF427B07100925F418D5580EB21C061CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0259306F Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 0259C3EA: GetFileAttributesW.KERNELBASE(00000000,02595424,00000000,00000000), ref: 0259C3F0

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,02593292,00000000), ref: 0259307D

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: d1a876f83b1a0b0a95c9b9f5cae6b2e42d89fa731a9087d729c48bc229760bc4
Instruction ID: 9d73d07858c6a7093b15e9152926edb0cd86769a5641d58723865037c2c0ef30
Opcode Fuzzy Hash: d1a876f83b1a0b0a95c9b9f5cae6b2e42d89fa731a9087d729c48bc229760bc4
Instruction Fuzzy Hash: C2D05E32A28231B6AE2071383C246BF098979A61743100B96F826D20C0FB08C901058D

Uniqueness

Uniqueness Score: -1.00%

Function 0259B655 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,0259B73D,00000000,00000400,00000000,00000000,?,025A0DF3,00000000,00000000), ref: 0259B669

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: cd2e6907ac880ac076c9b998bbe0b381492ff43c4cf5f653fcbb5c8a82e57382
Instruction ID: e2b831963368733623a6a4b4400e2339db037c161d1657b92ec86ea28d7981dc
Opcode Fuzzy Hash: cd2e6907ac880ac076c9b998bbe0b381492ff43c4cf5f653fcbb5c8a82e57382
Instruction Fuzzy Hash: D3D012B13A0101BEFB2C8E34CC5BFB2339CD700701F21065C7A12EA0E0CA6AE9588724

Uniqueness

Uniqueness Score: -1.00%

Function 02598F2A Relevance: 1.5, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,025998F4,00000100,?,02596534), ref: 02598F38

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 33036971904588e743aa252ca311033ef4949057f6009c530d2c600a9e0285a9
Instruction ID: 3980de036bd12a194caf6900fe83bf27f296a304bcda35684aac0ec880a22051
Opcode Fuzzy Hash: 33036971904588e743aa252ca311033ef4949057f6009c530d2c600a9e0285a9
Instruction Fuzzy Hash: F0B092314C020CBBCB411E91EC07A943F29F704791F004410F60C144608A636438AB88

Uniqueness

Uniqueness Score: -1.00%

Function 0259C3EA Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,02595424,00000000,00000000), ref: 0259C3F0

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a456db1d937fe59b92dd541320934e84f419cd9113c0217e2e038128c491139e
Instruction ID: 7359d6ca7dd501d4d53d6d3de8d73ccb9097284dba0f1862037f3cc68cfac8a7
Opcode Fuzzy Hash: a456db1d937fe59b92dd541320934e84f419cd9113c0217e2e038128c491139e
Instruction Fuzzy Hash: C6B012B63204024FC71C4B389889BDD32D0AF08231B350BBCB133D64D0DB32C8A4AB00

Uniqueness

Uniqueness Score: -1.00%

Function 0259505F Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(025955F6), ref: 0259506A

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 4c9d75a85d9f165824d9dadb6a61b0e27917786f900b81e2d8acd382c8008071
Instruction ID: 176efe20ebd6bb0d0dca5ac2e1c2e86273fa621982f93e68c4cd739ec4ea89a4
Opcode Fuzzy Hash: 4c9d75a85d9f165824d9dadb6a61b0e27917786f900b81e2d8acd382c8008071
Instruction Fuzzy Hash: 05C09275AF2202AFDB008F75E80786037E0F7203233202AA0F201C3870DB278868BB08

Uniqueness

Uniqueness Score: -1.00%

Function 02598F15 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00096000,00000000,0259652F), ref: 02598F1E

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 58f3ce9659eed1c9189d08e826883f0532e890a07623a29be6e283c191c907dc
Instruction ID: 9161a1e345f6c5f1fd8ea8950e047346385d0e18f341d5c330cc135b19cf6c3a
Opcode Fuzzy Hash: 58f3ce9659eed1c9189d08e826883f0532e890a07623a29be6e283c191c907dc
Instruction Fuzzy Hash: 9BB01270BC13006AD6500F105C47B4139107380B42F100400B605AC1C0D7A11028F50C

Uniqueness

Uniqueness Score: -1.00%

Function 0259CED3 Relevance: 1.4, APIs: 1, Instructions: 149memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 025990C4: memset.MSVCRT ref: 025990D6

LocalAlloc.KERNEL32(00000040,00000014), ref: 0259CFC8

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AllocLocalmemset
String ID:
API String ID: 1202173703-0
Opcode ID: 636d3bb36a9e561d2a4ce10f58a0304112b97efa50a01fd5d6b05f25f5fca811
Instruction ID: e405090a993e66b4108f465175912a8c7b3b46e2376657fb04b04ac759346a52
Opcode Fuzzy Hash: 636d3bb36a9e561d2a4ce10f58a0304112b97efa50a01fd5d6b05f25f5fca811
Instruction Fuzzy Hash: 37512871E01209EFDF10DF99D989AADBBF8FF08355F24406AE504E7250D3719A06DB58

Uniqueness

Uniqueness Score: -1.00%

Function 025A0D61 Relevance: 1.4, APIs: 1, Instructions: 114sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 02598F2A: RtlAllocateHeap.NTDLL(00000008,?,?,025998F4,00000100,?,02596534), ref: 02598F38

Sleep.KERNELBASE(00000001,?,00000000,00000000,?,?,?,?,025A0C8F,?,?,?,025A1051,00000000), ref: 025A0E89

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateHeapSleep
String ID:
API String ID: 4201116106-0
Opcode ID: 86e100b00608aef969d392a222f8ee972f03c40e87680eb10b33c2c6c69c4864
Instruction ID: adaa67fee4c23e361106df70fe7fe00a07e3a74a51523e8308e009d8299ff695
Opcode Fuzzy Hash: 86e100b00608aef969d392a222f8ee972f03c40e87680eb10b33c2c6c69c4864
Instruction Fuzzy Hash: 2631D171E10106ABDF04EBA4DC9AFAEB7BEFB44304F244569E615E7280D736E9048B5C

Uniqueness

Uniqueness Score: -1.00%

Function 025992E4 Relevance: 1.4, APIs: 1, Instructions: 107stringCOMMON

Download Yara Rule

APIs

Part of subcall function 02598F2A: RtlAllocateHeap.NTDLL(00000008,?,?,025998F4,00000100,?,02596534), ref: 02598F38

lstrcpynW.KERNEL32(00000000,00000000,00000200,00000000,00000000,00000000,0259B31C,00000000), ref: 0259932E

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateHeaplstrcpyn
String ID:
API String ID: 680773602-0
Opcode ID: 68a7225a47271e154e88a32e4b28d042e76b2ee866831d118f53147ed1ed26cc
Instruction ID: 99a028b7d191af1ca471b75a1a5063f4642f7d81c0d0d097c8ad24b379a1279a
Opcode Fuzzy Hash: 68a7225a47271e154e88a32e4b28d042e76b2ee866831d118f53147ed1ed26cc
Instruction Fuzzy Hash: F531A172A14306AFEF209F65D845B9E7BAAFF80320F20145EE605D72C0DB31A500CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0259B37C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000000,00000000,?,0259529C), ref: 0259B3B1

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: b23f85f93b208de5b61bf3a9fe01bbbc5ef5e1c24f0810ed4a75f3a9b92eb6d2
Instruction ID: 890ea9a4a88ff5171d085dece431f3e67abc740aad4ca6dc2a099998325c84e1
Opcode Fuzzy Hash: b23f85f93b208de5b61bf3a9fe01bbbc5ef5e1c24f0810ed4a75f3a9b92eb6d2
Instruction Fuzzy Hash: 11017878310102ABAF14EF59D58082EB7AAFFC43997208269D8068B210DB31EC51CBE8

Uniqueness

Uniqueness Score: -1.00%

Function 0259626A Relevance: 1.3, APIs: 1, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c39342506359b418bad0d7e0d34145d9649b8c2b9d19f396890ba1d928b0fb0
Instruction ID: 0d91d4a46133062ebc0de7b6aa8abe7eaf3f09bf1f383373c19879361365251a
Opcode Fuzzy Hash: 8c39342506359b418bad0d7e0d34145d9649b8c2b9d19f396890ba1d928b0fb0
Instruction Fuzzy Hash: 50E092B17812035ADF00AF39E816B2237DEBB85316F984820E485D6084FF20C018E518

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0259E6BA Relevance: 7.6, APIs: 5, Instructions: 87commemoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000,00000000,00000000,00000000,00000000,?,0259E9EB,00000EE4,00000000,00000000,00000005), ref: 0259E6CD
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,0259E9EB,00000EE4,00000000,00000000,00000005), ref: 0259E6DE
CoCreateInstance.OLE32(025AC868,00000000,00000001,025AC878,00000000,?,0259E9EB,00000EE4,00000000,00000000,00000005), ref: 0259E6F5
SysAllocString.OLEAUT32(00000000), ref: 0259E700
CoSetProxyBlanket.OLE32(00000005,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,0259E9EB,00000EE4,00000000,00000000,00000005), ref: 0259E72B

Part of subcall function 02598F2A: RtlAllocateHeap.NTDLL(00000008,?,?,025998F4,00000100,?,02596534), ref: 02598F38

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: Initialize$AllocAllocateBlanketCreateHeapInstanceProxySecurityString
String ID:
API String ID: 1610782348-0
Opcode ID: 96b8dd7686737294df95c58adfd7ce3785636ba3f66babbbbd850ad6f351ae69
Instruction ID: 26426489a6c8a20068689771f77c427fdca11a8273790a103a08f981d847759f
Opcode Fuzzy Hash: 96b8dd7686737294df95c58adfd7ce3785636ba3f66babbbbd850ad6f351ae69
Instruction Fuzzy Hash: F9213D34700285BBEB248B66CD4EE6BBFBDFFC2F15F00019DB601AA290D6719A00D635

Uniqueness

Uniqueness Score: -1.00%

Function 0259C053 Relevance: 3.1, APIs: 2, Instructions: 105fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,00000000,00000000), ref: 0259C084
FindNextFileW.KERNEL32(00000000,?), ref: 0259C167

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: a747fc2589569398125551d999a20d75710a40305506dfdddb5d513c54bdc095
Instruction ID: d300fa5bc94595987b3df30da555753065f23b25884641b7cd0d5931fa17bc96
Opcode Fuzzy Hash: a747fc2589569398125551d999a20d75710a40305506dfdddb5d513c54bdc095
Instruction Fuzzy Hash: F231C771A402156FEF209A64DC8AFAE37A9BB44751F100056F505A61C0E771A9448B9C

Uniqueness

Uniqueness Score: -1.00%

Function 0259A3BC Relevance: 1.5, APIs: 1, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,025952A3), ref: 0259A3C9

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: adb6c21d5f1aa78ed4fba24c552833ad57a0b16c571121f99cb0df5ed2fc310b
Instruction ID: cca1a2022480e36a21808ce16ae9b3dccba352ec7525bc2e1477ba22e7c6739f
Opcode Fuzzy Hash: adb6c21d5f1aa78ed4fba24c552833ad57a0b16c571121f99cb0df5ed2fc310b
Instruction Fuzzy Hash: A5E04FB6D013187FDB10AE68DD06EAEBBBDFBC0B14F114954AC45B7344E670EA488694

Uniqueness

Uniqueness Score: -1.00%

Function 0259ED04 Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 388memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0259E6BA: CoInitializeEx.OLE32(00000000,00000000,00000000,00000000,00000000,00000000,?,0259E9EB,00000EE4,00000000,00000000,00000005), ref: 0259E6CD
Part of subcall function 0259E6BA: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,0259E9EB,00000EE4,00000000,00000000,00000005), ref: 0259E6DE
Part of subcall function 0259E6BA: CoCreateInstance.OLE32(025AC868,00000000,00000001,025AC878,00000000,?,0259E9EB,00000EE4,00000000,00000000,00000005), ref: 0259E6F5
Part of subcall function 0259E6BA: SysAllocString.OLEAUT32(00000000), ref: 0259E700
Part of subcall function 0259E6BA: CoSetProxyBlanket.OLE32(00000005,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,0259E9EB,00000EE4,00000000,00000000,00000005), ref: 0259E72B

Part of subcall function 02598F2A: RtlAllocateHeap.NTDLL(00000008,?,?,025998F4,00000100,?,02596534), ref: 02598F38

SysAllocString.OLEAUT32(00000000), ref: 0259EDAD
SysAllocString.OLEAUT32(00000000), ref: 0259EDC1
SysFreeString.OLEAUT32(?), ref: 0259F14A
SysFreeString.OLEAUT32(?), ref: 0259F153

Part of subcall function 02598F40: RtlFreeHeap.NTDLL(00000000,00000000), ref: 02598F86

Strings

FALSE, xrefs: 0259EF76
TRUE, xrefs: 0259EF6F

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: String$AllocFree$HeapInitialize$AllocateBlanketCreateInstanceProxySecurity
String ID: FALSE$TRUE
API String ID: 1290676130-1412513891
Opcode ID: 78af608550656a4da96d215a087efb6fb238ffde213675a746ac17736d195ca7
Instruction ID: 5bd91f6541f643c4916a6f25e09fb71406d3ec9c398509ab8f1fa0a56ca05401
Opcode Fuzzy Hash: 78af608550656a4da96d215a087efb6fb238ffde213675a746ac17736d195ca7
Instruction Fuzzy Hash: 60E15D75D0021AAFDF14DFA4C899AAEBBBAFF49300F10455AE505E7280DB31A945CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0259E1F7 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 02598F2A: RtlAllocateHeap.NTDLL(00000008,?,?,025998F4,00000100,?,02596534), ref: 02598F38

GetCurrentProcessId.KERNEL32 ref: 0259E21E
GetLastError.KERNEL32 ref: 0259E318
GetVersionExA.KERNEL32(00000000), ref: 0259E3DD
GetWindowsDirectoryW.KERNEL32(00001020,00000104), ref: 0259E408

Strings

TEMP, xrefs: 0259E4A9, 0259E4B4, 0259E4C5
%s\%s, xrefs: 0259E47A
SystemDrive, xrefs: 0259E4D4, 0259E4DF, 0259E4F4
USERPROFILE, xrefs: 0259E465, 0259E493
TEMP, xrefs: 0259E474

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AllocateCurrentDirectoryErrorHeapLastProcessVersionWindows
String ID: %s\%s$SystemDrive$TEMP$TEMP$USERPROFILE
API String ID: 3743117707-2706916422
Opcode ID: ce6385d0bbb059b7ec1ebd2a3c8c1a55058c8e6934c49363fe5604656cd17483
Instruction ID: e1c4cc20b41ebdadaa2f46c1d226daee5a7cb2b2cc853b82e8377ac3eba9bac2
Opcode Fuzzy Hash: ce6385d0bbb059b7ec1ebd2a3c8c1a55058c8e6934c49363fe5604656cd17483
Instruction Fuzzy Hash: 9F91A471B00606AFDB04EF74C84AFEAB7E9FF48310F10456AE519D7240DB70A9558F98

Uniqueness

Uniqueness Score: -1.00%

Function 0259D701 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 223registrystringCOMMON

Download Yara Rule

APIs

RegisterClassExA.USER32(?), ref: 0259D7C7
CreateWindowExA.USER32 ref: 0259D7F2
DestroyWindow.USER32(00000000), ref: 0259D7FD
UnregisterClassA.USER32 ref: 0259D808

Part of subcall function 02598F40: RtlFreeHeap.NTDLL(00000000,00000000), ref: 02598F86

lstrlenW.KERNEL32(?,?,?,?,?,?,00000000,025961E8), ref: 0259D932

Strings

Jjischug, xrefs: 0259D905
18293, xrefs: 0259D77E
aeroflot, xrefs: 0259D789
0, xrefs: 0259D7B9

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: ClassWindow$CreateDestroyFreeHeapRegisterUnregisterlstrlen
String ID: 0$18293$Jjischug$aeroflot
API String ID: 1751977465-3772587274
Opcode ID: 39786be1b7b50535189cd8cc33034239242a813d1a70b03063598c6971167e4c
Instruction ID: bb6f51426e48eef65f16af4d9282aa7d34402dd91bb0703c8dc946de85593c30
Opcode Fuzzy Hash: 39786be1b7b50535189cd8cc33034239242a813d1a70b03063598c6971167e4c
Instruction Fuzzy Hash: EB8137B1E41219AFDB00EFA4D885EEEBBF8FB08354F14446AE605E7240D771A904DF68

Uniqueness

Uniqueness Score: -1.00%

Function 025A2B28 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 66libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(advapi32.dll,00000000,00000000,00000000,02597B7E), ref: 025A2B3A
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 025A2B52
GetProcAddress.KERNEL32(00000000,CryptGenRandom), ref: 025A2B60
GetProcAddress.KERNEL32(00000000,CryptReleaseContext), ref: 025A2B6F

Strings

CryptReleaseContext, xrefs: 025A2B69
CryptGenRandom, xrefs: 025A2B5A
CryptAcquireContextA, xrefs: 025A2B4C
advapi32.dll, xrefs: 025A2B35

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CryptAcquireContextA$CryptGenRandom$CryptReleaseContext$advapi32.dll
API String ID: 667068680-129414566
Opcode ID: b0e178c8d25b158ebf9660f6dab0f0d46c0990a7cfe5a1a90d1a8372d2cd00fe
Instruction ID: 7b06b95e05a0a4f7ae5dd3ddd73737654c20d40ed2b350c9ee0717900bd73a14
Opcode Fuzzy Hash: b0e178c8d25b158ebf9660f6dab0f0d46c0990a7cfe5a1a90d1a8372d2cd00fe
Instruction Fuzzy Hash: 9C118232A41319B7EB21AAB48C53F9EBBA9BF84755F1144A0EE01F6140DBB0DA01869C

Uniqueness

Uniqueness Score: -1.00%

Function 0259F9E0 Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 267COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0259FA11
memset.MSVCRT ref: 0259FA22

Part of subcall function 025990C4: memset.MSVCRT ref: 025990D6

GetLastError.KERNEL32(?,?,?,?,?,?,00000000,000007D0,00000000), ref: 0259FAF7

Strings

POST, xrefs: 0259FB70

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: memset$ErrorLast
String ID: POST
API String ID: 2570506013-1814004025
Opcode ID: c3278dcf4f1dbf5c63ef9fb25107274e451fd2ab659088be03ad71a518c4c662
Instruction ID: 5a67c2474d1c2889464c5441ae3f7d720365b634d967836b1b4b0c4613f7e6f2
Opcode Fuzzy Hash: c3278dcf4f1dbf5c63ef9fb25107274e451fd2ab659088be03ad71a518c4c662
Instruction Fuzzy Hash: B4A15F7190021AAFDF10DFA4D889AEEBBB9FF48314F104469E909E7250DB749E44DF68

Uniqueness

Uniqueness Score: -1.00%

Function 025A169C Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 445COMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 025A171C
qsort.MSVCRT ref: 025A199A

Strings

true, xrefs: 025A16F3
%I64d, xrefs: 025A170E
false, xrefs: 025A16FF
null, xrefs: 025A16E1

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: _snprintfqsort
String ID: %I64d$false$null$true
API String ID: 756996078-4285102228
Opcode ID: d609915cbee8f23833f85930a8ff24af6f4b7c46a0b22bd1688710a64fcd91e7
Instruction ID: 8c9494f6c823c600a6eb9409d128c708c5e92b17879777f3b81c0a92b2cf8763
Opcode Fuzzy Hash: d609915cbee8f23833f85930a8ff24af6f4b7c46a0b22bd1688710a64fcd91e7
Instruction Fuzzy Hash: 9CE15D71A0060ABBEF119E64CCA7FAF7B6AFF44794F00C415FD1996140EB31D9618BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0259E0E0 Relevance: 9.1, APIs: 6, Instructions: 98stringCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32 ref: 0259E0F5
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 0259E100
lstrlenW.KERNEL32 ref: 0259E142
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 0259E19B
lstrcpynW.KERNEL32(?,00000000,00000104), ref: 0259E1C0
lstrcpynW.KERNEL32(?,?,00000104), ref: 0259E1DE

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: CommandLinelstrcpyn$ArgvCurrentDirectorylstrlen
String ID:
API String ID: 1259063344-0
Opcode ID: ffb0f023783d362bf615a6f826f24475637dead011fc20690f8d1ad1b5ec0577
Instruction ID: 1961941eb8b117ddc135c21ccaa5d22656ff3c13752d9ea1164ac5960a598618
Opcode Fuzzy Hash: ffb0f023783d362bf615a6f826f24475637dead011fc20690f8d1ad1b5ec0577
Instruction Fuzzy Hash: EA31F571D00215EBDF28DB68D88AABE7BB8FB41714F10449BE405E2150E7309A84EF59

Uniqueness

Uniqueness Score: -1.00%

Function 0259E910 Relevance: 9.1, APIs: 6, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 0259E924
SysAllocString.OLEAUT32(?), ref: 0259E92C
SysAllocString.OLEAUT32(00000000), ref: 0259E940
SysFreeString.OLEAUT32(?), ref: 0259E9BB
SysFreeString.OLEAUT32(?), ref: 0259E9BE
SysFreeString.OLEAUT32(?), ref: 0259E9C3

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: da5e9326811e64d9b84d18a03706a563fbf670f4aca1dc7966b7094ef70624da
Instruction ID: aefafad6790921e17880617fec49bdc1dc566f9852f5c6e498f3f1ec1d34b14f
Opcode Fuzzy Hash: da5e9326811e64d9b84d18a03706a563fbf670f4aca1dc7966b7094ef70624da
Instruction Fuzzy Hash: D421F975D00219AFDF00DFA5CC89DAEBBBDFF88254B10449AE505A7250DB70AE05DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 025A3F9E Relevance: 7.8, APIs: 5, Instructions: 322libraryloaderstringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 025A4105
LoadLibraryA.KERNEL32(00000000), ref: 025A411E
GetProcAddress.KERNEL32(00000000,?), ref: 025A417A
GetProcAddress.KERNEL32(00000000,?), ref: 025A4199
lstrcmpA.KERNEL32(?,00000000), ref: 025A428A

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleLibraryLoadModulelstrcmp
String ID:
API String ID: 1872726118-0
Opcode ID: 5c9540fa491f25faa9f2988b1ad7cfdd05b303d1fe42baafbaab6ed29cb181dc
Instruction ID: d0dad9a00a486e3f12ebff59715633520c4324f4967791262a5c829f70de14ac
Opcode Fuzzy Hash: 5c9540fa491f25faa9f2988b1ad7cfdd05b303d1fe42baafbaab6ed29cb181dc
Instruction Fuzzy Hash: B8E1AF74A10209DFCB14CFA8D892AADBBF1FF48318F14856AE815EB351D774A981CF58

Uniqueness

Uniqueness Score: -1.00%

Function 025A1BE1 Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

@, xrefs: 025A1C4F
\u%04X\u%04X, xrefs: 025A1D3A
\u%04X, xrefs: 025A1CFB

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID:
String ID: @$\u%04X$\u%04X\u%04X
API String ID: 0-2132903582
Opcode ID: 6671a36fa6f6a2e4643b7d1adee574c024992ca79ed45c1e0da77a3628cb488f
Instruction ID: 1819daf053de74ec58ea68ec20e239c7f420eae0d37b79485f8295eed35df46f
Opcode Fuzzy Hash: 6671a36fa6f6a2e4643b7d1adee574c024992ca79ed45c1e0da77a3628cb488f
Instruction Fuzzy Hash: 55410471600B16ABDF388A6C8DBBAFE3E65FF40614F148516F91BDA240E361C990D29D

Uniqueness

Uniqueness Score: -1.00%

Function 025A35B1 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 85stringCOMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 025A35D5
strchr.MSVCRT ref: 025A35F5
strchr.MSVCRT ref: 025A3604
strchr.MSVCRT ref: 025A3629

Strings

%.*g, xrefs: 025A35CC

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: strchr$_snprintf
String ID: %.*g
API String ID: 3619936089-952554281
Opcode ID: 4d25429a9c1c0eb204fd680ca3775c65fe3cd11e145989917c311e7eca9a8c8d
Instruction ID: 1c7a25c39cb1d83e74724a98c993f69ef6608ca7194a9c0914f0c8b2647e5370
Opcode Fuzzy Hash: 4d25429a9c1c0eb204fd680ca3775c65fe3cd11e145989917c311e7eca9a8c8d
Instruction Fuzzy Hash: 0521577260061636EB255A2CDCA3FAE7B89FF44B6CF1441E9FA0087380E7A09A00439C

Uniqueness

Uniqueness Score: -1.00%

Function 025A4340 Relevance: 6.6, APIs: 5, Instructions: 341COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 025A444D
memcpy.MSVCRT ref: 025A44C4
memcpy.MSVCRT ref: 025A44F3
memcpy.MSVCRT ref: 025A451F
memcpy.MSVCRT ref: 025A45D4

Part of subcall function 025A7360: memcpy.MSVCRT ref: 025A743E

Part of subcall function 025A60C0: memcpy.MSVCRT ref: 025A60EA

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 3f684307e6c6a0f3c325066ecf6ea0e975fc2bf816bbe69e55cecdb5dd27a073
Instruction ID: 93410fa86506811842a70fb97eddc2f0d399cc19d4adf3f3e40db5acc78b1434
Opcode Fuzzy Hash: 3f684307e6c6a0f3c325066ecf6ea0e975fc2bf816bbe69e55cecdb5dd27a073
Instruction Fuzzy Hash: 67D10575600A049FCB24CFADD8E1A6EBBE5FF88304B24892DE48AC7751D771E944CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0259D4D7 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 0259D5CC

Strings

dll, xrefs: 0259D58E
%08x, xrefs: 0259D538

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: %08x$dll
API String ID: 1029625771-2963171978
Opcode ID: 087e776339d00190b0184cbe9cdf9563d9e2817863ceb0cbae3139887d1a152b
Instruction ID: 90fa5c728ea07161be794ab1214b0529fe93dd0f26dfafae2d2038f27caff1bb
Opcode Fuzzy Hash: 087e776339d00190b0184cbe9cdf9563d9e2817863ceb0cbae3139887d1a152b
Instruction Fuzzy Hash: 7C31B572A41209BEEB10AF78DC46FAA37EDF789314F204426F145E3180DA35D8488B6C

Uniqueness

Uniqueness Score: -1.00%

Function 025A38AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,000000B0,000000B0,?,00000000,000000B0,00000228), ref: 025A38F3
_ftol2_sse.MSVCRT ref: 025A3936

Strings

msxml32.dll, xrefs: 025A38BE

Memory Dump Source

Source File: 00000025.00000002.667755743.0000000002590000.00000040.80000000.00040000.00000000.sdmp, Offset: 02590000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_2590000_explorer.jbxd

Yara matches

Similarity

API ID: _ftol2_sselstrlen
String ID: msxml32.dll
API String ID: 1292649733-2051705522
Opcode ID: 2c6f60b86bc729140f79f42791da86d81ebe914755e8657413614847ce737fc1
Instruction ID: 2cc1cc73313623a74ea9d314a7e9a94564bae57b9f2c670027e0b49582ff6739
Opcode Fuzzy Hash: 2c6f60b86bc729140f79f42791da86d81ebe914755e8657413614847ce737fc1
Instruction Fuzzy Hash: E611E932E0065AABCF009F69E8165DD7FB5FF80324F264999D85092141EB31C564D749

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication. The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.
Tactics:	Persistence, Privilege Escalation
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report X18flXFlh9.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Qbot

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Google\Chrome\User Data\0514ad7a-febe-4a4b-b0bb-7aabb793a604.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\06f48d95-77d6-44e6-9651-d0991f4cb8bc.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1b38f540-a382-4ebd-9cdb-8673ce1d99e4.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\1f73dca9-0a69-4e98-aad9-0779d4b907c6.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5d5b031e-6121-437f-bdd4-62211fb6c455.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\5f69ba03-1712-46c4-ae4e-d8c7366a0881.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\61a66f66-d618-4260-b9d5-91e00506acc3.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\7b5010af-e4ad-406f-bb1e-ae58a8383a4d.tmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000001.dbtmp

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\000002.dbtmp

Windows Analysis Report
X18flXFlh9.html

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre