24:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/2vw2j18d9u3gs.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 42:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T548,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Gen:Variant.Jacard — Falcon Sandbox Report — Score 100/100 — Sample f1d0df0e6b4e…","description":"Malicious verdict for sandbox report 5c5b30387ca3…. Malware family: Gen:Variant.Jacard. Threat score 100/100. 12 malicious and 23 suspicious behavioral indicators across 73 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/f1d0df0e6b4e050703056fa3cad9b690c45ee7d239d5a45faf3e0cdf6b0ebd20/5c5b30387ca3e1653d1b1d33","keywords":["Malicious","Gen:Variant.Jacard","sandbox report","malware analysis","MITRE ATT\u0026CK","f1d0df0e6b4e050703056fa3cad9b690c45ee7d239d5a45faf3e0cdf6b0ebd20"],"about":{"@type":"SoftwareApplication","name":"f1d0df0e6b4e050703056fa3cad9b690c45ee7d239d5a45faf3e0cdf6b0ebd20.bin","applicationCategory":"PE32 executable (GUI) Intel 80386, for MS Windows","identifier":"f1d0df0e6b4e050703056fa3cad9b690c45ee7d239d5a45faf3e0cdf6b0ebd20","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Gen:Variant.Jacard","sandboxEnvironment":"Windows 7 32 bit","behavioralIndicators":{"malicious":12,"suspicious":23,"totalSignatures":73},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAh3YAAAAAAAAAAAAAAAAAd4h2aAAAAAAAAAAAAAAAd4iIdmZwAAAAAAAAAAAHd4iIiHZ3ZwAAAAAAAAB3eIiIiHdmd3ZwAAAAAACHiIiId3d3dnd2ZoAAAAAAB4iIh3d3eId3d3dnAAAAAACIh3d3iIiHeHeIhnAAAAAAd3d3iIiIh3iHeId3AAAACIh3iIiIiHeIh3d3iHgAAAd4iIiIiHd3iIiHd4h3AAAHiIiIiHd3d3iIiHd4dwAACIiIh3d3eIc3eIiHd3cAAAiIh3d3eIiHM3d4iHd3AAAIh3d3eIiIhzuXd4iIdwAACHd3iIiIiHczMzd4iIdwAAd4iIiIh3czMzMzd4iHcAAHiIiIh3d3dzOTMzd3d3AAAIiIh3d3eIh3MzMzd3iAAACId3d3iIiHd3czMzd3gAAId3d3iIh3d4h3czczNwAAB3h4iIh3d4iIh3czMzNwAAB4h4h3d4iIiIh3czMzMAAAAIiHeIiIiIiIh3dzNzAAAAAAd3iIiIiIiIiHdzMwAAAAAAB3eIiIiIiIiHhzcAAAAAAACHeIiIiIiHd3eAAAAAAAAAAHd4iId3d3gAAAAAAAAAAAAHeIiHdwAAAAAAAAAAAAAAAIiIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////h////gH///gA///AAH/+AAA/+AAAD/wAAAf+AAAD/gAAAfwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAA8AAAAPAAAAD4AAAA+AAAAPAAAAHwAAAA+AAAAP4AAAD/gAAA/+AAAP/wAAH//AAP//4A////B///////w==26:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAh3YAAAAAAAAAAAAAAAAAd4h2aAAAAAAAAAAAAAAAd4iIdmZwAAAAAAAAAAAHd4iIiHZ3ZwAAAAAAAAB3eIiIiHdmd3ZwAAAAAACHiIiId3d3dnd2ZoAAAAAAB4iIh3d3eId3d3dnAAAAAACIh3d3iIiHeHeIhnAAAAAAd3d3iIiIh3iHeId3AAAACIh3iIiIiHeIh3d3iHgAAAd4iIiIiHd3iIiHd4h3AAAHiIiIiHd3d3iIiHd4dwAACIiIh3d3eIc3eIiHd3cAAAiIh3d3eIiHM3d4iHd3AAAIh3d3eIiIhzuXd4iIdwAACHd3iIiIiHczMzd4iIdwAAd4iIiIh3czMzMzd4iHcAAHiIiIh3d3dzOTMzd3d3AAAIiIh3d3eIh3MzMzd3iAAACId3d3iIiHd3czMzd3gAAId3d3iIh3d4h3czczNwAAB3h4iIh3d4iIh3czMzNwAAB4h4h3d4iIiIh3czMzMAAAAIiHeIiIiIiIh3dzNzAAAAAAd3iIiIiIiIiHdzMwAAAAAAB3eIiIiIiIiHhzcAAAAAAACHeIiIiIiHd3eAAAAAAAAAAHd4iId3d3gAAAAAAAAAAAAHeIiHdwAAAAAAAAAAAAAAAIiIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////h////gH///gA///AAH/+AAA/+AAAD/wAAAf+AAAD/gAAAfwAAAB8AAAAfAAAAHwAAAB8AAAAfAAAAHwAAAA8AAAAPAAAAD4AAAA+AAAAPAAAAHwAAAA+AAAAP4AAAD/gAAA/+AAAP/wAAH//AAP//4A////B///////w==27:T446,Antivirus vendors marked dropped file "CHCP.COM.5C5B4381.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B44D0.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B4588.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B463B.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B4692.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B46EF.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B4779.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B4799.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows")28:T446,Antivirus vendors marked dropped file "CHCP.COM.5C5B4381.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B44D0.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B4588.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B463B.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B4692.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B46EF.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B4779.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B4799.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows")29:T446,Antivirus vendors marked dropped file "CHCP.COM.5C5B4381.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B44D0.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B4588.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B463B.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B4692.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B46EF.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B4779.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "CHCP.COM.5C5B4799.bin" as clean (type is "PE32 executable (console) Intel 80386 for MS Windows")2a:T43e,"wbadmin.exe" touched "BlbEngine Class" (Path: "HKCU\CLSID\{37734C4D-FFA8-4139-9AAC-60FBE55BF3DF}") "wbadmin.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{E3633C03-DF7A-41E0-B903-CC349A05E021}") "WMIC.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "WMIC.exe" touched "Free Threaded XML DOM Document" (Path: "HKCU\CLSID\{F6D90F12-9C73-11D3-B32E-00C04F990BB4}") "WMIC.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "WMIC.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "WMIC.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "vssadmin.exe" touched "VSSCoordinator Class" (Path: "HKCU\CLSID\{E579AB5F-1CC4-44B4-BED9-DE0991FF0623}")2b:T57f,"/C cscript //e:vbscript //nologo "%TEMP%\temp.txt"" on 2019-2-6.20:26:57.056 "/C chcp 1250 && net view" on 2019-2-6.20:28:49.520 "/C chcp 1250 && net view" on 2019-2-6.20:33:35.847 "/C chcp 1250 && net view" on 2019-2-6.20:34:24.199 "/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" on 2019-2-6.20:35:15.760 "/C chcp 1250 && net view" on 2019-2-6.20:35:16.840 "/C bcdedit /set {default} recoveryenabled no" on 2019-2-6.20:35:18.085 "/C wbadmin delete catalog -quiet" on 2019-2-6.20:35:19.995 "/C chcp 1250 && net view" on 2019-2-6.20:37:27.866 "/C wbadmin delete systemstatebackup" on 2019-2-6.20:37:30.417 "/C wbadmin delete backup" on 2019-2-6.20:37:33.937 "/C wmic shadowcopy delete" on 2019-2-6.20:37:36.043 "/C chcp 1250 && net view" on 2019-2-6.20:38:18.223 "/C vssadmin delete shadows /all /quiet" on 2019-2-6.20:39:45.710 "/C chcp 1250 && net view" on 2019-2-6.20:40:26.872 "/C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f" on 2019-2-6.20:40:27.780 "/C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f" on 2019-2-6.20:40:29.218 "/C reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"" on 2019-2-6.20:41:10.681 "/C attrib "%userprofile%\documents\Default.rdp" -s -h" on 2019-2-6.20:41:52.274 "/C del "%userprofile%\documents\Default.rdp"" on 2019-2-6.20:41:53.5502c:T7ca,Spawned process "cmd.exe" with commandline "/C cscript //e:vbscript //nologo "%TEMP%\temp.txt"" (UID: 00041352-00003228) Spawned process "cscript.exe" with commandline "cscript //e:vbscript //nologo "%TEMP%\temp.txt"" (UID: 00041360-00004440) Spawned process "cmd.exe" with commandline "/C chcp 1250 && net view" (UID: 00042914-00002812) Spawned process "chcp.com" with commandline "chcp 1250" (UID: 00042921-00003924) Spawned process "net.exe" with commandline "net view" (UID: 00043252-00002572) Spawned process "cmd.exe" with commandline "/C chcp 1250 && net view" (UID: 00043278-00004716) Spawned process "chcp.com" with commandline "chcp 1250" (UID: 00043286-00002728) Spawned process "net.exe" with commandline "net view" (UID: 00043689-00004740) Spawned process "cmd.exe" with commandline "/C chcp 1250 && net view" (UID: 00043786-00004644) Spawned process "chcp.com" with commandline "chcp 1250" (UID: 00043806-00004788) Spawned process "net.exe" with commandline "net view" (UID: 00044519-00004892) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00044560-00004932) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00044609-00004808) Spawned process "cmd.exe" with commandline "/C chcp 1250 && net view" (UID: 00044643-00004728) Spawned process "chcp.com" with commandline "chcp 1250" (UID: 00044672-00005120) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} recoveryenabled no" (UID: 00044733-00002104) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled no" (UID: 00044795-00005028) Spawned process "cmd.exe" with commandline "/C wbadmin delete catalog -quiet" (UID: 00044872-00005232) Spawned process "wbadmin.exe" with commandline "wbadmin delete catalog -quiet" (UID: 00044920-00005368) Spawned process "net.exe" with commandline "net view" (UID: 00045360-00005000)2d:T7ca,Spawned process "cmd.exe" with commandline "/C cscript //e:vbscript //nologo "%TEMP%\temp.txt"" (UID: 00041352-00003228) Spawned process "cscript.exe" with commandline "cscript //e:vbscript //nologo "%TEMP%\temp.txt"" (UID: 00041360-00004440) Spawned process "cmd.exe" with commandline "/C chcp 1250 && net view" (UID: 00042914-00002812) Spawned process "chcp.com" with commandline "chcp 1250" (UID: 00042921-00003924) Spawned process "net.exe" with commandline "net view" (UID: 00043252-00002572) Spawned process "cmd.exe" with commandline "/C chcp 1250 && net view" (UID: 00043278-00004716) Spawned process "chcp.com" with commandline "chcp 1250" (UID: 00043286-00002728) Spawned process "net.exe" with commandline "net view" (UID: 00043689-00004740) Spawned process "cmd.exe" with commandline "/C chcp 1250 && net view" (UID: 00043786-00004644) Spawned process "chcp.com" with commandline "chcp 1250" (UID: 00043806-00004788) Spawned process "net.exe" with commandline "net view" (UID: 00044519-00004892) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00044560-00004932) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00044609-00004808) Spawned process "cmd.exe" with commandline "/C chcp 1250 && net view" (UID: 00044643-00004728) Spawned process "chcp.com" with commandline "chcp 1250" (UID: 00044672-00005120) Spawned process "cmd.exe" with commandline "/C bcdedit /set {default} recoveryenabled no" (UID: 00044733-00002104) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled no" (UID: 00044795-00005028) Spawned process "cmd.exe" with commandline "/C wbadmin delete catalog -quiet" (UID: 00044872-00005232) Spawned process "wbadmin.exe" with commandline "wbadmin delete catalog -quiet" (UID: 00044920-00005368) Spawned process "net.exe" with commandline "net view" (UID: 00045360-00005000)2e:T5a5,"CHCP.COM.5C5B4381.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CHCP.COM.5C5B44D0.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CHCP.COM.5C5B4588.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CHCP.COM.5C5B463B.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CHCP.COM.5C5B4692.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CHCP.COM.5C5B46EF.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CHCP.COM.5C5B4779.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CHCP.COM.5C5B4799.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "PlayStore_icon.svg" has type "data" "CCEnhancer-4.5.1.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "adoberfp.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "close.svg" has type "data" "ccme_ecc.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "AdobeXMP.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "logsession.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Acrofx32.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "notepad.vbs" has type "data" "de_get.svg" has type "data" "ccme_base_non_fips.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"2f:T46c," Microsoft" "CCEnhancer-4.5.1.exe" was detected as "Microsoft visual C# v7.0 / Basic .NET" "adoberfp.dll" was detected as "Borland Delphi 3.0 (???)" "ccme_ecc.dll" was detected as "Borland Delphi 3.0 (???)" "AdobeXMP.dll" was detected as "Borland Delphi 3.0 (???)" "logsession.dll" was detected as "Borland Delphi 3.0 (???)" "Acrofx32.dll" was detected as "Borland Delphi 3.0 (???)" "ccme_base_non_fips.dll" was detected as "Borland Delphi 3.0 (???)" "Eula.exe" was detected as "VC8 -> Microsoft Corporation" "arh.exe" was detected as "VC8 -> Microsoft Corporation" "ccme_asym.dll" was detected as "Borland Delphi 3.0 (???)" "Au3Check.exe" was detected as "VC8 -> Microsoft Corporation" "BIB.dll" was detected as "Borland Delphi 3.0 (???)" "AutoItX3.dll" was detected as "Borland Delphi 3.0 (???)" "nppdf32.dll" was detected as "Borland Delphi 3.0 (???)" "ccme_base.dll" was detected as "Borland Delphi 3.0 (???)"32:T48e,Process "net.exe" with commandline "net view" (UID: 00043252-00002572) Process "net.exe" with commandline "net view" (UID: 00043689-00004740) Process "net.exe" with commandline "net view" (UID: 00044519-00004892) Process "net.exe" with commandline "net view" (UID: 00045360-00005000) Process "net.exe" with commandline "net view" (UID: 00046299-00005392) Process "net.exe" with commandline "net view" (UID: 00047180-00005460) Process "net.exe" with commandline "net view" (UID: 00048156-00000956) Process "net.exe" with commandline "net view" (UID: 00048970-00005428) Process "net.exe" with commandline "net view" (UID: 00049744-00004092) Process "net.exe" with commandline "net view" (UID: 00050533-00002980) Process "net.exe" with commandline "net view" (UID: 00051307-00002256) Process "net.exe" with commandline "net view" (UID: 00052136-00004180) Process "net.exe" with commandline "net view" (UID: 00052950-00001736) Process "net.exe" with commandline "net view" (UID: 00053762-00003292) Process "net.exe" with commandline "net view" (UID: 00054549-00002804) Process "net.exe" with commandline "net view" (UID: 00055410-00003792)33:T6b7,"CHCP.COM.5C5B4381.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CHCP.COM.5C5B44D0.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CHCP.COM.5C5B4588.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CHCP.COM.5C5B463B.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CHCP.COM.5C5B4692.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CHCP.COM.5C5B46EF.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CHCP.COM.5C5B4779.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CHCP.COM.5C5B4799.bin" has type "PE32 executable (console) Intel 80386 for MS Windows" "CCEnhancer-4.5.1.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "adoberfp.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ccme_ecc.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "AdobeXMP.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "logsession.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Acrofx32.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "ccme_base_non_fips.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Eula.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "arh.exe" has type "PE32 executable (console) Intel 80386 for MS Windows" "ccme_asym.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "d3dcompiler_43.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "Au3Check.exe" has type "PE32 executable (console) Intel 80386 for MS Windows"34:T615,"cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\cscript.exe" (Handle: 80) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\cscript.exe" (Handle: 80) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\cscript.exe" (Handle: 80) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\chcp.com" (Handle: 80) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\chcp.com" (Handle: 80) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\chcp.com" (Handle: 80) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 76) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 76) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 76) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 80) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 80) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 80) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wbadmin.exe" (Handle: 80) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wbadmin.exe" (Handle: 80) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wbadmin.exe" (Handle: 80) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 80) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 80)35:T55f,RegOpenKeyExA RegCloseKey GetFileAttributesA GetDriveTypeA FindFirstFileW WriteFile GetModuleFileNameA LoadLibraryExA UnhandledExceptionFilter GetModuleHandleA CreateThread ExitThread TerminateProcess GetTickCount GetVersionExA LoadLibraryA GetStartupInfoA OpenProcess DeleteFileA ReadProcessMemory CreateDirectoryW DeleteFileW GetProcAddress FindNextFileW FindNextFileA CreateFileW CreateFileA CreateProcessW GetCommandLineA FindFirstFileA CreateProcessA Sleep VirtualAlloc RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegDeleteKeyW GetDriveTypeW FindResourceExW OutputDebugStringW CopyFileW GetModuleFileNameW IsDebuggerPresent LoadLibraryExW GetModuleHandleExW CreateToolhelp32Snapshot VirtualProtect GetFileSize GetStartupInfoW FindFirstFileExW FindResourceW Process32NextW LockResource Process32FirstW GetModuleHandleW GetFileAttributesExW GetTempPathW FindWindowW GetWindowThreadProcessId WriteProcessMemory GetTickCount64 LoadLibraryW OutputDebugStringA GetCommandLineW VirtualProtectEx CreateProcessWithLogonW SetSecurityDescriptorDacl OpenProcessToken CreateProcessAsUserW GetVersionExW VirtualAllocEx GetCursorPos SetKeyboardState GetFileAttributesW OpenFileMappingA GetTempPathA CopyFileA CreateDirectoryA GetTempFileNameA CreateFileMappingA MapViewOfFile FindWindowA36:T15cf,Spawned process " Microsoft","version_info":[{"id":"LegalCopyright","value":"Microsoft Corporation. All rights reserved."},{"id":"InternalName","value":"chcp"},{"id":"FileVersion","value":"6.1.7600.16385 (win7_rtm.090713-1255)"},{"id":"CompanyName","value":"Microsoft Corporation"},{"id":"ProductName","value":"Microsoft Windows Operating System"},{"id":"ProductVersion","value":"6.1.7600.16385"},{"id":"FileDescription","value":"Change CodePage Utility"},{"id":"OriginalFilename","value":"CHCP.COM"},{"id":"Translation","value":"0x0409 0x04b0"}],"file_sections":[{"name":".text","entropy":6.01408949954,"virtual_address":"0x1000","virtual_size":"0x1aae","raw_size":"0x1c00","md5":"4f0348f2f20b9b54473144e5f575a5d6"},{"name":".data","entropy":0.299050910335,"virtual_address":"0x3000","virtual_size":"0x380","raw_size":"0x200","md5":"a497d24ecb6e112af339fa7456a7af7f"},{"name":".rsrc","entropy":4.02042614905,"virtual_address":"0x4000","virtual_size":"0x6d0","raw_size":"0x800","md5":"494e42dd8ff8ed1a4b652feb8dd1da8b"},{"name":".reloc","entropy":3.49090417865,"virtual_address":"0x5000","virtual_size":"0x264","raw_size":"0x400","md5":"f4e0fab0a9adcd0718d6b19b95cf22eb"}],"file_imports":[{"module":"KERNEL32.dll","functions":["GetCurrentProcess","GetCurrentProcessId","GetCurrentThreadId","GetModuleHandleA","GetSystemDefaultLangID","GetSystemTimeAsFileTime","GetTickCount","InterlockedCompareExchange","InterlockedExchange","QueryPerformanceCounter","SetThreadUILanguage","SetUnhandledExceptionFilter","Sleep","TerminateProcess","UnhandledExceptionFilter"]},{"module":"msvcrt.dll","functions":["?terminate@@YAXXZ","__getmainargs","__p__commode","__p__fmode","__set_app_type","__setusermatherr","_amsg_exit","_cexit","_controlfp","_except_handler4_common","_exit","_initterm","_XcptFilter","exit"]},{"module":"ntdll.dll","functions":["RtlAllocateHeap","RtlFreeHeap"]},{"module":"ulib.dll","functions":["??0ARGUMENT_LEXEMIZER@@QAE@XZ","??0ARRAY@@QAE@XZ","??0CLASS_DESCRIPTOR@@QAE@XZ","??0DSTRING@@QAE@XZ","??0FLAG_ARGUMENT@@QAE@XZ","??0LONG_ARGUMENT@@QAE@XZ","??0PROGRAM@@IAE@XZ","??0SCREEN@@QAE@XZ","??0STRING_ARGUMENT@@QAE@XZ","??1ARGUMENT_LEXEMIZER@@UAE@XZ","??1ARRAY@@UAE@XZ","??1DSTRING@@UAE@XZ","??1OBJECT@@UAE@XZ","??1PROGRAM@@UAE@XZ","??1SCREEN@@UAE@XZ","??1STRING_ARGUMENT@@UAE@XZ","?Compare@OBJECT@@UBEJPBV1@@Z","?DisplayMessage@PROGRAM@@UBAEKW4MESSAGE_TYPE@@PADZZ","?DisplayMessage@PROGRAM@@UBEEKW4MESSAGE_TYPE@@@Z","?DoParsing@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z","?EraseScreenAndResetAttribute@SCREEN@@QAEEXZ","?ExitProgram@PROGRAM@@SGXK@Z","?Fatal@PROGRAM@@UBAXKKPADZZ","?Fatal@PROGRAM@@UBEXXZ","?GetStandardError@PROGRAM@@UAEPAVSTREAM@@XZ","?GetStandardInput@PROGRAM@@UAEPAVSTREAM@@XZ","?GetStandardOutput@PROGRAM@@UAEPAVSTREAM@@XZ","?Initialize@ARGUMENT_LEXEMIZER@@QAEEPAVARRAY@@@Z","?Initialize@ARRAY@@QAEEKK@Z","?Initialize@CLASS_DESCRIPTOR@@QAEEXZ","?Initialize@FLAG_ARGUMENT@@QAEEPAD@Z","?Initialize@LONG_ARGUMENT@@QAEEPAD@Z","?Initialize@PROGRAM@@QAEEKKK@Z","?Initialize@SCREEN@@QAEEXZ","?Initialize@STRING_ARGUMENT@@QAEEPAD@Z","?Initialize@WSTRING@@QAEEJ@Z","?IsValueSet@ARGUMENT@@QAEEXZ","?MoveCursorTo@SCREEN@@QAEEGG@Z","?PrepareToParse@ARGUMENT_LEXEMIZER@@QAEEPAVWSTRING@@@Z","?Put@ARRAY@@UAEEPAVOBJECT@@@Z","?PutSwitches@ARGUMENT_LEXEMIZER@@QAEXPBD@Z","?QueryCodePage@SCREEN@@QAEKXZ","?QueryInvalidArgument@ARGUMENT_LEXEMIZER@@QAEPAVWSTRING@@XZ","?SetCaseSensitive@ARGUMENT_LEXEMIZER@@QAEXE@Z","?SetCodePage@SCREEN@@QAEEK@Z","?SetOutputCodePage@SCREEN@@QAEEK@Z","?Usage@PROGRAM@@UBEXXZ","?ValidateVersion@PROGRAM@@UBEXKK@Z"]}],"file_exports":[]}},{"name":"CHCP.COM.5C5B44D0.bin","file_path":null,"file_size":11776,"md5":"4436b1a16bdc58d2b3a5263f042c09b3","sha1":"cf2e11809832fc7d3d7f3169418690b8ea4fb969","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","sha512":"c50ad6de05957574b4e8cf0f4ac221522db1ee2617ada4a4267ac4b829fcfdce09e038ae2db6240ce2786980eab3d32dc1a2e81ff58c1b09fac2685ac0656d25","type_tags":["peexe","executable"],"description":"PE32 executable (console) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"clean","av_label":null,"av_matched":0,"av_total":93,"file_available_to_download":true,"download_link":"/bff/report/5c5b30387ca3e1653d1b1d33/download/dropped-file?key=267a570bee8d59f5c9146e933c4b93483e215c8d2b08e9827ee93bf3ff1507750a72549a335141bd1314dc39e4b4b703a3c60967d7b64e2d92b4a206b41d9b874c4bb7cf98","submit_link":"/bff/report/5c5b30387ca3e1653d1b1d33/submit/dropped-file?key=267a570bee8d59f5c9146e933c4b93483e215c8d2b08e9827ee93bf3ff1507750a72549a335141bd1314dc39e4b4b703a3c60967d7b64e2d92b4a206b41d9b874c4bb7cf98","has_overview":true,"extended_details":null},{"name":"CHCP.COM.5C5B4588.bin","file_path":null,"file_size":11776,"md5":"4436b1a16bdc58d2b3a5263f042c09b3","sha1":"cf2e11809832fc7d3d7f3169418690b8ea4fb969","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","sha512":"c50ad6de05957574b4e8cf0f4ac221522db1ee2617ada4a4267ac4b829fcfdce09e038ae2db6240ce2786980eab3d32dc1a2e81ff58c1b09fac2685ac0656d25","type_tags":["peexe","executable"],"description":"PE32 executable (console) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"clean","av_label":null,"av_matched":0,"av_total":93,"file_available_to_download":true,"download_link":"/bff/report/5c5b30387ca3e1653d1b1d33/download/dropped-file?key=05fe2de3e2706c37b2860b4ce3327cd3552dc6b834bfddf6342d531eb1252447575a22884c57609d2c349788511b373748e8b9bb142d75be56236d60c080b7a1a01014528c","submit_link":"/bff/report/5c5b30387ca3e1653d1b1d33/submit/dropped-file?key=05fe2de3e2706c37b2860b4ce3327cd3552dc6b834bfddf6342d531eb1252447575a22884c57609d2c349788511b373748e8b9bb142d75be56236d60c080b7a1a01014528c","has_overview":true,"extended_details":null},{"name":"CHCP.COM.5C5B463B.bin","file_path":null,"file_size":11776,"md5":"4436b1a16bdc58d2b3a5263f042c09b3","sha1":"cf2e11809832fc7d3d7f3169418690b8ea4fb969","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","sha512":"c50ad6de05957574b4e8cf0f4ac221522db1ee2617ada4a4267ac4b829fcfdce09e038ae2db6240ce2786980eab3d32dc1a2e81ff58c1b09fac2685ac0656d25","type_tags":["peexe","executable"],"description":"PE32 executable (console) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"clean","av_label":null,"av_matched":0,"av_total":93,"file_available_to_download":true,"download_link":"/bff/report/5c5b30387ca3e1653d1b1d33/download/dropped-file?key=f2d2423000575fb350985fe7073776215948220196d1cdc7227aad4959ec3a4957739a04b4350fbaa521fb93507add40dad5785df5be8e32bd09e40f1fd4324538f6e9f476","submit_link":"/bff/report/5c5b30387ca3e1653d1b1d33/submit/dropped-file?key=f2d2423000575fb350985fe7073776215948220196d1cdc7227aad4959ec3a4957739a04b4350fbaa521fb93507add40dad5785df5be8e32bd09e40f1fd4324538f6e9f476","has_overview":true,"extended_details":null},{"name":"CHCP.COM.5C5B4692.bin","file_path":null,"file_size":11776,"md5":"4436b1a16bdc58d2b3a5263f042c09b3","sha1":"cf2e11809832fc7d3d7f3169418690b8ea4fb969","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","sha512":"c50ad6de05957574b4e8cf0f4ac221522db1ee2617ada4a4267ac4b829fcfdce09e038ae2db6240ce2786980eab3d32dc1a2e81ff58c1b09fac2685ac0656d25","type_tags":["peexe","executable"],"description":"PE32 executable (console) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"clean","av_label":null,"av_matched":0,"av_total":93,"file_available_to_download":true,"download_link":"/bff/report/5c5b30387ca3e1653d1b1d33/download/dropped-file?key=1fc135ad4ba188352de4ceb1751a0c66b8c8d82d8988d8ad666cef5569f704c7b283864ef0125d09876a1e42cb53c5f8c49b18214fc76198bb03480e2fdc15c9feccce3628","submit_link":"/bff/report/5c5b30387ca3e1653d1b1d33/submit/dropped-file?key=1fc135ad4ba188352de4ceb1751a0c66b8c8d82d8988d8ad666cef5569f704c7b283864ef0125d09876a1e42cb53c5f8c49b18214fc76198bb03480e2fdc15c9feccce3628","has_overview":true,"extended_details":null},{"name":"CHCP.COM.5C5B46EF.bin","file_path":null,"file_size":11776,"md5":"4436b1a16bdc58d2b3a5263f042c09b3","sha1":"cf2e11809832fc7d3d7f3169418690b8ea4fb969","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","sha512":"c50ad6de05957574b4e8cf0f4ac221522db1ee2617ada4a4267ac4b829fcfdce09e038ae2db6240ce2786980eab3d32dc1a2e81ff58c1b09fac2685ac0656d25","type_tags":["peexe","executable"],"description":"PE32 executable (console) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"clean","av_label":null,"av_matched":0,"av_total":93,"file_available_to_download":true,"download_link":"/bff/report/5c5b30387ca3e1653d1b1d33/download/dropped-file?key=611954e9ae47e7a5099a7c14debd4cc0a61e57d12b10d27093b57197168b90563295dd123020d8826e6c043c99501b0c23180d4f238cd299b1ff023d50df0f0c7f6f688a1c","submit_link":"/bff/report/5c5b30387ca3e1653d1b1d33/submit/dropped-file?key=611954e9ae47e7a5099a7c14debd4cc0a61e57d12b10d27093b57197168b90563295dd123020d8826e6c043c99501b0c23180d4f238cd299b1ff023d50df0f0c7f6f688a1c","has_overview":true,"extended_details":null},{"name":"CHCP.COM.5C5B4779.bin","file_path":null,"file_size":11776,"md5":"4436b1a16bdc58d2b3a5263f042c09b3","sha1":"cf2e11809832fc7d3d7f3169418690b8ea4fb969","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","sha512":"c50ad6de05957574b4e8cf0f4ac221522db1ee2617ada4a4267ac4b829fcfdce09e038ae2db6240ce2786980eab3d32dc1a2e81ff58c1b09fac2685ac0656d25","type_tags":["peexe","executable"],"description":"PE32 executable (console) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"clean","av_label":null,"av_matched":0,"av_total":93,"file_available_to_download":true,"download_link":"/bff/report/5c5b30387ca3e1653d1b1d33/download/dropped-file?key=7759de19587f65d666c4db7068fd679824b6b1cf4ec9ea4ecc62e12e2872eb03bbbc9ca325dcca15a58ec6e82e98c95f2ff2154e94fba9a64565765ff4e77e04e07a0204dd","submit_link":"/bff/report/5c5b30387ca3e1653d1b1d33/submit/dropped-file?key=7759de19587f65d666c4db7068fd679824b6b1cf4ec9ea4ecc62e12e2872eb03bbbc9ca325dcca15a58ec6e82e98c95f2ff2154e94fba9a64565765ff4e77e04e07a0204dd","has_overview":true,"extended_details":null},{"name":"CHCP.COM.5C5B4799.bin","file_path":null,"file_size":11776,"md5":"4436b1a16bdc58d2b3a5263f042c09b3","sha1":"cf2e11809832fc7d3d7f3169418690b8ea4fb969","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","sha512":"c50ad6de05957574b4e8cf0f4ac221522db1ee2617ada4a4267ac4b829fcfdce09e038ae2db6240ce2786980eab3d32dc1a2e81ff58c1b09fac2685ac0656d25","type_tags":["peexe","executable"],"description":"PE32 executable (console) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"clean","av_label":null,"av_matched":0,"av_total":93,"file_available_to_download":true,"download_link":"/bff/report/5c5b30387ca3e1653d1b1d33/download/dropped-file?key=c1c63c24cc99db79f8325ce06a1ad6615a7043fea875d1192dfe8f18f4ee2c83e10f04b9ad3091456ed898324924531438ee1193ff78c16d1ec1dc53cbf6bbb974369577f4","submit_link":"/bff/report/5c5b30387ca3e1653d1b1d33/submit/dropped-file?key=c1c63c24cc99db79f8325ce06a1ad6615a7043fea875d1192dfe8f18f4ee2c83e10f04b9ad3091456ed898324924531438ee1193ff78c16d1ec1dc53cbf6bbb974369577f4","has_overview":true,"extended_details":null},{"name":"PlayStore_icon.svg","file_path":null,"file_size":7843,"md5":"7cbfa2a4aa1c89e77971bd3d97d01801","sha1":"cb482947c9f8bd9626944803d0bed2aa36702a73","sha256":"e06c008f9b9cda032aa1bf529acb06131eed7ef1133008c94ef8aab497df3917","sha512":"9304b05b370215ea41ef0f6b67e0746de80a7a29c797f034d6ef29ee1ba3836c2375aa76d0e89eaa7f8722e4957eb3547bffcae00b1fb39ff78865e030b4ea96","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"CCEnhancer-4.5.1.exe","file_path":null,"file_size":848897,"md5":"f027b66c68eb7321f9455a8d873331bd","sha1":"93f4c32df6af4a9f902adc9cf53a9291dec25aa3","sha256":"3b5f5172379ae15264866ee6c041e8291e51d5a1f9a6a313b2882bb4188124df","sha512":"b2f2c8c1d70524d925fff340b846cab69b56fb206bab3b0668e69aa819dee6de15a2bd21c057eefaa379679941154bee6cfadb0f772fa9276e5aa570fcb42145","type_tags":["peexe","assembly","executable"],"description":"PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"CCEnhancer-4.5.1.exe","size":848897,"description":null,"architecture":"32 Bit","ssdeep":"6144:FkbPefTPdK2tEnI+btx+j5V2F3EL9fTPdK2tEnIvbtx+jNV9jAM:FkbPyKAEnI95A4zKAEnIkNYM","imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","authentihash":"f8c3906ab3777a869c47f4348c1772cd07267c8a19a3f2101b8cf756c913487c","entrypoint_bytes":null,"packer":"Microsoft visual C# v7.0 / Basic .NET","version_info":[{"id":"Translation","value":"0x0000 0x04b0"},{"id":"LegalCopyright","value":"Copyright 2017"},{"id":"Assembly Version","value":"4.5.1.0"},{"id":"InternalName","value":"CCEnhancer.exe"},{"id":"FileVersion","value":"4.5.1.0"},{"id":"CompanyName","value":"SingularLabs"},{"id":"LegalTrademarks","value":null},{"id":"Comments","value":"Supercharge the cleaning capabilities of Piriform's CCleaner"},{"id":"ProductName","value":"CCEnhancer"},{"id":"ProductVersion","value":"4.5.1.0"},{"id":"FileDescription","value":"CCEnhancer"},{"id":"OriginalFilename","value":"CCEnhancer.exe"}],"file_sections":[{"name":".text","entropy":5.04786256252,"virtual_address":"0x2000","virtual_size":"0x73534","raw_size":"0x73600","md5":"50cafdff3d26d0500f43cae3f9e68d62"},{"name":".rsrc","entropy":4.49878010346,"virtual_address":"0x76000","virtual_size":"0x5b44c","raw_size":"0x5b600","md5":"0fbb3c29ef6c77f0f4d5d24ccffbfd30"},{"name":".reloc","entropy":0.101910425663,"virtual_address":"0xd2000","virtual_size":"0xc","raw_size":"0x200","md5":"440966dcbc2b017bb72c63c89748fc17"}],"file_imports":[{"module":"mscoree.dll","functions":["_CorExeMain"]}],"file_exports":[]}},{"name":"adoberfp.dll","file_path":null,"file_size":285265,"md5":"cab0db1f89db39dee857143ab4c97089","sha1":"508d8e3e9a9c0c1355c8c8a346773def2e2a831b","sha256":"cef8d1a4364cf5cf7e586bd78bd897b50e24ced4c82c6ce49fa841395d168109","sha512":"0d1c093d5b368436f8adea02261de155770de20a792f0da81041bda5b70396ae0ad13da958fa6e20ad15e383df5b0c05d437612d7a2a659e63ca7097cf19688d","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"adoberfp.dll","size":285265,"description":null,"architecture":"32 Bit","ssdeep":"3072:0BIEREpZbaTWBeMSqv2yuWyPy4N+XmmZG06Muq5WpHZaB8INx+ov5TAuNYSVnR85:0Dxyu+TbPW5Zwb59NjJxAYc","imphash":"68faf3a2613bcbd472b9f9f99f23e973","authentihash":"ee27997a5c5b1041c850ba831bd115208cc449b4fd4513053f9cfbc6260b933b","entrypoint_bytes":null,"packer":"Borland Delphi 3.0 (???)","version_info":[{"id":"LegalCopyright","value":"Copyright 2017 Adobe Systems Incorporated and its licensors. All rights reserved."},{"id":"InternalName","value":"adoberfp.dll"},{"id":"FileVersion","value":"15.23.20053.211670"},{"id":"CompanyName","value":"Adobe Systems, Inc."},{"id":"ProductName","value":"Adobe Reader File Preview"},{"id":"ProductVersion","value":"15.23.20053.211670"},{"id":"FileDescription","value":"Adobe Reader File Preview"},{"id":"OriginalFilename","value":"adoberfp.dll"},{"id":"Translation","value":"0x0409 0x04e4"}],"file_sections":[{"name":".text","entropy":6.63787739322,"virtual_address":"0x1000","virtual_size":"0x29d8d","raw_size":"0x29e00","md5":"629380bcc669fbb9d91d5f3af5beaa58"},{"name":".orpc","entropy":3.32860031655,"virtual_address":"0x2b000","virtual_size":"0xf7","raw_size":"0x200","md5":"b0e854283440361366671de741264315"},{"name":".rdata","entropy":4.87004424389,"virtual_address":"0x2c000","virtual_size":"0xf926","raw_size":"0xfa00","md5":"e51f59863302cc47f65a40758163fc4c"},{"name":".data","entropy":4.60909891747,"virtual_address":"0x3c000","virtual_size":"0x517c","raw_size":"0x3200","md5":"67923e26e05ef6aa1f91ddecc7f29a46"},{"name":".rsrc","entropy":4.63269989553,"virtual_address":"0x42000","virtual_size":"0x2f70","raw_size":"0x3000","md5":"89b06948cea00f52e1661e0794aee73d"},{"name":".reloc","entropy":6.53226147569,"virtual_address":"0x45000","virtual_size":"0x38ac","raw_size":"0x3a00","md5":"50f2cf5edff349c58f2f893112aab16c"}],"file_imports":[{"module":"ADVAPI32.dll","functions":["CryptAcquireContextW","CryptCreateHash","CryptDecrypt","CryptDestroyHash","CryptDestroyKey","CryptGetHashParam","CryptHashData","CryptImportKey","CryptReleaseContext","CryptSetKeyParam","RegCloseKey","RegCreateKeyExW","RegDeleteKeyW","RegDeleteValueW","RegEnumKeyExW","RegOpenKeyExW","RegQueryInfoKeyW","RegSetValueExW"]},{"module":"GDI32.dll","functions":["BitBlt","CopyEnhMetaFileW","CreateCompatibleBitmap","CreateCompatibleDC","CreateDIBSection","CreateSolidBrush","DeleteDC","DeleteEnhMetaFile","DeleteObject","GetDeviceCaps","GetDIBits","GetEnhMetaFileHeader","GetEnhMetaFileW","GetObjectW","GetStockObject","PlayEnhMetaFile","SelectObject","SetBrushOrgEx","SetEnhMetaFileBits","SetStretchBltMode","StretchBlt"]},{"module":"KERNEL32.dll","functions":["CloseHandle","CompareStringW","CopyFileW","CreateFileW","CreateToolhelp32Snapshot","DecodePointer","DeleteCriticalSection","DeleteFileW","EncodePointer","EnterCriticalSection","ExitProcess","FileTimeToLocalFileTime","FileTimeToSystemTime","FindClose","FindFirstFileExW","FindResourceExW","FindResourceW","FlushFileBuffers","FlushInstructionCache","FreeEnvironmentStringsW","FreeLibrary","GetACP","GetCommandLineA","GetConsoleCP","GetConsoleMode","GetCPInfo","GetCurrentDirectoryW","GetCurrentProcess","GetCurrentProcessId","GetCurrentThreadId","GetDriveTypeW","GetEnvironmentStringsW","GetFileAttributesExW","GetFileInformationByHandle","GetFileSize","GetFileType","GetFullPathNameW","GetLastError","GetModuleFileNameA","GetModuleFileNameW","GetModuleHandleExW","GetModuleHandleW","GetOEMCP","GetProcAddress","GetProcessHeap","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemInfo","GetSystemTimeAsFileTime","GetTempPathW","GetThreadLocale","GetTimeZoneInformation","GlobalAlloc","GlobalLock","GlobalReAlloc","GlobalUnlock","HeapAlloc","HeapDestroy","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSection","InitializeCriticalSectionAndSpinCount","InitializeCriticalSectionEx","InitializeSListHead","InterlockedPopEntrySList","InterlockedPushEntrySList","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","LCMapStringW","LeaveCriticalSection","LoadLibraryExW","LoadResource","LocalFree","LockResource","lstrcmpiW","lstrcmpW","lstrlenA","MulDiv","MultiByteToWideChar","OpenProcess","OutputDebugStringW","PeekNamedPipe","Process32FirstW","Process32NextW","QueryPerformanceCounter","RaiseException","ReadConsoleW","ReadFile","RtlUnwind","SetEndOfFile","SetEnvironmentVariableA","SetFileAttributesW","SetFilePointerEx","SetLastError","SetStdHandle","SetThreadLocale","SetUnhandledExceptionFilter","SizeofResource","Sleep","SystemTimeToTzSpecificLocalTime","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","VirtualAlloc","VirtualFree","VirtualProtect","VirtualQuery","WideCharToMultiByte","WriteConsoleW","WriteFile"]},{"module":"ole32.dll","functions":["CLSIDFromProgID","CLSIDFromString","CoCreateInstance","CoGetClassObject","CoTaskMemAlloc","CoTaskMemFree","CoTaskMemRealloc","CreateBindCtx","CreateStreamOnHGlobal","HWND_UserFree","HWND_UserMarshal","HWND_UserSize","HWND_UserUnmarshal","OleDraw","OleInitialize","OleLockRunning","OleUninitialize","StringFromGUID2"]},{"module":"OLEAUT32.dll","functions":["LoadRegTypeLib","LoadTypeLib","LPSAFEARRAY_UserFree","LPSAFEARRAY_UserMarshal","LPSAFEARRAY_UserSize","LPSAFEARRAY_UserUnmarshal","OleCreateFontIndirect","OleLoadPicture","RegisterTypeLib","SafeArrayAccessData","SafeArrayCopy","SafeArrayCreate","SafeArrayDestroy","SafeArrayGetLBound","SafeArrayGetUBound","SafeArrayGetVartype","SafeArrayLock","SafeArrayRedim","SafeArrayUnaccessData","SafeArrayUnlock","SysAllocString","SysAllocStringByteLen","SysAllocStringLen","SysFreeString","SysStringByteLen","SysStringLen","UnRegisterTypeLib","VarBstrCmp","VarBstrFromI4","VarI4FromStr","VARIANT_UserFree","VARIANT_UserMarshal","VARIANT_UserSize","VARIANT_UserUnmarshal","VariantChangeType","VariantClear","VariantCopy","VariantInit","VarUI4FromStr"]},{"module":"RPCRT4.dll","functions":["CStdStubBuffer_AddRef","CStdStubBuffer_Connect","CStdStubBuffer_CountRefs","CStdStubBuffer_DebugServerQueryInterface","CStdStubBuffer_DebugServerRelease","CStdStubBuffer_Disconnect","CStdStubBuffer_Invoke","CStdStubBuffer_IsIIDSupported","CStdStubBuffer_QueryInterface","IUnknown_AddRef_Proxy","IUnknown_QueryInterface_Proxy","IUnknown_Release_Proxy","NdrClientCall2","NdrCStdStubBuffer_Release","NdrDllCanUnloadNow","NdrDllGetClassObject","NdrDllRegisterProxy","NdrDllUnregisterProxy","NdrOleAllocate","NdrOleFree","RpcStringFreeW","UuidCreate","UuidToStringW"]},{"module":"SHELL32.dll","functions":["SHGetDesktopFolder"]},{"module":"urlmon.dll","functions":["CoInternetSetFeatureEnabled","CreateURLMonikerEx"]},{"module":"USER32.dll","functions":["BeginPaint","CallWindowProcW","CharLowerBuffW","CharNextW","ClientToScreen","CloseClipboard","CreateAcceleratorTableW","CreateWindowExW","DefWindowProcW","DestroyAcceleratorTable","DestroyWindow","EmptyClipboard","EndPaint","FillRect","FindWindowW","GetClassInfoExW","GetClassNameW","GetClientRect","GetClipboardData","GetDC","GetDesktopWindow","GetDlgItem","GetFocus","GetParent","GetSysColor","GetWindow","GetWindowLongW","GetWindowRect","GetWindowTextLengthW","GetWindowTextW","GetWindowThreadProcessId","InvalidateRect","InvalidateRgn","IsChild","IsClipboardFormatAvailable","IsWindow","KillTimer","LoadCursorW","MoveWindow","OffsetRect","OpenClipboard","PeekMessageW","PostMessageW","RedrawWindow","RegisterClassExW","RegisterWindowMessageW","ReleaseCapture","ReleaseDC","ScreenToClient","SendMessageW","SetCapture","SetFocus","SetParent","SetTimer","SetWindowLongW","SetWindowPos","SetWindowTextW","ShowWindow","UnregisterClassW"]}],"file_exports":[{"name":"DllCanUnloadNow","ordinal":1,"address":"0x1000d849"},{"name":"DllGetClassObject","ordinal":2,"address":"0x1000d866"},{"name":"DllInstall","ordinal":3,"address":"0x1000d892"},{"name":"DllRegisterServer","ordinal":4,"address":"0x1000d8e9"},{"name":"DllUnregisterServer","ordinal":5,"address":"0x1000d8fe"}]}},{"name":"close.svg","file_path":null,"file_size":1427,"md5":"5406436dc6eefb0f89e9efe2c5e59d99","sha1":"a03f78f29276d41da05ca3464372d1e2939d3988","sha256":"1a85d876a63099b608e739760b7ddce57e6292cd17b7f893098fd30fa11e6947","sha512":"cf7ae69827424c3e11d72015124dd4262f8d9cc0601b04adea7e9460e3ebb61d3a338f242e35a03078962ce9177c32100798275d3b1b653e43d32b84c7e0cd7e","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"ccme_ecc.dll","file_path":null,"file_size":505345,"md5":"53c3f67c7682f5565c137f4a0bf95397","sha1":"dd93b2db9ad08b0524acc500e2d33abdfc55fecd","sha256":"eaac86214b56b15800f648bb6315beb73c197b49c2f5ff2b91e19db866a24326","sha512":"873fb44a9f10b11b787af30f49c94b6387537d4f1c96c86009b6eb41077903a19db33ef1222820f672321331f60a23d52bec8aa0e5a485da454088ced2a26094","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"ccme_ecc.dll","size":505345,"description":null,"architecture":"32 Bit","ssdeep":"6144:q1cOq+Dno9/eTnmElqh6Rl6FDz/O8qJ9CFPKCPM4r8Ue5L0QpC7+Ooa4hTQ0oL8u:qJbno9/eTnmWigl6FDz/OBJw/us64","imphash":"3cecc98a9a150d637aa00c8d7bac6447","authentihash":"a9476f1bab69323f25e2ab54e4e67310b8bb88808f4efa2f86d54010d19da9c3","entrypoint_bytes":null,"packer":"Borland Delphi 3.0 (???)","version_info":[{"id":"LegalCopyright","value":"Copyright 2011 by RSA Security Inc. All rights reserved."},{"id":"InternalName","value":"ccme_ecc"},{"id":"FileVersion","value":"4.1.2.0"},{"id":"CompanyName","value":"RSA - The Security Division of EMC"},{"id":"ProductName","value":"RSA BSAFE Crypto-C ME"},{"id":"ProductVersion","value":"4.1.2.0"},{"id":"FileDescription","value":"{TARGETDESC}"},{"id":"OriginalFilename","value":"ccme_ecc"},{"id":"Translation","value":"0x0409 0x04e4"}],"file_sections":[{"name":".text","entropy":6.42570403953,"virtual_address":"0x1000","virtual_size":"0x523ea","raw_size":"0x52400","md5":"3ce4a29c8840262eb3d8561579048307"},{"name":".rdata","entropy":5.4649677587,"virtual_address":"0x54000","virtual_size":"0x42b4","raw_size":"0x4400","md5":"4399c761d8d3e537442e8961b2e7d2e7"},{"name":".data","entropy":3.80630941111,"virtual_address":"0x59000","virtual_size":"0x22a7c","raw_size":"0x22800","md5":"50f74eb85314470066c7b1f97c78718a"},{"name":"_RDATA","entropy":1.00297658396,"virtual_address":"0x7c000","virtual_size":"0x68","raw_size":"0x200","md5":"0d6c821ac42bbf1d0c9c67cb31a7ff32"},{"name":"_DATA1","entropy":0.681890269912,"virtual_address":"0x7d000","virtual_size":"0x2d","raw_size":"0x200","md5":"1dcacc8dad2dc940cd46ed4712696900"},{"name":".rsrc","entropy":3.08398983791,"virtual_address":"0x7e000","virtual_size":"0x3a0","raw_size":"0x400","md5":"fdef9f9f54f24f2ea6ba9032dd786651"},{"name":".reloc","entropy":6.12825429086,"virtual_address":"0x7f000","virtual_size":"0x15ac","raw_size":"0x1600","md5":"e11ec32e86fdede5677a98f44ccc3a9c"}],"file_imports":[{"module":"KERNEL32.dll","functions":["DecodePointer","DisableThreadLibraryCalls","EncodePointer","GetCurrentProcessId","GetCurrentThreadId","GetSystemTimeAsFileTime","IsDebuggerPresent","IsProcessorFeaturePresent","QueryPerformanceCounter"]},{"module":"MSVCR120.dll","functions":["__clean_type_info_names_internal","__CppXcptFilter","__crtTerminateProcess","__crtUnhandledException","__dllonexit","_amsg_exit","_calloc_crt","_crt_debugger_hook","_except_handler4_common","_initterm","_initterm_e","_lock","_malloc_crt","_onexit","_unlock","free","memcpy_s","memmove_s","memset"]}],"file_exports":[{"name":"R_FIPS_MODULE_resource","ordinal":1,"address":"0x10001000"}]}},{"name":"AdobeXMP.dll","file_path":null,"file_size":307793,"md5":"5f9c7ba78285c7b88f1fe74c6e2479de","sha1":"df1c7acb33631192d1b7ec6c2f9d828216e42582","sha256":"c9e73e69679d831b6e74eed0dc8a1ab190ff89b00a8a51a15aec0ba5eb1a8cfe","sha512":"2b711ede880052d40402a591fd3278639e3cb6d9dec618d9b1b22bc93493f61dfe564a08d419e316021b7278208717a8a76eee788e2c5a1c46c1054f1d041f99","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"AdobeXMP.dll","size":307793,"description":null,"architecture":"32 Bit","ssdeep":"6144:bT/q0p7gzArFKQMt0oKoFM+zFj8ocUCH5xMrsK:5c+2tQ2ooxzsK","imphash":"3994590949b81ac8fe20d77b401f2240","authentihash":"7a0b7527f9d8c77e462125addf80245983135be9b907afe144081138328e493c","entrypoint_bytes":null,"packer":"Borland Delphi 3.0 (???)","version_info":[{"id":"LegalCopyright","value":"Copyright 2002-2009, Adobe Systems Incorporated. All Rights Reserved."},{"id":"InternalName","value":"AdobeXMPCore"},{"id":"FileVersion","value":"5.6-c015 ( 32 bit ), 84.159810, 2016/09/10-02:41:30"},{"id":"CompanyName","value":"Adobe Systems Incorporated"},{"id":"BuildVersion","value":"84.159810"},{"id":"Company","value":"Adobe Systems Incorporated"},{"id":"BinType","value":"32"},{"id":"ProductName","value":"Adobe XMP Core 2016/09/10-02:41:30"},{"id":"BuildID","value":"37152"},{"id":"ProductVersion","value":"84.159810"},{"id":"FileDescription","value":"Adobe XMP Core 5.6-c015 ( 32 bit )"},{"id":"Configuration","value":"Release"},{"id":"OriginalFilename","value":"AdobeXMP.dll"},{"id":"BuildDate","value":"2016/09/10-02:41:30"},{"id":"Translation","value":"0x0800 0x04b0"}],"file_sections":[{"name":".text","entropy":6.71987399371,"virtual_address":"0x1000","virtual_size":"0x362e6","raw_size":"0x36400","md5":"6da79601bc42ec36e05887698c19d6c2"},{"name":".rdata","entropy":5.24145372607,"virtual_address":"0x38000","virtual_size":"0xe4b2","raw_size":"0xe600","md5":"db2aaa6618aa39eac7c58e9701e82cc3"},{"name":".data","entropy":4.38916178065,"virtual_address":"0x47000","virtual_size":"0x83c","raw_size":"0x400","md5":"2a4e62d6ac6efcbc1ab600c61e8f22d2"},{"name":".rsrc","entropy":3.85828710113,"virtual_address":"0x48000","virtual_size":"0x760","raw_size":"0x800","md5":"bf1671e8ca098dc799f62951fb73681c"},{"name":".reloc","entropy":6.64550692012,"virtual_address":"0x49000","virtual_size":"0x365c","raw_size":"0x3800","md5":"f0837cf1c894b1a259ca011f8ee8d764"}],"file_imports":[{"module":"KERNEL32.dll","functions":["CloseHandle","CreateEventW","DecodePointer","DeleteCriticalSection","DisableThreadLibraryCalls","EncodePointer","EnterCriticalSection","GetCurrentProcessId","GetCurrentThreadId","GetSystemTimeAsFileTime","InitializeCriticalSection","IsDebuggerPresent","IsProcessorFeaturePresent","LeaveCriticalSection","QueryPerformanceCounter","SetEvent","WaitForSingleObject"]},{"module":"MSVCP120.dll","functions":["?_Syserror_map@std@@YAPBDH@Z","?_Winerror_map@std@@YAPBDH@Z","?_Xbad_alloc@std@@YAXXZ","?_Xlength_error@std@@YAXPBD@Z","?_Xout_of_range@std@@YAXPBD@Z"]},{"module":"MSVCR120.dll","functions":["??0exception@std@@QAE@ABQBDH@Z","??0exception@std@@QAE@ABV01@@Z","??1exception@std@@UAE@XZ","??1type_info@@UAE@XZ","?terminate@@YAXXZ","?what@exception@std@@UBEPBDXZ","__clean_type_info_names_internal","__CppXcptFilter","__crtTerminateProcess","__crtUnhandledException","__CxxFrameHandler3","__dllonexit","__lconv_init","_amsg_exit","_calloc_crt","_crt_debugger_hook","_CxxThrowException","_difftime64","_errno","_except_handler4_common","_gmtime64_s","_initterm","_initterm_e","_localtime64_s","_lock","_malloc_crt","_mktime64","_onexit","_purecall","_snprintf","_time64","_unlock","free","malloc","memchr","memcmp","memcpy","memmove","memset","realloc","setlocale","sscanf","strcmp","strlen","strncmp","strtod"]},{"module":"RPCRT4.dll","functions":["UuidCreate"]}],"file_exports":[{"name":"WXMPMeta_GetVersionInfo_1","ordinal":1,"address":"0x1001e067"},{"name":"WXMPMeta_Initialize_1","ordinal":2,"address":"0x1001e09f"},{"name":"WXMPMeta_Terminate_1","ordinal":3,"address":"0x1001e168"},{"name":"WXMPMeta_CTor_1","ordinal":4,"address":"0x1001e174"},{"name":"WXMPMeta_IncrementRefCount_1","ordinal":5,"address":"0x1001d0c8"},{"name":"WXMPMeta_DecrementRefCount_1","ordinal":6,"address":"0x1001d0f1"},{"name":"WXMPMeta_GetGlobalOptions_1","ordinal":7,"address":"0x1001e21a"},{"name":"WXMPMeta_SetGlobalOptions_1","ordinal":8,"address":"0x1001e229"},{"name":"WXMPMeta_GetMemProcs_1","ordinal":9,"address":"0x1001e294"},{"name":"WXMPMeta_RegisterAssertNotify_1","ordinal":10,"address":"0x1001e31c"},{"name":"WXMPMeta_UnregisterAssertNotify_1","ordinal":11,"address":"0x1001e3a5"},{"name":"WXMPMeta_DumpNamespaces_1","ordinal":13,"address":"0x1001e3cc"},{"name":"WXMPMeta_DumpPropertyTraits_1","ordinal":14,"address":"0x1001e488"},{"name":"WXMPMeta_RegisterNamespace_1","ordinal":15,"address":"0x1001e511"},{"name":"WXMPMeta_GetNamespacePrefix_1","ordinal":16,"address":"0x1001e62d"},{"name":"WXMPMeta_GetNamespaceURI_1","ordinal":17,"address":"0x1001e71a"},{"name":"WXMPMeta_DeleteNamespace_1","ordinal":18,"address":"0x1001e801"},{"name":"WXMPMeta_RegisterPropertyTraits_1","ordinal":19,"address":"0x1001e89b"},{"name":"WXMPMeta_GetProperty_1","ordinal":20,"address":"0x1001e964"},{"name":"WXMPMeta_GetArrayItem_1","ordinal":21,"address":"0x1001eab9"},{"name":"WXMPMeta_GetStructField_1","ordinal":22,"address":"0x1001ec11"},{"name":"WXMPMeta_GetQualifier_1","ordinal":23,"address":"0x1001edd7"},{"name":"WXMPMeta_SetProperty_1","ordinal":24,"address":"0x1001ef9d"},{"name":"WXMPMeta_SetArrayItem_1","ordinal":25,"address":"0x1001f0b5"},{"name":"WXMPMeta_AppendArrayItem_1","ordinal":26,"address":"0x1001f1d0"},{"name":"WXMPMeta_SetStructField_1","ordinal":27,"address":"0x1001f2eb"},{"name":"WXMPMeta_SetQualifier_1","ordinal":28,"address":"0x1001f473"},{"name":"WXMPMeta_DeleteProperty_1","ordinal":29,"address":"0x1001f5fb"},{"name":"WXMPMeta_DeleteArrayItem_1","ordinal":30,"address":"0x1001f70d"},{"name":"WXMPMeta_DeleteStructField_1","ordinal":31,"address":"0x1001f822"},{"name":"WXMPMeta_DeleteQualifier_1","ordinal":32,"address":"0x1001f9a0"},{"name":"WXMPMeta_DoesPropertyExist_1","ordinal":33,"address":"0x1001fb1e"},{"name":"WXMPMeta_DoesArrayItemExist_1","ordinal":34,"address":"0x1001fc35"},{"name":"WXMPMeta_DoesStructFieldExist_1","ordinal":35,"address":"0x1001fd4f"},{"name":"WXMPMeta_DoesQualifierExist_1","ordinal":36,"address":"0x1001fed8"},{"name":"WXMPMeta_GetLocalizedText_1","ordinal":37,"address":"0x10020061"},{"name":"WXMPMeta_SetLocalizedText_1","ordinal":38,"address":"0x10020224"},{"name":"WXMPMeta_DeleteLocalizedText_1","ordinal":39,"address":"0x1002038a"},{"name":"WXMPMeta_GetProperty_Bool_1","ordinal":40,"address":"0x100204e1"},{"name":"WXMPMeta_GetProperty_Int_1","ordinal":41,"address":"0x10020627"},{"name":"WXMPMeta_GetProperty_Int64_1","ordinal":42,"address":"0x1002075b"},{"name":"WXMPMeta_GetProperty_Float_1","ordinal":43,"address":"0x1002088f"},{"name":"WXMPMeta_GetProperty_Date_1","ordinal":44,"address":"0x100209c3"},{"name":"WXMPMeta_SetProperty_Bool_1","ordinal":45,"address":"0x10020af7"},{"name":"WXMPMeta_SetProperty_Int_1","ordinal":46,"address":"0x10020c16"},{"name":"WXMPMeta_SetProperty_Int64_1","ordinal":47,"address":"0x10020d2e"},{"name":"WXMPMeta_SetProperty_Float_1","ordinal":48,"address":"0x10020e49"},{"name":"WXMPMeta_SetProperty_Date_1","ordinal":49,"address":"0x10020f63"},{"name":"WXMPMeta_GetObjectName_1","ordinal":50,"address":"0x10021589"},{"name":"WXMPMeta_SetObjectName_1","ordinal":51,"address":"0x10021648"},{"name":"WXMPMeta_GetObjectOptions_1","ordinal":52,"address":"0x1002172f"},{"name":"WXMPMeta_SetObjectOptions_1","ordinal":53,"address":"0x10021767"},{"name":"WXMPMeta_Sort_1","ordinal":54,"address":"0x10021158"},{"name":"WXMPMeta_Erase_1","ordinal":55,"address":"0x10021259"},{"name":"WXMPMeta_Clone_1","ordinal":56,"address":"0x10021319"},{"name":"WXMPMeta_CountArrayItems_1","ordinal":57,"address":"0x100213ea"},{"name":"WXMPMeta_MarkStaleProperties_1","ordinal":58,"address":"0x100214fe"},{"name":"WXMPMeta_DumpObject_1","ordinal":59,"address":"0x1002107b"},{"name":"WXMPMeta_ParseFromBuffer_1","ordinal":60,"address":"0x100217f2"},{"name":"WXMPMeta_SerializeToBuffer_1","ordinal":61,"address":"0x100218a3"},{"name":"WXMPIterator_PropCTor_1","ordinal":62,"address":"0x1001dc94"},{"name":"WXMPIterator_TableCTor_1","ordinal":63,"address":"0x1001dd78"},{"name":"WXMPIterator_IncrementRefCount_1","ordinal":64,"address":"0x1001d0c8"},{"name":"WXMPIterator_DecrementRefCount_1","ordinal":65,"address":"0x1001d0f1"},{"name":"WXMPIterator_Next_1","ordinal":66,"address":"0x1001de3c"},{"name":"WXMPIterator_Skip_1","ordinal":67,"address":"0x1001df91"},{"name":"WXMPUtils_ComposeArrayItemPath_1","ordinal":68,"address":"0x10021aa0"},{"name":"WXMPUtils_ComposeStructFieldPath_1","ordinal":69,"address":"0x10021bd2"},{"name":"WXMPUtils_ComposeQualifierPath_1","ordinal":70,"address":"0x10021d88"},{"name":"WXMPUtils_ComposeLangSelector_1","ordinal":71,"address":"0x10021f3e"},{"name":"WXMPUtils_ComposeFieldSelector_1","ordinal":72,"address":"0x100220b4"},{"name":"WXMPUtils_ConvertFromBool_1","ordinal":73,"address":"0x10022288"},{"name":"WXMPUtils_ConvertFromInt_1","ordinal":74,"address":"0x10022369"},{"name":"WXMPUtils_ConvertFromInt64_1","ordinal":75,"address":"0x10022442"},{"name":"WXMPUtils_ConvertFromFloat_1","ordinal":76,"address":"0x1002251e"},{"name":"WXMPUtils_ConvertFromDate_1","ordinal":77,"address":"0x100225f7"},{"name":"WXMPUtils_ConvertToBool_1","ordinal":78,"address":"0x100226c1"},{"name":"WXMPUtils_ConvertToInt_1","ordinal":79,"address":"0x10022780"},{"name":"WXMPUtils_ConvertToInt64_1","ordinal":80,"address":"0x100227fe"},{"name":"WXMPUtils_ConvertToFloat_1","ordinal":81,"address":"0x1002287f"},{"name":"WXMPUtils_ConvertToDate_1","ordinal":82,"address":"0x1002293d"},{"name":"WXMPUtils_CurrentDateTime_1","ordinal":83,"address":"0x100229b7"},{"name":"WXMPUtils_SetTimeZone_1","ordinal":84,"address":"0x10022a2e"},{"name":"WXMPUtils_ConvertToUTCTime_1","ordinal":85,"address":"0x10022aa5"},{"name":"WXMPUtils_ConvertToLocalTime_1","ordinal":86,"address":"0x10022b1e"},{"name":"WXMPUtils_CompareDateTime_1","ordinal":87,"address":"0x10022b95"},{"name":"WXMPUtils_EncodeToBase64_1","ordinal":88,"address":"0x10022bb0"},{"name":"WXMPUtils_DecodeFromBase64_1","ordinal":89,"address":"0x10022c7f"},{"name":"WXMPUtils_PackageForJPEG_1","ordinal":90,"address":"0x10022d4e"},{"name":"WXMPUtils_MergeFromJPEG_1","ordinal":91,"address":"0x10022ead"},{"name":"WXMPUtils_CatenateArrayItems_1","ordinal":92,"address":"0x10022fdd"},{"name":"WXMPUtils_SeparateArrayItems_1","ordinal":93,"address":"0x1002317f"},{"name":"WXMPUtils_RemoveProperties_1","ordinal":94,"address":"0x100233a1"},{"name":"WXMPUtils_AppendProperties_1","ordinal":95,"address":"0x10023492"},{"name":"WXMPUtils_DuplicateSubtree_1","ordinal":96,"address":"0x100235b2"},{"name":"WXMPUtils_CollectMultiFileXMP_1","ordinal":97,"address":"0x10023742"},{"name":"WXMPUtils_DistributeMultiFileXMP_1","ordinal":98,"address":"0x10023860"},{"name":"WXMPUtils_IsPropertyMultiValued_1","ordinal":99,"address":"0x1002397e"},{"name":"WXMPUtils_GetDateRange_1","ordinal":100,"address":"0x10023a95"},{"name":"WXMPUtils_GetMergedListPath_1","ordinal":101,"address":"0x10023bb4"},{"name":"WXMPUtils_RemoveMultiValueInfo_1","ordinal":102,"address":"0x10023d24"},{"name":"WXMPUtils_GetBulkMarkers_1","ordinal":103,"address":"0x10023e11"},{"name":"WXMPUtils_SetBulkMarkers_1","ordinal":104,"address":"0x10023eff"},{"name":"WXMPDocOps_SetAppName_1","ordinal":105,"address":"0x1001d14d"},{"name":"WXMPDocOps_CreateID_1","ordinal":106,"address":"0x1001d1dc"},{"name":"WXMPDocOps_CTor_1","ordinal":107,"address":"0x1001d022"},{"name":"WXMPDocOps_IncrementRefCount_1","ordinal":108,"address":"0x1001d0c8"},{"name":"WXMPDocOps_DecrementRefCount_1","ordinal":109,"address":"0x1001d0f1"},{"name":"WXMPDocOps_NewXMP_1","ordinal":110,"address":"0x1001d2b5"},{"name":"WXMPDocOps_OpenXMP_1","ordinal":111,"address":"0x1001d3b9"},{"name":"WXMPDocOps_BranchXMP_1","ordinal":112,"address":"0x1001d4d0"},{"name":"WXMPDocOps_PrepareForSave_1","ordinal":113,"address":"0x1001d60a"},{"name":"WXMPDocOps_NoteChange_1","ordinal":114,"address":"0x1001d6fc"},{"name":"WXMPDocOps_HasPartChanged_1","ordinal":115,"address":"0x1001d808"},{"name":"WXMPDocOps_GetPartChangeID_1","ordinal":116,"address":"0x1001d930"},{"name":"WXMPDocOps_EnsureIDsExist_1","ordinal":117,"address":"0x1001da66"},{"name":"WXMPDocOps_IsDirty_1","ordinal":118,"address":"0x1001db17"},{"name":"WXMPDocOps_Clone_1","ordinal":119,"address":"0x1001db5e"},{"name":"WXMPDocOps_GetMetaRef_1","ordinal":120,"address":"0x1001dc5a"},{"name":"XMP_NewExpatAdapter","ordinal":121,"address":"0x10016952"},{"name":"XMP_GetAssertNotify","ordinal":122,"address":"0x1000de77"},{"name":"WXMPUtils_ApplyTemplate_1","ordinal":123,"address":"0x100232d5"},{"name":"WXMPMeta_SetDefaultErrorCallback_1","ordinal":124,"address":"0x100219bc"},{"name":"WXMPMeta_SetErrorCallback_1","ordinal":125,"address":"0x100219e7"},{"name":"WXMPMeta_ResetErrorCallbackLimit_1","ordinal":126,"address":"0x10021a56"}]}},{"name":"logsession.dll","file_path":null,"file_size":402513,"md5":"b5c34939a8d5a5a809432b9b781c38b6","sha1":"d91efaaa07fd5f6a5faa8fbe5b01bbd2dab0160a","sha256":"70f31fe2763b930e12ec30619bbea632ab0820e68573bb0bf91026f04122435e","sha512":"95df9dfb4fc06fd1a7e7bce538e973de7abaca0c71de848af27070594287852bf80695e4f3df43b9d0e0a934c9aec921a4687d39f5fa3fe04383a842be83b584","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"logsession.dll","size":402513,"description":null,"architecture":"32 Bit","ssdeep":"6144:8CD3W+LFDcPAY71TiyJljN7t7PqCSmia5VUNVejYvKmGR0PiuyFBxGF5O8GiD69i:8CPyJlDbhxmGouBxG33emCy","imphash":"e71c943beb69eb348b6048e211d7f322","authentihash":"ae537bcef4989ea41307c6883fae4046fdbba5ab31a20987b02525dbb8726892","entrypoint_bytes":null,"packer":"Borland Delphi 3.0 (???)","version_info":[{"id":"LegalCopyright","value":"Copyright 2008-15 Adobe Systems Incorporated. All rights reserved."},{"id":"InternalName","value":"LogSession"},{"id":"FileVersion","value":"7.1.1.3403"},{"id":"CompanyName","value":"Adobe Systems Incorporated"},{"id":"PrivateBuild","value":"7.1.1.3403"},{"id":"ProductName","value":"LogSession"},{"id":"ProductVersion","value":"7.1.1.3403"},{"id":"FileDescription","value":"LogSession"},{"id":"OriginalFilename","value":"LogSession.dll"},{"id":"Translation","value":"0x0409 0x04b0"}],"file_sections":[{"name":".text","entropy":6.41804913764,"virtual_address":"0x1000","virtual_size":"0x45e1b","raw_size":"0x46000","md5":"e288d6079878b7115f9360461b4eda0a"},{"name":".rdata","entropy":5.06958654452,"virtual_address":"0x47000","virtual_size":"0xe484","raw_size":"0xe600","md5":"1d3830a2a77f1e08d3895fdc98a5bc14"},{"name":".data","entropy":5.0907023573,"virtual_address":"0x56000","virtual_size":"0x17ac","raw_size":"0x1400","md5":"500946e1e7a5fd14cfa016f715b2f861"},{"name":".rsrc","entropy":3.97809548144,"virtual_address":"0x58000","virtual_size":"0x5a8","raw_size":"0x600","md5":"c02a9fe0fc0eaa5d792e05b80b32f3b1"},{"name":".reloc","entropy":3.84860754338,"virtual_address":"0x59000","virtual_size":"0x9fc4","raw_size":"0xa000","md5":"9a0a2c09776e275583022a9f5faabf08"}],"file_imports":[{"module":"ADVAPI32.dll","functions":["CryptAcquireContextA","CryptCreateHash","CryptDestroyHash","CryptGetHashParam","CryptHashData","CryptReleaseContext","RegCloseKey","RegCreateKeyExW","RegDeleteKeyW","RegDeleteValueW","RegEnumValueW","RegOpenKeyExW","RegQueryValueExW","RegSetValueExW"]},{"module":"KERNEL32.dll","functions":["CloseHandle","CompareFileTime","CopyFileW","CreateFileW","CreateProcessW","DecodePointer","DeleteCriticalSection","DeleteFileW","EncodePointer","EnterCriticalSection","ExpandEnvironmentStringsW","FileTimeToLocalFileTime","FindClose","FindFirstFileW","FindNextFileW","FindResourceExW","FindResourceW","FreeEnvironmentStringsW","FreeLibrary","GetCurrentProcess","GetCurrentThreadId","GetDiskFreeSpaceW","GetEnvironmentStringsW","GetFileAttributesExW","GetFileTime","GetLastError","GetLocaleInfoA","GetModuleFileNameW","GetModuleHandleA","GetModuleHandleW","GetProcAddress","GetProcessHeap","GetSystemInfo","GetSystemTimeAsFileTime","GetTickCount64","GetVersionExA","GlobalMemoryStatusEx","HeapAlloc","HeapDestroy","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSection","InitializeCriticalSectionEx","IsDebuggerPresent","IsProcessorFeaturePresent","LeaveCriticalSection","LoadLibraryA","LoadLibraryW","LoadResource","LockResource","lstrlenW","MoveFileExW","MultiByteToWideChar","QueryPerformanceCounter","RaiseException","SetUnhandledExceptionFilter","SizeofResource","VerLanguageNameW","VirtualProtect","WideCharToMultiByte","WriteFile","WriteProcessMemory"]},{"module":"MSVCP110.dll","functions":["??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ","??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ","??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z","??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z","??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z","??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z","??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z","??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ","??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ","??0_Locinfo@std@@QAE@PBD@Z","??0_Lockit@std@@QAE@H@Z","??0facet@locale@std@@IAE@I@Z","??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ","??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ","??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ","??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ","??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ","??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ","??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ","??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ","??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ","??1_Locinfo@std@@QAE@XZ","??1_Lockit@std@@QAE@XZ","??1facet@locale@std@@MAE@XZ","??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z","??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z","??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z","??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z","??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@","??_7_Facet_base@std@@6B@","??_7facet@locale@std@@6B@","??Bid@locale@std@@QAEIXZ","?_Add_vtordisp1@?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAEXXZ","?_Add_vtordisp1@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ","?_Add_vtordisp1@?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAEXXZ","?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UAEXXZ","?_Add_vtordisp2@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ","?_Add_vtordisp2@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAEXXZ","?_Add_vtordisp2@?$basic_ostream@DU?$char_traits@D@std@@@std@@UAEXXZ","?_BADOFF@std@@3_JB","?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ","?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z","?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z","?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z","?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z","?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ","?_Getfalse@_Locinfo@std@@QBEPBDXZ","?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ","?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ","?_Gettrue@_Locinfo@std@@QBEPBDXZ","?_Incref@facet@locale@std@@UAEXXZ","?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ","?_Init@locale@std@@CAPAV_Locimp@12@_N@Z","?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z","?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ","?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ","?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ","?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ","?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ","?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ","?_Syserror_map@std@@YAPBDH@Z","?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ","?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ","?_Winerror_map@std@@YAPBDH@Z","?_Xbad_alloc@std@@YAXXZ","?_Xlength_error@std@@YAXPBD@Z","?_Xout_of_range@std@@YAXPBD@Z","?always_noconv@codecvt_base@std@@QBE_NXZ","?classic@locale@std@@SAABV12@XZ","?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z","?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A","?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z","?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ","?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ","?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z","?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ","?id@?$codecvt@DDH@std@@2V0locale@2@A","?id@?$ctype@D@std@@2V0locale@2@A","?id@?$numpunct@D@std@@2V0locale@2@A","?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z","?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z","?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z","?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z","?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ","?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z","?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z","?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z","?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z","?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z","?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z","?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z","?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ","?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ","?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ","?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ","?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z","?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z","?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z","?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z","?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ","?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ","?tolower@?$ctype@D@std@@QBEDD@Z","?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ","?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ","?uncaught_exception@std@@YA_NXZ","?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z","?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z","?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z","?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z","?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z","?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z"]},{"module":"MSVCR110.dll","functions":["??0bad_cast@std@@QAE@ABV01@@Z","??0bad_cast@std@@QAE@PBD@Z","??0exception@std@@QAE@ABQBD@Z","??0exception@std@@QAE@ABV01@@Z","??1bad_cast@std@@UAE@XZ","??1exception@std@@UAE@XZ","??1type_info@@UAE@XZ","??2@YAPAXI@Z","??3@YAXPAX@Z","??_U@YAPAXI@Z","??_V@YAXPAX@Z","?terminate@@YAXXZ","?what@exception@std@@UBEPBDXZ","__clean_type_info_names_internal","__CppXcptFilter","__crtTerminateProcess","__crtUnhandledException","__CxxFrameHandler3","__dllonexit","_amsg_exit","_calloc_crt","_crt_debugger_hook","_CxxThrowException","_except_handler4_common","_fseeki64","_getpid","_gmtime32_s","_initterm","_initterm_e","_ismbcspace","_localtime64","_lock","_lock_file","_malloc_crt","_mbsinc","_mbsstr","_onexit","_purecall","_time32","_time64","_unlock","_unlock_file","_vscprintf","_vscwprintf","_wassert","_wtoi","abort","atoi","atol","calloc","fclose","fflush","fgetc","fgetpos","fputc","free","fsetpos","fwrite","ispunct","isspace","malloc","memchr","memcpy","memcpy_s","memmove","memmove_s","memset","realloc","setvbuf","sprintf","strftime","strncpy_s","strnlen","strtok_s","strtol","swprintf_s","tolower","ungetc","vsprintf_s","vswprintf_s","wcsnlen"]},{"module":"ole32.dll","functions":["CoCreateGuid","CoCreateInstance","CoInitializeEx","CoTaskMemFree","CoUninitialize"]},{"module":"SHELL32.dll","functions":["SHCreateDirectoryExW","SHFileOperationW","SHGetFolderPathW"]},{"module":"SHLWAPI.dll","functions":["PathFileExistsW","PathIsDirectoryW"]},{"module":"USER32.dll","functions":["EnumDisplayMonitors","GetMonitorInfoA","GetSystemMetrics"]},{"module":"VERSION.dll","functions":["GetFileVersionInfoSizeW","GetFileVersionInfoW","VerQueryValueW"]}],"file_exports":[{"name":"UTAddToGroup","ordinal":1,"address":"0x10039390"},{"name":"UTAddToSession","ordinal":2,"address":"0x10039280"},{"name":"UTCloseSession","ordinal":3,"address":"0x100393e0"},{"name":"UTGetDemographic","ordinal":4,"address":"0x10039540"},{"name":"UTGetNonDefaultDemographic","ordinal":5,"address":"0x100395d0"},{"name":"UTGetOptIn","ordinal":6,"address":"0x10039420"},{"name":"UTInitialize","ordinal":7,"address":"0x100391d0"},{"name":"UTLogEvent","ordinal":8,"address":"0x100392d0"},{"name":"UTNewDataGroup","ordinal":9,"address":"0x10039330"},{"name":"UTOptInGet","ordinal":10,"address":"0x100394b0"},{"name":"UTOptInSet","ordinal":11,"address":"0x10039500"},{"name":"UTSetDemographic","ordinal":12,"address":"0x10039590"},{"name":"UTSetNonDefaultDemographic","ordinal":13,"address":"0x10039620"},{"name":"UTSetOptIn","ordinal":14,"address":"0x10039470"},{"name":"UTSetSerializationState","ordinal":15,"address":"0x10039670"},{"name":"UTStartSession","ordinal":16,"address":"0x10039220"}]}},{"name":"Acrofx32.dll","file_path":null,"file_size":80057,"md5":"7ed9086d294873aa339bcea51a3b34d9","sha1":"4d34fa689e722ec9b43d3400293b91ce724d799c","sha256":"49824c217e50b00336a59f6ff11ebb306d796076b643473b3384383076d03e63","sha512":"c1711aa6abda4863dbdb20677bbd44518d9a5eb500b09d0a5ac13c2a9e3056a02ff4e3abb36520207f0a818a48d8348b21ee1f6e108d97c2f8c839919bc62ade","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"Acrofx32.dll","size":80057,"description":null,"architecture":"32 Bit","ssdeep":"1536:HaI4NXON6oJW2H02dGSbc+o6sWjcdukfc+Ew:6oN8SVQuD1w","imphash":"f5a69758e4b45135c3fc7a6bec47580d","authentihash":"67eb00b44640db6c547c0118c90c93580806f45f6ee34e97cff14cff84712fb8","entrypoint_bytes":null,"packer":"Borland Delphi 3.0 (???)","version_info":[{"id":"LegalCopyright","value":"Copyright 1984-2016 Adobe Systems Incorporated and its licensors. All rights reserved."},{"id":"FileVersion","value":"15.16.20039.185268"},{"id":"CompanyName","value":"Adobe Systems Incorporated"},{"id":"ProductName","value":"Adobe Acrobat"},{"id":"ProductVersion","value":"15.16.20039.185268"},{"id":"FileDescription","value":"Lotus Notes Field Exchange Module for Adobe Acrobat"},{"id":"OriginalFilename","value":"Acrofx32.dll"},{"id":"Translation","value":"0x0409 0x04e4"}],"file_sections":[{"name":".text","entropy":6.68070757044,"virtual_address":"0x1000","virtual_size":"0xa47c","raw_size":"0xa600","md5":"83e5a167c12399487bbb7c55134400ea"},{"name":".rdata","entropy":4.53293057745,"virtual_address":"0xc000","virtual_size":"0x4862","raw_size":"0x4a00","md5":"20d4566724f7fa80880335d5886de1c6"},{"name":".data","entropy":3.2605757198,"virtual_address":"0x11000","virtual_size":"0x3120","raw_size":"0x1200","md5":"ce322b2087f6127762888f444178b050"},{"name":".rsrc","entropy":3.77921062371,"virtual_address":"0x15000","virtual_size":"0x678","raw_size":"0x800","md5":"b7336d9a3069fac81e78b1a6f6f2ecc1"},{"name":".reloc","entropy":6.3612278797,"virtual_address":"0x16000","virtual_size":"0xcfc","raw_size":"0xe00","md5":"77f158d854f7c028197b4aadea693172"}],"file_imports":[{"module":"KERNEL32.dll","functions":["CloseHandle","CreateFileW","DecodePointer","DeleteCriticalSection","EncodePointer","EnterCriticalSection","ExitProcess","FlushFileBuffers","FreeEnvironmentStringsW","GetACP","GetCommandLineA","GetConsoleCP","GetConsoleMode","GetCPInfo","GetCurrentProcess","GetCurrentProcessId","GetCurrentThreadId","GetEnvironmentStringsW","GetFileType","GetLastError","GetModuleFileNameA","GetModuleFileNameW","GetModuleHandleExW","GetModuleHandleW","GetOEMCP","GetProcAddress","GetProcessHeap","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemTimeAsFileTime","GlobalAlloc","GlobalLock","GlobalUnlock","HeapAlloc","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSectionAndSpinCount","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","LCMapStringW","LeaveCriticalSection","LoadLibraryExW","lstrlenA","MultiByteToWideChar","OutputDebugStringW","QueryPerformanceCounter","RtlUnwind","SetFilePointerEx","SetLastError","SetStdHandle","SetUnhandledExceptionFilter","Sleep","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","WideCharToMultiByte","WriteConsoleW","WriteFile"]},{"module":"nNOTES.dll","functions":[]}],"file_exports":[{"name":"Foo","ordinal":1,"address":"0x10001076"},{"name":"GetNotesNumberField","ordinal":2,"address":"0x10001006"},{"name":"GetNotesStringField","ordinal":3,"address":"0x10001029"},{"name":"NotesCloseDB","ordinal":4,"address":"0x10001066"},{"name":"NotesFriendlyInit","ordinal":5,"address":"0x10001076"},{"name":"NotesFriendlyTerm","ordinal":6,"address":"0x1000108c"},{"name":"NotesGetDBHandle","ordinal":7,"address":"0x10001091"},{"name":"NotesGetNoteHandles","ordinal":8,"address":"0x100010aa"},{"name":"NotesIntfcGetNoteshNote","ordinal":9,"address":"0x100010e2"},{"name":"NotesReopenDB","ordinal":10,"address":"0x10001115"},{"name":"SetNotesNumberField","ordinal":11,"address":"0x10001145"},{"name":"SetNotesStringField","ordinal":12,"address":"0x10001171"}]}},{"name":"notepad.vbs","file_path":null,"file_size":1523,"md5":"48decbd2aceaddc403ee87f633e9677c","sha1":"4ad5658162e90296eb176128cb22c8e163a0b5a5","sha256":"efeec05d1514cf0693da5b419a768852dc708544bc916983006778942b5d9ac7","sha512":"938615a6bc6912ad2c919131c0ea60effbb70b0289ca7417214fafcdbee05d46dd51f340f93e73f28814c2cf4ee46186077032984b1fa0ce8a01e29412be4ff8","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"de_get.svg","file_path":null,"file_size":5731,"md5":"5420e2255f1cfd449e880fa7edd6c9fa","sha1":"5615bdd44c2beea13d394f273f29a2b6b406f381","sha256":"47330d64c4757bff944a898abf3fa1632bf87a8e4f977b306ffe3b7b834990ac","sha512":"a887cf6cd6a1cb44a359097f3e06e6cc775cbe82fcfd2fa0448cfc973704c33d0c207e5e70e82abc237ff0d83f6873626c54246e36743d14a406862e2ec8f354","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"ccme_base_non_fips.dll","file_path":null,"file_size":380929,"md5":"a99192413c5d256f8f895adf90a18e5b","sha1":"cd6e75b2554cc316033950aad91d4b622e8af44a","sha256":"797a53feb666eaf2d6795a3dbc601a07bd2926ba616169d75e4b570c2ddafc32","sha512":"4532e284f14d70e393d1eaf322b1694cefa0e5f7758518833eaaba5d7b159afa4239f1f0e2e35e4ae1584e400395ff8dd4a32b1bb7e0fe865e15764fb1ba5fa8","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"ccme_base_non_fips.dll","size":380929,"description":null,"architecture":"32 Bit","ssdeep":"6144:3U7+tkF0B+4ParvkjoJ39lKLcJaSVCo/HDTg7o8EY70qqDbfvTPCc4pEC:I+tMJ40vtxJandvEgRqffOVEC","imphash":"2ebb4c9fcb3b88c1eaf73b7b808aee79","authentihash":"803dd438ab3032e8e5477223ba27cff2f3949b4c75d441f3a65b84b7583d8c5b","entrypoint_bytes":null,"packer":"Borland Delphi 3.0 (???)","version_info":[{"id":"LegalCopyright","value":"Copyright 2011 by RSA Security Inc. All rights reserved."},{"id":"InternalName","value":"ccme_base_non_fips"},{"id":"FileVersion","value":"4.1.2.0"},{"id":"CompanyName","value":"RSA - The Security Division of EMC"},{"id":"ProductName","value":"RSA BSAFE Crypto-C ME"},{"id":"ProductVersion","value":"4.1.2.0"},{"id":"FileDescription","value":"{TARGETDESC}"},{"id":"OriginalFilename","value":"ccme_base_non_fips"},{"id":"Translation","value":"0x0409 0x04e4"}],"file_sections":[{"name":".text","entropy":6.55457433003,"virtual_address":"0x1000","virtual_size":"0x42a4a","raw_size":"0x42c00","md5":"051e00efebaeb6aab44bf171b298681b"},{"name":".rdata","entropy":5.58495468146,"virtual_address":"0x44000","virtual_size":"0x11b48","raw_size":"0x11c00","md5":"83ef99db37489fa4c3b25321a27e59f3"},{"name":".data","entropy":6.13766803991,"virtual_address":"0x56000","virtual_size":"0x420c","raw_size":"0x3e00","md5":"fa074e4ebb39fd52a6e6e0de0781f1a0"},{"name":".rsrc","entropy":3.2000593042,"virtual_address":"0x5b000","virtual_size":"0x3c8","raw_size":"0x400","md5":"2d8383952e4aabe79943ef37c597b69e"},{"name":".reloc","entropy":6.63841661342,"virtual_address":"0x5c000","virtual_size":"0x3c1c","raw_size":"0x3e00","md5":"0c3f261a253670c9afa6a213a372e0c0"}],"file_imports":[{"module":"KERNEL32.dll","functions":["DecodePointer","DisableThreadLibraryCalls","EncodePointer","GetCurrentProcessId","GetCurrentThreadId","GetSystemTimeAsFileTime","IsDebuggerPresent","IsProcessorFeaturePresent","QueryPerformanceCounter"]},{"module":"MSVCR120.dll","functions":["__clean_type_info_names_internal","__CppXcptFilter","__crtTerminateProcess","__crtUnhandledException","__dllonexit","_amsg_exit","_calloc_crt","_crt_debugger_hook","_difftime64","_except_handler4_common","_initterm","_initterm_e","_lock","_malloc_crt","_onexit","_stat64i32","_time64","_unlock","fclose","fopen","fread","free","memcpy","memcpy_s","memmove","memmove_s","memset","rand","srand"]}],"file_exports":[{"name":"R_FIPS_MODULE_resource","ordinal":1,"address":"0x10001000"}]}},{"name":"Worksheet.xls","file_path":null,"file_size":13859,"md5":"26625db9cb0d04ff73a153b5bd05b84d","sha1":"bdc15e69421c8e91c257869455258abf29ca5e21","sha256":"9529d7f1de038e7c565ae03c088bfff39faf1a7aad45caf64a09e0e33c8fccfd","sha512":"2fb858c4fd7672d2b768036b68c20c853a3c50d8fb942029d851f5a2add9866b931887d25dd19523cd9a70563d29bd83a11ac4efda6f35c9c4f7c3bb8ef21ab3","type_tags":["data"],"description":"data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"Eula.exe","file_path":null,"file_size":87121,"md5":"2e35f1fb0c6fbacab95b1d5a4649ea3d","sha1":"a89a62a1cbfa586f244c006b84fcd78da9a7cdc2","sha256":"809bec1b7272ef8d77216b4804e53a09bdecb96e33b701521f0c1a87b9f9492f","sha512":"1f8b6b3be493fafb0b96b7488bb64da6f0ebaad8649f6956ac872f84d2cee0abaef18aaaf9e9ba05f6c49b1228390f3025f33cd6a45af8ef62768f25d5138c11","type_tags":["peexe","executable"],"description":"PE32 executable (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"Eula.exe","size":87121,"description":null,"architecture":"32 Bit","ssdeep":"1536:L/ucYYEbptHwIToBaALeq9p/qqqEHk9JIx40zrdp9+4owckM3KyjO9zVIbF/AhD+:j7YYEbptQMMLeL4H4JItzrdp9jc5KiC6","imphash":"5816ad39efdb22916b53c6d1be6b2511","authentihash":"e82092ccd48814fcfb0003b98005c3634c81f3120f50afe00dad48473f429f39","entrypoint_bytes":null,"packer":"VC8 -> Microsoft Corporation","version_info":[{"id":"LegalCopyright","value":"Copyright 2010-2017 Adobe Systems Incorporated. All rights reserved."},{"id":"InternalName","value":"Eula.exe"},{"id":"FileVersion","value":"15.23.20053.211670"},{"id":"CompanyName","value":"Adobe Systems Incorporated"},{"id":"ProductName","value":"EULA"},{"id":"ProductVersion","value":"15.23.20053.211670"},{"id":"FileDescription","value":"Eula display"},{"id":"OriginalFilename","value":"Eula.exe"},{"id":"Translation","value":"0x0409 0x04e4"}],"file_sections":[{"name":".text","entropy":6.36352556315,"virtual_address":"0x1000","virtual_size":"0xac31","raw_size":"0xae00","md5":"bf1a694125b945dad2460eb36041bc51"},{"name":".rdata","entropy":4.5624463216,"virtual_address":"0xc000","virtual_size":"0x4676","raw_size":"0x4800","md5":"2fd32ae242735175415bc4cfc2203fa1"},{"name":".data","entropy":4.83375286978,"virtual_address":"0x11000","virtual_size":"0x167c","raw_size":"0x1200","md5":"6c26ce401f783fe612afea9689b4a890"},{"name":".rsrc","entropy":3.60115556365,"virtual_address":"0x13000","virtual_size":"0x1318","raw_size":"0x1400","md5":"af1ae42bc7a0c835e5699fa7550093d6"},{"name":".reloc","entropy":6.48383786725,"virtual_address":"0x15000","virtual_size":"0x1340","raw_size":"0x1400","md5":"49c9574fec27752d0e8d63963702179f"}],"file_imports":[{"module":"ADVAPI32.dll","functions":["RegCloseKey","RegCreateKeyExW","RegSetValueExW"]},{"module":"GDI32.dll","functions":["BitBlt","CreateCompatibleBitmap","CreateCompatibleDC","CreateSolidBrush","DeleteDC","DeleteObject","GetDeviceCaps","GetObjectW","GetStockObject","SelectObject"]},{"module":"KERNEL32.dll","functions":["CopyFileW","DecodePointer","DeleteCriticalSection","EncodePointer","EnterCriticalSection","FindClose","FindFirstFileW","FindResourceW","FlushInstructionCache","GetCurrentProcess","GetCurrentProcessId","GetCurrentThreadId","GetFullPathNameW","GetLastError","GetModuleFileNameW","GetModuleHandleA","GetModuleHandleW","GetPrivateProfileIntW","GetPrivateProfileStringW","GetProcAddress","GetProcessHeap","GetSystemTimeAsFileTime","GlobalAlloc","GlobalFree","GlobalHandle","GlobalLock","GlobalUnlock","HeapAlloc","HeapFree","InitializeCriticalSectionAndSpinCount","InitializeSListHead","InterlockedPopEntrySList","InterlockedPushEntrySList","IsDebuggerPresent","IsProcessorFeaturePresent","LeaveCriticalSection","LoadLibraryA","LoadLibraryW","LoadResource","LockResource","lstrcatW","lstrcmpW","lstrcpynW","lstrcpyW","lstrlenW","MulDiv","MultiByteToWideChar","OutputDebugStringA","OutputDebugStringW","QueryPerformanceCounter","RaiseException","SetLastError","VirtualAlloc","VirtualFree"]},{"module":"MSVCR120.dll","functions":["??1type_info@@UAE@XZ","??2@YAPAXI@Z","??3@YAXPAX@Z","??_U@YAPAXI@Z","??_V@YAXPAX@Z","?terminate@@YAXXZ","__crtGetShowWindowMode","__crtSetUnhandledExceptionFilter","__crtTerminateProcess","__crtUnhandledException","__CxxFrameHandler3","__dllonexit","__set_app_type","__setusermatherr","__wgetmainargs","_amsg_exit","_calloc_crt","_cexit","_commode","_configthreadlocale","_controlfp_s","_crt_debugger_hook","_CxxThrowException","_except_handler4_common","_exit","_fmode","_initterm","_initterm_e","_invoke_watson","_lock","_onexit","_recalloc","_unlock","_wcmdln","_wtoi","_wtoi64","_XcptFilter","calloc","exit","free","malloc","memcmp","memcpy_s","memset","strlen","swprintf_s","wcscpy_s","wcscspn","wcslen","wcsncpy_s"]},{"module":"ole32.dll","functions":["CLSIDFromProgID","CLSIDFromString","CoAddRefServerProcess","CoCreateInstance","CoGetClassObject","CoReleaseServerProcess","CoTaskMemAlloc","CoTaskMemFree","CreateStreamOnHGlobal","OleInitialize","OleLockRunning","OleUninitialize","StringFromGUID2"]},{"module":"OLEAUT32.dll","functions":["DispCallFunc","LoadRegTypeLib","LoadTypeLib","OleCreateFontIndirect","SysAllocString","SysAllocStringLen","SysFreeString","SysStringLen","VariantClear","VariantInit"]},{"module":"USER32.dll","functions":["BeginPaint","CallWindowProcW","CharNextW","ClientToScreen","CreateAcceleratorTableW","CreateWindowExW","DefWindowProcW","DestroyAcceleratorTable","DestroyWindow","DialogBoxIndirectParamW","EnableWindow","EndDialog","EndPaint","FillRect","GetActiveWindow","GetClassInfoExW","GetClassNameW","GetClientRect","GetDC","GetDesktopWindow","GetDlgItem","GetDlgItemTextW","GetFocus","GetParent","GetSysColor","GetSystemMetrics","GetWindow","GetWindowLongW","GetWindowTextLengthW","GetWindowTextW","InvalidateRect","InvalidateRgn","IsChild","IsWindow","IsWindowEnabled","LoadCursorW","MapDialogRect","MoveWindow","RedrawWindow","RegisterClassExW","RegisterWindowMessageW","ReleaseCapture","ReleaseDC","ScreenToClient","SendDlgItemMessageW","SendMessageW","SetCapture","SetDlgItemTextW","SetFocus","SetWindowContextHelpId","SetWindowLongW","SetWindowPos","SetWindowTextW","UnregisterClassW"]}],"file_exports":[]}},{"name":"AutoItX.chm","file_path":null,"file_size":207301,"md5":"1a2de252f3a17a8c9170df5fafc0fd44","sha1":"c3389bd3ccf6a35e51a6734a8742ca1e7be480d6","sha256":"6eb8f01fe6f9307b1b9ba5c0877bf90c4b9785658ffbd3e94a8e5591d09f229c","sha512":"aafbbd8532233ecd44ea1c78a4f482f19e2804e667b024397796a3e764cbd70eb80922135f76ab6c216bda8ed284a371bb266d78f2b98cb31fae32745e8712af","type_tags":["text","mshelp"],"description":"MS Windows HtmlHelp Data","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"arh.exe","file_path":null,"file_size":87713,"md5":"51f855715295232a9e36139eb281e847","sha1":"4af3eae5ad6c16eb64f331249231c998b3cecccc","sha256":"a538cf9b30dc5d366bc960a6e92cf2f2e7fb1f51f92e0f18c7fb6d9357bb0c65","sha512":"af06e24294ccaf1ec20f914f6e87d6ba6b741d423fcaf574a2130474820c1694adbed97dd38d5521a479df56c04b28d7dc6fc4419637f3fe3db8558810867994","type_tags":["peexe","executable"],"description":"PE32 executable (console) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"arh.exe","size":87713,"description":null,"architecture":"32 Bit","ssdeep":"1536:qWjrXDyO4zkm8dbHVLokF8iJTwRH0IM2D57Kykf8d/R8Tyr5J5is7Mp:qKrMzkm8PL3E7Qw/STyr5Jks7Mp","imphash":"085b8a5d9e723b8ba9982a936ce1c779","authentihash":"f3b0e252625615e781617b219229e46695a6d2f8879013b82e4b0e49680abe13","entrypoint_bytes":null,"packer":"VC8 -> Microsoft Corporation","version_info":[{"id":"LegalCopyright","value":"Copyright 2012, Adobe Systems Inc."},{"id":"InternalName","value":"arh.exe"},{"id":"FileVersion","value":"3.5.0.0"},{"id":"CompanyName","value":"Adobe Systems Inc."},{"id":"ProductName","value":"Adobe AIR"},{"id":"ProductVersion","value":"3.5"},{"id":"FileDescription","value":"Adobe AIR Redistribution Helper"},{"id":"OriginalFilename","value":"arh.exe"},{"id":"Translation","value":"0x0409 0x04b0"}],"file_sections":[{"name":".text","entropy":6.51295212458,"virtual_address":"0x1000","virtual_size":"0xce29","raw_size":"0xd000","md5":"4daa39d9886367f120ef99196624dd86"},{"name":".rdata","entropy":5.34663740611,"virtual_address":"0xe000","virtual_size":"0x3776","raw_size":"0x3800","md5":"8cf60ffda618ab7b4db1326ad4df73b1"},{"name":".data","entropy":2.38597171525,"virtual_address":"0x12000","virtual_size":"0x2d24","raw_size":"0x1000","md5":"200276f279210dec423b4d75c4d02560"},{"name":".rsrc","entropy":4.50481039574,"virtual_address":"0x15000","virtual_size":"0x4f0","raw_size":"0x600","md5":"c5e2007c37ffa663f97c4f23f337f2bb"},{"name":".reloc","entropy":4.00963285254,"virtual_address":"0x16000","virtual_size":"0x1768","raw_size":"0x1800","md5":"3f1bf9d9187de4bb4a263b3783acea82"}],"file_imports":[{"module":"ADVAPI32.dll","functions":["CryptAcquireContextW","CryptCreateHash","CryptDestroyHash","CryptGetHashParam","CryptHashData","CryptReleaseContext","RegCloseKey","RegOpenKeyExW","RegQueryValueExW"]},{"module":"KERNEL32.dll","functions":["CloseHandle","CreateFileA","CreateProcessW","DeleteCriticalSection","EnterCriticalSection","ExitProcess","FlushFileBuffers","FreeEnvironmentStringsW","GetACP","GetCommandLineW","GetConsoleCP","GetConsoleMode","GetConsoleOutputCP","GetCPInfo","GetCurrentProcess","GetCurrentProcessId","GetCurrentThreadId","GetEnvironmentStringsW","GetExitCodeProcess","GetFileType","GetLastError","GetLocaleInfoA","GetModuleFileNameA","GetModuleFileNameW","GetModuleHandleW","GetOEMCP","GetProcAddress","GetProcessHeap","GetStartupInfoA","GetStdHandle","GetStringTypeA","GetStringTypeW","GetSystemTimeAsFileTime","GetTickCount","HeapAlloc","HeapCreate","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSection","InitializeCriticalSectionAndSpinCount","InterlockedDecrement","InterlockedIncrement","IsDebuggerPresent","IsValidCodePage","LCMapStringA","LCMapStringW","LeaveCriticalSection","LoadLibraryA","LoadLibraryW","LocalFree","MultiByteToWideChar","QueryPerformanceCounter","RaiseException","RtlUnwind","SetFilePointer","SetHandleCount","SetLastError","SetStdHandle","SetUnhandledExceptionFilter","Sleep","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","VirtualAlloc","VirtualFree","WaitForSingleObject","WideCharToMultiByte","WriteConsoleA","WriteConsoleW","WriteFile"]},{"module":"msi.dll","functions":[]},{"module":"SHLWAPI.dll","functions":["PathAppendA","PathAppendW","PathRemoveFileSpecW","StrChrA","StrDupW"]},{"module":"VERSION.dll","functions":["GetFileVersionInfoSizeW","GetFileVersionInfoW","VerQueryValueW"]}],"file_exports":[]}},{"name":"ccme_asym.dll","file_path":null,"file_size":218625,"md5":"254db9a7cd69b29d1057eea3db2294c7","sha1":"14801f41cbd02d8a28f0f98c70c9b1bb9543c0f1","sha256":"d4eac88cb3e29106e63e9834d1bf6597cf1ed82087b10742994465f773ec442f","sha512":"ab8b7da6b21bb8202bd5f2a7017c9c40e7b22f1047b17b394e6cd2c3750cf5c6fec699b1e941d97fb9061445a2063cce36137e3f4c685590f4d009d2d1b8e6ba","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"ccme_asym.dll","size":218625,"description":null,"architecture":"32 Bit","ssdeep":"6144:KJAmFBo2hwfl9OMi35T+xxsak4RkcFW4zbl4X:KJAmFKXlXnxxXRVw4zmX","imphash":"c149ef9dda806db148db7eca1215a082","authentihash":"4ef24c0139828fec828fbc09551d9289f592163e3b7247de60c34acdbaa013fb","entrypoint_bytes":null,"packer":"Borland Delphi 3.0 (???)","version_info":[{"id":"LegalCopyright","value":"Copyright 2011 by RSA Security Inc. All rights reserved."},{"id":"InternalName","value":"ccme_asym"},{"id":"FileVersion","value":"4.1.2.0"},{"id":"CompanyName","value":"RSA - The Security Division of EMC"},{"id":"ProductName","value":"RSA BSAFE Crypto-C ME"},{"id":"ProductVersion","value":"4.1.2.0"},{"id":"FileDescription","value":"{TARGETDESC}"},{"id":"OriginalFilename","value":"ccme_asym"},{"id":"Translation","value":"0x0409 0x04e4"}],"file_sections":[{"name":".text","entropy":6.30444328856,"virtual_address":"0x1000","virtual_size":"0x2b41a","raw_size":"0x2b600","md5":"c11bf570503c42c7b74a0a72c67b971f"},{"name":".rdata","entropy":5.47306112403,"virtual_address":"0x2d000","virtual_size":"0x49a4","raw_size":"0x4a00","md5":"d49c44595d0a78ed03b4b4994aacefa4"},{"name":".data","entropy":6.30171096478,"virtual_address":"0x32000","virtual_size":"0x354c","raw_size":"0x3200","md5":"5c50e62bd17b4199d1be7b30d1eb4c1a"},{"name":"_RDATA","entropy":1.01668664257,"virtual_address":"0x36000","virtual_size":"0x68","raw_size":"0x200","md5":"258a115fc408cc760d20d273e3e3b36c"},{"name":"_DATA1","entropy":0.681890269912,"virtual_address":"0x37000","virtual_size":"0x2d","raw_size":"0x200","md5":"1dcacc8dad2dc940cd46ed4712696900"},{"name":".rsrc","entropy":3.09799971478,"virtual_address":"0x38000","virtual_size":"0x3a0","raw_size":"0x400","md5":"93a68131951e92f7ac0c17f1a4321ef8"},{"name":".reloc","entropy":6.09986000969,"virtual_address":"0x39000","virtual_size":"0x1330","raw_size":"0x1400","md5":"a99c00ef5e95e00b5c12742fe2708743"}],"file_imports":[{"module":"KERNEL32.dll","functions":["DecodePointer","DisableThreadLibraryCalls","EncodePointer","GetCurrentProcessId","GetCurrentThreadId","GetSystemTimeAsFileTime","IsDebuggerPresent","IsProcessorFeaturePresent","QueryPerformanceCounter"]},{"module":"MSVCR120.dll","functions":["__clean_type_info_names_internal","__CppXcptFilter","__crtTerminateProcess","__crtUnhandledException","__dllonexit","_amsg_exit","_calloc_crt","_crt_debugger_hook","_except_handler4_common","_initterm","_initterm_e","_lock","_malloc_crt","_onexit","_unlock","free","memcpy_s","memset"]}],"file_exports":[{"name":"R_FIPS_MODULE_resource","ordinal":1,"address":"0x10001000"}]}},{"name":"d3dcompiler_43.dll","file_path":null,"file_size":2107241,"md5":"c1f2301e1f43cac3af0c7dc34ccd259f","sha1":"940e5e2a8264f42573144cb7ca4412c30bbce514","sha256":"0e514dd078200006d1143c2129ca8b744c13c7ca77540964e05cb2eecd8f78cc","sha512":"78966d5db47cc3ff2418272b96aa26744284522154ebe383db237b14ca6d5269ee7e92a6a218e69bf3870bb26c30a8fecdf8d232b0ec921b6303e693638762e6","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (console) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"Au3Check.exe","file_path":null,"file_size":196929,"md5":"872c32449ab9b760a75b7b0d1e5b21e5","sha1":"1930aff27da108d8932dc43d2af737e4437083af","sha256":"c7abcf40241d5ff355dd0636f15202390218b8b17068b9dcd2b5510c923b007f","sha512":"28f4ed51d02070293b2ddd7e38f7487a569f4f677151341f21f3947ff41f48f036c57425846ff00594b6c4db3f9f2e8ff77a5fd4cc98c0ba19adf245193185f1","type_tags":["peexe","executable"],"description":"PE32 executable (console) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"Au3Check.exe","size":196929,"description":null,"architecture":"32 Bit","ssdeep":"3072:r7rBRAAV8Y/OiDz70CpzjBiXCPVdwQWEtP+N+WYPwmnDx5T4XTbCAqfTGbM:nrvAU/H0CxjBxFPQ8TjRAY","imphash":"e4318fe059493b307c8841deafc806a6","authentihash":"e5a1b37486801391b961e60e104fdc58e6b6ad1721adef92477d288640342ab0","entrypoint_bytes":null,"packer":"VC8 -> Microsoft Corporation","version_info":[{"id":"LegalCopyright","value":"1999-2015 Jonathan Bennett & AutoIt Team"},{"id":"InternalName","value":"Au3Check.exe"},{"id":"FileVersion","value":"3.3.14.2"},{"id":"CompanyName","value":"Tylo (modified by Jos)"},{"id":"Comments","value":"Program that checks the syntax of AutoIt v3 scripts"},{"id":"ProductName","value":"AutoIt3 Syntax checker"},{"id":"ProductVersion","value":"3.3.14.2"},{"id":"FileDescription","value":"Au3Check"},{"id":"OriginalFilename","value":"Au3Check.exe"},{"id":"Translation","value":"0x0409 0x04b0"}],"file_sections":[{"name":".text","entropy":6.67008682354,"virtual_address":"0x1000","virtual_size":"0x19a1e","raw_size":"0x19c00","md5":"a064ec9318b122ae415721ad507f1873"},{"name":".rdata","entropy":4.7435611657,"virtual_address":"0x1b000","virtual_size":"0x1295a","raw_size":"0x12a00","md5":"5d2c97b98e8418eb42333a8cab7ad6e8"},{"name":".data","entropy":3.47393784204,"virtual_address":"0x2e000","virtual_size":"0x8cb68","raw_size":"0x1600","md5":"87fd4d4dbf9a50af14a86ce647066cba"},{"name":".rsrc","entropy":4.04205441302,"virtual_address":"0xbb000","virtual_size":"0x5c0","raw_size":"0x600","md5":"1071d37b9ff30f9d2964f16a0863cee0"}],"file_imports":[{"module":"ADVAPI32.dll","functions":["RegCloseKey","RegOpenKeyExA","RegQueryValueExA"]},{"module":"KERNEL32.dll","functions":["AreFileApisANSI","CloseHandle","CreateFileW","DecodePointer","DeleteCriticalSection","EncodePointer","EnterCriticalSection","ExitProcess","FlushFileBuffers","FreeEnvironmentStringsW","GetACP","GetCommandLineA","GetConsoleCP","GetConsoleMode","GetCPInfo","GetCurrentProcess","GetCurrentProcessId","GetCurrentThreadId","GetEnvironmentStringsW","GetFileType","GetFullPathNameA","GetLastError","GetModuleFileNameA","GetModuleFileNameW","GetModuleHandleExW","GetModuleHandleW","GetOEMCP","GetProcAddress","GetProcessHeap","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemTimeAsFileTime","HeapAlloc","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSectionAndSpinCount","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","LCMapStringW","LeaveCriticalSection","LoadLibraryExW","MultiByteToWideChar","OutputDebugStringW","QueryPerformanceCounter","RaiseException","ReadConsoleW","ReadFile","RtlUnwind","SetEndOfFile","SetFilePointerEx","SetLastError","SetStdHandle","SetUnhandledExceptionFilter","Sleep","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","WideCharToMultiByte","WriteConsoleW","WriteFile"]}],"file_exports":[]}},{"name":"wow_helper.exe","file_path":null,"file_size":117945,"md5":"f5d557fee8ae8a293193107d8c8c838a","sha1":"debd0467e3a013af5d342735fbd848a68184d60f","sha256":"f77418d7723f2a079f39d3ddda0304c4ce2492815786efba3becc2ecd48fb281","sha512":"0a9713893d59e22537243615863eac3ff93554724d5bce487c3e6484139c012824296772a4328206717b28be85c36afc3f70512cf4340e78bf4b196abf14c395","type_tags":["peexe","64bits","executable"],"description":"PE32+ executable (GUI) x86-64, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"wow_helper.exe","size":117945,"description":null,"architecture":"64 Bit","ssdeep":"3072:pAHaqQzTh+Ej7EZnD3XpTeCZbZvk+46eyemcr3is:pihQzTwcYHdeC0qef7ys","imphash":"19d5fde8be25751c7946eb965b6f6eee","authentihash":"47f913b88ae39bb3b784918a9daa4e44bfbccdbc862714424dac80f0b9c2fe8f","entrypoint_bytes":null,"packer":null,"version_info":[{"id":"LegalCopyright","value":"Copyright 2010-2016 Adobe Systems Incorporated and its licensors. All rights reserved."},{"id":"InternalName","value":"wow_helper.exe"},{"id":"FileVersion","value":"15.16.20039.185268"},{"id":"CompanyName","value":"Adobe Systems, Inc"},{"id":"ProductName","value":"Adobe Reader WOW Helper"},{"id":"ProductVersion","value":"15.16.20039.185268"},{"id":"FileDescription","value":"Adobe Reader WOW Helper"},{"id":"OriginalFilename","value":"wow_helper.exe"},{"id":"Translation","value":"0x0409 0x04e4"}],"file_sections":[{"name":".text","entropy":6.43485739679,"virtual_address":"0x1000","virtual_size":"0xe0ef","raw_size":"0xe200","md5":"5ae3c3315fc9158895b7c6e7e8b66141"},{"name":".rdata","entropy":4.09308594721,"virtual_address":"0x10000","virtual_size":"0x90ea","raw_size":"0x9200","md5":"09565f91760d53b3a82a3fec7c8083ee"},{"name":".data","entropy":3.16254150635,"virtual_address":"0x1a000","virtual_size":"0x3f78","raw_size":"0x1a00","md5":"2df9d981c249629f1b344b6f4af0c1fa"},{"name":".pdata","entropy":4.59100680325,"virtual_address":"0x1e000","virtual_size":"0xce4","raw_size":"0xe00","md5":"0fbffc1962a262e356e10199b11530f8"},{"name":".rsrc","entropy":4.12854356399,"virtual_address":"0x1f000","virtual_size":"0x5e0","raw_size":"0x600","md5":"53a2d8af722602d486bc1f6a665e5828"},{"name":".reloc","entropy":4.94099066987,"virtual_address":"0x20000","virtual_size":"0x80c","raw_size":"0xa00","md5":"cb72e1352c7e7fc007daaa9b3c31225b"}],"file_imports":[{"module":"KERNEL32.dll","functions":["CloseHandle","CreateFileW","DecodePointer","DeleteCriticalSection","EncodePointer","EnterCriticalSection","ExitProcess","FlushFileBuffers","FreeEnvironmentStringsW","GetACP","GetCommandLineW","GetConsoleCP","GetConsoleMode","GetCPInfo","GetCurrentProcess","GetCurrentProcessId","GetCurrentThreadId","GetEnvironmentStringsW","GetFileType","GetLastError","GetModuleFileNameW","GetModuleHandleExW","GetModuleHandleW","GetOEMCP","GetProcAddress","GetProcessHeap","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemTimeAsFileTime","HeapAlloc","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSectionAndSpinCount","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","LCMapStringW","LeaveCriticalSection","LoadLibraryExW","MultiByteToWideChar","OpenProcess","OutputDebugStringW","QueryPerformanceCounter","RaiseException","ReadProcessMemory","RtlCaptureContext","RtlLookupFunctionEntry","RtlPcToFileHeader","RtlUnwindEx","RtlVirtualUnwind","SetFilePointerEx","SetLastError","SetStdHandle","SetUnhandledExceptionFilter","Sleep","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","VirtualProtectEx","WideCharToMultiByte","WriteConsoleW","WriteFile","WriteProcessMemory"]}],"file_exports":[]}},{"name":"BIB.dll","file_path":null,"file_size":120305,"md5":"f71b219379247f04b0690ed1f129220c","sha1":"4d7a9ac1be59ad6c74e770013ead667fc54f3777","sha256":"1ff0746a4f8c08ab8352ce44d7293f03a17a5ad63fd6714d5e963863752d3d76","sha512":"8e6feb78f15f0aea4f6462c74ab7e33598a7fa03698ea60687843d0f4d5ba69d2e26d44744f6776e83f48102c66b5d2322fff84b67bdffbca3ecf5cb6b327e24","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"BIB.dll","size":120305,"description":null,"architecture":"32 Bit","ssdeep":"3072:SL/tNyJoC/WbcPTCclAZrpIGFUbfPI90EZrZyibdutKr5igRs+pl31ClCELk:E/V1QCclAZFUbnE1ClRI","imphash":"4edcd6d6106398ed32511bf5ba5471b5","authentihash":"03799f78e64b064b151d7b219215a0263704bd3870eb8b01f713f8473251f0ef","entrypoint_bytes":null,"packer":"Borland Delphi 3.0 (???)","version_info":[{"id":"LegalCopyright","value":"1995-2009 Adobe Systems Incorporated"},{"id":"BuildType","value":"Release CRTMTDLL"},{"id":"InternalName","value":"BIB"},{"id":"FileVersion","value":"1.2.10.1"},{"id":"CompanyName","value":"Adobe Systems Incorporated"},{"id":"BuildVersion","value":"84.584320"},{"id":"BinType","value":"32"},{"id":"ProductName","value":"BIB 2017/06/30-02:37:58"},{"id":"BuildID","value":"1"},{"id":"ProductVersion","value":"84.584320"},{"id":"FileDescription","value":"Bravo Interface Binder"},{"id":"OriginalFilename","value":"BIB.dll"},{"id":"BuildDate","value":"2017/06/30-02:37:58"},{"id":"Translation","value":"0x0800 0x04b0"}],"file_sections":[{"name":".text","entropy":6.41651953227,"virtual_address":"0x1000","virtual_size":"0x104c0","raw_size":"0x10600","md5":"91814afe58a8caa833a5b70777bfcbbf"},{"name":".rdata","entropy":4.41820166019,"virtual_address":"0x12000","virtual_size":"0x76f6","raw_size":"0x7800","md5":"9fc8af8a8ee461d9e470d620ccef42ae"},{"name":".data","entropy":4.32973810019,"virtual_address":"0x1a000","virtual_size":"0xf04","raw_size":"0xa00","md5":"71441ab5c40b59ca3ec1c71e44ed3d4a"},{"name":".rsrc","entropy":3.41650708502,"virtual_address":"0x1b000","virtual_size":"0x630","raw_size":"0x800","md5":"069ed3612a69d3fb96f59ac6fc539b85"},{"name":".reloc","entropy":6.62332958365,"virtual_address":"0x1c000","virtual_size":"0x1f2c","raw_size":"0x2000","md5":"eec4bca781b160e179d77435b052a778"}],"file_imports":[{"module":"KERNEL32.dll","functions":["CloseHandle","CreateEventA","CreateThread","DecodePointer","DeleteCriticalSection","EncodePointer","EnterCriticalSection","GetCurrentDirectoryA","GetCurrentProcessId","GetCurrentThreadId","GetModuleHandleA","GetProcAddress","GetSystemTimeAsFileTime","InitializeCriticalSection","IsDebuggerPresent","IsProcessorFeaturePresent","LeaveCriticalSection","QueryPerformanceCounter","ResetEvent","SetCurrentDirectoryA","SetEvent","Sleep","SwitchToThread","WaitForSingleObject"]},{"module":"MSVCR120.dll","functions":["??1type_info@@UAE@XZ","??3@YAXPAX@Z","?terminate@@YAXXZ","__clean_type_info_names_internal","__CppXcptFilter","__crtTerminateProcess","__crtUnhandledException","__CxxFrameHandler3","__dllonexit","__RTDynamicCast","_amsg_exit","_calloc_crt","_crt_debugger_hook","_CxxThrowException","_except1","_except_handler4_common","_hypot","_i64toa_s","_i64tow_s","_initterm","_initterm_e","_itoa_s","_itow_s","_lock","_ltoa_s","_ltow_s","_makepath_s","_malloc_crt","_onexit","_purecall","_splitpath_s","_ui64toa_s","_ui64tow_s","_ultoa_s","_ultow_s","_unlock","_vsnprintf_s","fclose","feof","ferror","fflush","fopen","fread","free","fseek","ftell","fwrite","gets_s","log","malloc","memcpy_s","memmove_s","memset","qsort","strcmp","strlen","strtok_s","vprintf_s","vsprintf_s","vwprintf_s"]}],"file_exports":[{"name":"BIBGetVersion","ordinal":2,"address":"0x700b43f"},{"name":"BIBInitialize","ordinal":3,"address":"0x700b445"},{"name":"BIBTerminate","ordinal":4,"address":"0x7007544"},{"name":"BIBGetGetProcAddress","ordinal":5,"address":"0x70052b6"},{"name":"BIBInitialize2","ordinal":6,"address":"0x700b465"},{"name":"BIBLockSmithLockImpl","ordinal":7,"address":"0x700b4b4"},{"name":"BIBLockSmithUnlockImpl","ordinal":8,"address":"0x700b4b7"},{"name":"BIBLockSmithDeleteImpl","ordinal":9,"address":"0x700b4b3"},{"name":"BIBLockSmithAssertNoLocksImpl","ordinal":10,"address":"0x700b4b2"},{"name":"BIBInitialize3","ordinal":11,"address":"0x700b489"},{"name":"BIBInitialize4","ordinal":12,"address":"0x700173e"}]}},{"name":"AutoItX3.dll","file_path":null,"file_size":457033,"md5":"688ad05f7909c56ed02be0da39dae465","sha1":"d0fef1b2fe60f0d5e4228edc93ce70395580a049","sha256":"7a283a67cea12b1f8bf0d092945885bf06a09aae3d5d949b9f227acbb30a23b4","sha512":"2096035ce1ad64666c03ae132d5c750de2e6eda592d033d06113381050a37dd9d5eaeae73e84c45560bea8fb83f71893bc76783794d3e603cbed4e2184378731","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"AutoItX3.dll","size":457033,"description":null,"architecture":"32 Bit","ssdeep":"6144:70SnA0DIfodhgBziJFx6efZbZi6z6L9RW8zAOe+Hoa596KR:70P0DIfodaB6yeRZX6fW8z5HoaHR","imphash":"2de8719ca2500f1feedfbadd841c0daf","authentihash":"1a1b930a8c093e294be5f6fae15f7fa23eadf33dde37dac7797143fce0b1aecd","entrypoint_bytes":null,"packer":"Borland Delphi 3.0 (???)","version_info":[{"id":"LegalCopyright","value":"1999-2015 Jonathan Bennett & AutoIt Team"},{"id":"InternalName","value":"AutoItX3.dll"},{"id":"FileVersion","value":"3, 3, 14, 2"},{"id":"CompanyName","value":"AutoIt Team"},{"id":"Comments","value":"http://www.autoitscript.com/autoit3/"},{"id":"ProductName","value":"AutoIt v3 ActiveX Control"},{"id":"ProductVersion","value":"3, 3, 14, 2"},{"id":"FileDescription","value":"AutoIt v3 ActiveX Control"},{"id":"OriginalFilename","value":"AutoItX3.dll"},{"id":"Translation","value":"0x0809 0x04b0"}],"file_sections":[{"name":".text","entropy":6.67992774164,"virtual_address":"0x1000","virtual_size":"0x41ed6","raw_size":"0x42000","md5":"640385a01c4ad186a52dc29d9161ecf8"},{"name":".orpc","entropy":0.917834523523,"virtual_address":"0x43000","virtual_size":"0x34","raw_size":"0x200","md5":"0265a738ef070597f48e81a29c56429a"},{"name":".rdata","entropy":5.54305742525,"virtual_address":"0x44000","virtual_size":"0x21b54","raw_size":"0x21c00","md5":"e8cff6ad38b9a7572ae1a4ab7dfba67a"},{"name":".data","entropy":4.0853054118,"virtual_address":"0x66000","virtual_size":"0x3e80","raw_size":"0x1e00","md5":"da91fe46336464f74cfe15f24e33318b"},{"name":".rsrc","entropy":4.70335489348,"virtual_address":"0x6a000","virtual_size":"0x4c70","raw_size":"0x4e00","md5":"e0b428420c7e59f921bb4ebe72f0d406"},{"name":".reloc","entropy":6.66542138555,"virtual_address":"0x6f000","virtual_size":"0x2f28","raw_size":"0x3000","md5":"265b71c8ae18275efb37138d1e3203dd"}],"file_imports":[{"module":"ADVAPI32.dll","functions":["AddAce","AdjustTokenPrivileges","AllocateAndInitializeSid","CheckTokenMembership","CopySid","CreateProcessAsUserW","CreateProcessWithLogonW","DuplicateTokenEx","FreeSid","GetAce","GetAclInformation","GetLengthSid","GetSecurityDescriptorDacl","GetTokenInformation","InitializeAcl","InitializeSecurityDescriptor","InitiateSystemShutdownExW","LogonUserW","LookupPrivilegeValueW","OpenProcessToken","OpenThreadToken","RegCloseKey","RegCreateKeyExW","RegDeleteKeyW","RegDeleteValueW","RegEnumKeyExW","RegOpenKeyExW","RegQueryInfoKeyW","RegQueryValueExW","RegSetValueExW","SetSecurityDescriptorDacl"]},{"module":"COMCTL32.dll","functions":[]},{"module":"GDI32.dll","functions":["CreateCompatibleBitmap","CreateCompatibleDC","DeleteDC","DeleteObject","GetDIBits","GetPixel","SelectObject","StretchBlt"]},{"module":"KERNEL32.dll","functions":["CloseHandle","CompareStringW","CreateFileW","CreatePipe","CreateProcessW","CreateThread","CreateToolhelp32Snapshot","DecodePointer","DeleteCriticalSection","DuplicateHandle","EncodePointer","EnterCriticalSection","ExitProcess","FindResourceW","FlushFileBuffers","FreeEnvironmentStringsW","FreeLibrary","GetACP","GetCommandLineA","GetConsoleCP","GetConsoleMode","GetCPInfo","GetCurrentDirectoryW","GetCurrentProcess","GetCurrentProcessId","GetCurrentThread","GetCurrentThreadId","GetEnvironmentStringsW","GetExitCodeProcess","GetFileType","GetLastError","GetModuleFileNameA","GetModuleFileNameW","GetModuleHandleExW","GetModuleHandleW","GetOEMCP","GetProcAddress","GetProcessHeap","GetStartupInfoW","GetStdHandle","GetStringTypeW","GetSystemDirectoryW","GetSystemInfo","GetSystemTimeAsFileTime","GetThreadLocale","GetVersionExW","GlobalAlloc","GlobalLock","GlobalUnlock","HeapAlloc","HeapFree","HeapReAlloc","HeapSize","InitializeCriticalSectionAndSpinCount","InterlockedDecrement","InterlockedIncrement","IsDebuggerPresent","IsProcessorFeaturePresent","IsValidCodePage","IsWow64Process","LCMapStringW","LeaveCriticalSection","LoadLibraryA","LoadLibraryExW","LoadResource","lstrcmpiW","MultiByteToWideChar","OpenProcess","OutputDebugStringW","Process32FirstW","Process32NextW","QueryPerformanceCounter","QueryPerformanceFrequency","RaiseException","ReadProcessMemory","RtlUnwind","SetFilePointerEx","SetLastError","SetPriorityClass","SetStdHandle","SetSystemPowerState","SetThreadLocale","SetUnhandledExceptionFilter","SizeofResource","Sleep","TerminateProcess","TlsAlloc","TlsFree","TlsGetValue","TlsSetValue","UnhandledExceptionFilter","VirtualAllocEx","VirtualFreeEx","WaitForSingleObject","WideCharToMultiByte","WriteConsoleW","WriteFile","WriteProcessMemory"]},{"module":"MPR.dll","functions":["WNetCancelConnection2W","WNetGetConnectionW","WNetUseConnectionW"]},{"module":"ole32.dll","functions":["CoCreateInstance","CoTaskMemAlloc","CoTaskMemFree","CoTaskMemRealloc","StringFromGUID2"]},{"module":"OLEAUT32.dll","functions":["BSTR_UserFree","BSTR_UserMarshal","BSTR_UserSize","BSTR_UserUnmarshal","LoadRegTypeLib","LoadTypeLib","RegisterTypeLib","SafeArrayAccessData","SafeArrayAllocData","SafeArrayAllocDescriptorEx","SafeArrayDestroyData","SafeArrayDestroyDescriptor","SafeArrayUnaccessData","SysAllocString","SysFreeString","SysStringLen","UnRegisterTypeLib","VARIANT_UserFree","VARIANT_UserMarshal","VARIANT_UserSize","VARIANT_UserUnmarshal","VariantClear","VariantCopy","VariantInit","VarUI4FromStr"]},{"module":"RPCRT4.dll","functions":["IUnknown_AddRef_Proxy","IUnknown_QueryInterface_Proxy","IUnknown_Release_Proxy","NdrCStdStubBuffer2_Release","NdrDllCanUnloadNow","NdrDllGetClassObject","NdrDllRegisterProxy","NdrDllUnregisterProxy","NdrOleAllocate","NdrOleFree","NdrStubCall2","NdrStubForwardingFunction"]},{"module":"SHELL32.dll","functions":["DragQueryFileW"]},{"module":"USER32.dll","functions":["AttachThreadInput","CharNextW","CharUpperBuffW","ClientToScreen","CloseClipboard","CloseDesktop","CloseWindowStation","CopyRect","CountClipboardFormats","CreateWindowExW","DestroyWindow","EmptyClipboard","EnableWindow","EnumChildWindows","EnumWindows","ExitWindowsEx","FindWindowW","GetAsyncKeyState","GetCaretPos","GetClassNameW","GetClientRect","GetClipboardData","GetCursor","GetCursorPos","GetDC","GetDesktopWindow","GetDlgCtrlID","GetFocus","GetForegroundWindow","GetKeyboardState","GetKeyState","GetMenu","GetMenuItemCount","GetMenuItemID","GetMenuStringW","GetMonitorInfoW","GetParent","GetProcessWindowStation","GetSubMenu","GetUserObjectSecurity","GetWindowLongW","GetWindowRect","GetWindowTextW","GetWindowThreadProcessId","InvalidateRect","IsClipboardFormatAvailable","IsIconic","IsWindow","IsWindowEnabled","IsWindowVisible","IsZoomed","keybd_event","LoadCursorW","MapVirtualKeyW","MonitorFromPoint","mouse_event","MoveWindow","OpenClipboard","OpenDesktopW","OpenWindowStationW","PostMessageW","RegisterWindowMessageW","ReleaseDC","ScreenToClient","SendInput","SendMessageTimeoutW","SendMessageW","SetClipboardData","SetFocus","SetForegroundWindow","SetKeyboardState","SetLayeredWindowAttributes","SetProcessWindowStation","SetUserObjectSecurity","SetWindowLongW","SetWindowPos","ShowWindow","SystemParametersInfoW","VkKeyScanW","WindowFromPoint"]},{"module":"USERENV.dll","functions":["CreateEnvironmentBlock","DestroyEnvironmentBlock","LoadUserProfileW","UnloadUserProfile"]},{"module":"WINMM.dll","functions":["timeGetTime"]}],"file_exports":[{"name":"AU3_AutoItSetOption","ordinal":1,"address":"0x10003abb"},{"name":"AU3_ClipGet","ordinal":2,"address":"0x10003b79"},{"name":"AU3_ClipPut","ordinal":3,"address":"0x10003c1d"},{"name":"AU3_ControlClick","ordinal":4,"address":"0x10003cb4"},{"name":"AU3_ControlClickByHandle","ordinal":5,"address":"0x10003dc9"},{"name":"AU3_ControlCommand","ordinal":6,"address":"0x10003eda"},{"name":"AU3_ControlCommandByHandle","ordinal":7,"address":"0x10003fca"},{"name":"AU3_ControlDisable","ordinal":8,"address":"0x100044d6"},{"name":"AU3_ControlDisableByHandle","ordinal":9,"address":"0x10004574"},{"name":"AU3_ControlEnable","ordinal":10,"address":"0x1000460e"},{"name":"AU3_ControlEnableByHandle","ordinal":11,"address":"0x100046ac"},{"name":"AU3_ControlFocus","ordinal":12,"address":"0x10004746"},{"name":"AU3_ControlFocusByHandle","ordinal":13,"address":"0x100047e4"},{"name":"AU3_ControlGetFocus","ordinal":14,"address":"0x1000487e"},{"name":"AU3_ControlGetFocusByHandle","ordinal":15,"address":"0x10004936"},{"name":"AU3_ControlGetHandle","ordinal":16,"address":"0x100049ea"},{"name":"AU3_ControlGetHandleAsText","ordinal":17,"address":"0x10004ac4"},{"name":"AU3_ControlGetPos","ordinal":18,"address":"0x10004bba"},{"name":"AU3_ControlGetPosByHandle","ordinal":19,"address":"0x10004c52"},{"name":"AU3_ControlGetText","ordinal":20,"address":"0x10004ce6"},{"name":"AU3_ControlGetTextByHandle","ordinal":21,"address":"0x10004dba"},{"name":"AU3_ControlHide","ordinal":22,"address":"0x10004e8a"},{"name":"AU3_ControlHideByHandle","ordinal":23,"address":"0x10004f28"},{"name":"AU3_ControlListView","ordinal":24,"address":"0x100040b6"},{"name":"AU3_ControlListViewByHandle","ordinal":25,"address":"0x100041c0"},{"name":"AU3_ControlMove","ordinal":26,"address":"0x10004fc2"},{"name":"AU3_ControlMoveByHandle","ordinal":27,"address":"0x100050d4"},{"name":"AU3_ControlSend","ordinal":28,"address":"0x100051e2"},{"name":"AU3_ControlSendByHandle","ordinal":29,"address":"0x100052b4"},{"name":"AU3_ControlSetText","ordinal":30,"address":"0x10005382"},{"name":"AU3_ControlSetTextByHandle","ordinal":31,"address":"0x1000543a"},{"name":"AU3_ControlShow","ordinal":32,"address":"0x100054ee"},{"name":"AU3_ControlShowByHandle","ordinal":33,"address":"0x1000558c"},{"name":"AU3_ControlTreeView","ordinal":34,"address":"0x100042c6"},{"name":"AU3_ControlTreeViewByHandle","ordinal":35,"address":"0x100043d0"},{"name":"AU3_DriveMapAdd","ordinal":36,"address":"0x10008c65"},{"name":"AU3_DriveMapDel","ordinal":37,"address":"0x10008aff"},{"name":"AU3_DriveMapGet","ordinal":38,"address":"0x10008ba3"},{"name":"AU3_Init","ordinal":39,"address":"0x10003ab0"},{"name":"AU3_IsAdmin","ordinal":40,"address":"0x10005626"},{"name":"AU3_MouseClick","ordinal":41,"address":"0x100056aa"},{"name":"AU3_MouseClickDrag","ordinal":42,"address":"0x100057c5"},{"name":"AU3_MouseDown","ordinal":43,"address":"0x100058eb"},{"name":"AU3_MouseGetCursor","ordinal":44,"address":"0x100058fa"},{"name":"AU3_MouseGetPos","ordinal":45,"address":"0x1000597e"},{"name":"AU3_MouseMove","ordinal":46,"address":"0x10005a0d"},{"name":"AU3_MouseUp","ordinal":47,"address":"0x10005ae1"},{"name":"AU3_MouseWheel","ordinal":48,"address":"0x10008d9b"},{"name":"AU3_Opt","ordinal":49,"address":"0x10003abb"},{"name":"AU3_PixelChecksum","ordinal":50,"address":"0x10008e4c"},{"name":"AU3_PixelGetColor","ordinal":51,"address":"0x10005af0"},{"name":"AU3_PixelSearch","ordinal":52,"address":"0x10005bae"},{"name":"AU3_ProcessClose","ordinal":53,"address":"0x10005d3c"},{"name":"AU3_ProcessExists","ordinal":54,"address":"0x10005de0"},{"name":"AU3_ProcessSetPriority","ordinal":55,"address":"0x10008f67"},{"name":"AU3_ProcessWait","ordinal":56,"address":"0x10005e84"},{"name":"AU3_ProcessWaitClose","ordinal":57,"address":"0x10005f42"},{"name":"AU3_Run","ordinal":58,"address":"0x10006000"},{"name":"AU3_RunAs","ordinal":59,"address":"0x100060da"},{"name":"AU3_RunAsWait","ordinal":60,"address":"0x100062fa"},{"name":"AU3_RunWait","ordinal":61,"address":"0x1000621e"},{"name":"AU3_Send","ordinal":62,"address":"0x1000643e"},{"name":"AU3_Shutdown","ordinal":63,"address":"0x100064eb"},{"name":"AU3_Sleep","ordinal":64,"address":"0x10006500"},{"name":"AU3_StatusbarGetText","ordinal":65,"address":"0x1000650f"},{"name":"AU3_StatusbarGetTextByHandle","ordinal":66,"address":"0x100065ea"},{"name":"AU3_ToolTip","ordinal":67,"address":"0x100066c1"},{"name":"AU3_WinActivate","ordinal":68,"address":"0x10006797"},{"name":"AU3_WinActivateByHandle","ordinal":69,"address":"0x10006831"},{"name":"AU3_WinActive","ordinal":70,"address":"0x100068f1"},{"name":"AU3_WinActiveByHandle","ordinal":71,"address":"0x1000698b"},{"name":"AU3_WinClose","ordinal":72,"address":"0x10006a21"},{"name":"AU3_WinCloseByHandle","ordinal":73,"address":"0x10006abb"},{"name":"AU3_WinExists","ordinal":74,"address":"0x10006b7b"},{"name":"AU3_WinExistsByHandle","ordinal":75,"address":"0x10006c15"},{"name":"AU3_WinGetCaretPos","ordinal":76,"address":"0x10006cab"},{"name":"AU3_WinGetClassList","ordinal":77,"address":"0x10006d21"},{"name":"AU3_WinGetClassListByHandle","ordinal":78,"address":"0x10006dd9"},{"name":"AU3_WinGetClientSize","ordinal":79,"address":"0x10006e8d"},{"name":"AU3_WinGetClientSizeByHandle","ordinal":80,"address":"0x10006f03"},{"name":"AU3_WinGetHandle","ordinal":81,"address":"0x10006f9f"},{"name":"AU3_WinGetHandleAsText","ordinal":82,"address":"0x10007039"},{"name":"AU3_WinGetPos","ordinal":83,"address":"0x100070f1"},{"name":"AU3_WinGetPosByHandle","ordinal":84,"address":"0x10007167"},{"name":"AU3_WinGetProcess","ordinal":85,"address":"0x10007203"},{"name":"AU3_WinGetProcessByHandle","ordinal":86,"address":"0x1000729d"},{"name":"AU3_WinGetState","ordinal":87,"address":"0x10007333"},{"name":"AU3_WinGetStateByHandle","ordinal":88,"address":"0x100073cd"},{"name":"AU3_WinGetText","ordinal":89,"address":"0x10007463"},{"name":"AU3_WinGetTextByHandle","ordinal":90,"address":"0x1000751b"},{"name":"AU3_WinGetTitle","ordinal":91,"address":"0x100075f9"},{"name":"AU3_WinGetTitleByHandle","ordinal":92,"address":"0x100076b1"},{"name":"AU3_WinKill","ordinal":93,"address":"0x1000778f"},{"name":"AU3_WinKillByHandle","ordinal":94,"address":"0x10007829"},{"name":"AU3_WinMenuSelectItem","ordinal":95,"address":"0x100078e9"},{"name":"AU3_WinMenuSelectItemByHandle","ordinal":96,"address":"0x10007a93"},{"name":"AU3_WinMinimizeAll","ordinal":97,"address":"0x10007c39"},{"name":"AU3_WinMinimizeAllUndo","ordinal":98,"address":"0x10007cac"},{"name":"AU3_WinMove","ordinal":99,"address":"0x10007d1f"},{"name":"AU3_WinMoveByHandle","ordinal":100,"address":"0x10007e2d"},{"name":"AU3_WinSetOnTop","ordinal":101,"address":"0x10007f37"},{"name":"AU3_WinSetOnTopByHandle","ordinal":102,"address":"0x10007feb"},{"name":"AU3_WinSetState","ordinal":103,"address":"0x1000809b"},{"name":"AU3_WinSetStateByHandle","ordinal":104,"address":"0x1000814f"},{"name":"AU3_WinSetTitle","ordinal":105,"address":"0x100081ff"},{"name":"AU3_WinSetTitleByHandle","ordinal":106,"address":"0x100082b3"},{"name":"AU3_WinSetTrans","ordinal":107,"address":"0x10008363"},{"name":"AU3_WinSetTransByHandle","ordinal":108,"address":"0x10008417"},{"name":"AU3_WinWait","ordinal":109,"address":"0x100084c7"},{"name":"AU3_WinWaitActive","ordinal":110,"address":"0x10008655"},{"name":"AU3_WinWaitActiveByHandle","ordinal":111,"address":"0x10008709"},{"name":"AU3_WinWaitByHandle","ordinal":112,"address":"0x1000857b"},{"name":"AU3_WinWaitClose","ordinal":113,"address":"0x100087e3"},{"name":"AU3_WinWaitCloseByHandle","ordinal":114,"address":"0x10008897"},{"name":"AU3_WinWaitNotActive","ordinal":115,"address":"0x10008971"},{"name":"AU3_WinWaitNotActiveByHandle","ordinal":116,"address":"0x10008a25"},{"name":"AU3_error","ordinal":117,"address":"0x10008f5f"},{"name":"DllCanUnloadNow","ordinal":118,"address":"0x100037d8"},{"name":"DllGetClassObject","ordinal":119,"address":"0x100037fb"},{"name":"DllRegisterServer","ordinal":120,"address":"0x10003842"},{"name":"DllUnregisterServer","ordinal":121,"address":"0x10003885"}]}},{"name":"nppdf32.dll","file_path":null,"file_size":242161,"md5":"ddd066bd0adfef0f2a53ccc98584b3b8","sha1":"77186a75457ed6362c06770e14df2f5f5c06b7f5","sha256":"eba9a05919416ed15988c7e26935f0bd5b74e90c0ba3104337600f0704142dd5","sha512":"c4d627de6e922471c2d4529c1858fa79e475565df39b9d9fe236445c5b215c29682e4d8a638bcf7b7324e566d8f3c4b93f70bff179416b4a4b29c3353c978f17","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"nppdf32.dll","size":242161,"description":null,"architecture":"32 Bit","ssdeep":"3072:/in0dbtiB6cwEBFL+ak/FdT7eaFgIRYg9Rr2H8i5e0sq1CAg/P0V2Qz5rQJYV0U4:/ztM6v/eiRR9d2HH3g/lQzuCV8","imphash":"f91b34efd167113e55e1b55d1a8fff35","authentihash":"e7810557e9449550d52163dde3edb03213c2b4fae0e138b724b74df8ac91a02f","entrypoint_bytes":null,"packer":"Borland Delphi 3.0 (???)","version_info":[{"id":"MIMEType","value":"application/pdf|application/vnd.adobe.pdfxml|application/vnd.adobe.x-mars|application/vnd.fdf|application/vnd.adobe.xfdf|application/vnd.adobe.xdp+xml|application/vnd.adobe.xfd+xml"},{"id":"LegalCopyright","value":"Copyright 2000-2017 Adobe Systems Incorporated and its licensors. All rights reserved."},{"id":"FileExtents","value":"pdf|pdfxml|mars|fdf|xfdf|xdp|xfd"},{"id":"FileVersion","value":"18.9.20044.251705"},{"id":"CompanyName","value":"Adobe Systems Inc."},{"id":"FileOpenName","value":"Acrobat Portable Document Format (*.pdf)|Adobe PDF in XML Format (*.pdfxml)|Adobe PDF in XML Format (*.mars)|Acrobat Forms Data Format (*.fdf)|XML Version of Acrobat Forms Data Format (*.xfdf) | Acrobat XML Data Package (*.xdp)|Adobe FormFlow99 Data File (*.xfd)"},{"id":"ProductName","value":"Adobe Acrobat"},{"id":"ProductVersion","value":"18.9.20044.251705"},{"id":"FileDescription","value":"Adobe PDF Plug-In For Firefox and Netscape 18.9.20044"},{"id":"OriginalFilename","value":"NPPDF32.DLL"},{"id":"Translation","value":"0x0409 0x04e4"}],"file_sections":[{"name":".text","entropy":6.5879919722,"virtual_address":"0x1000","virtual_size":"0x27c41","raw_size":"0x27e00","md5":"086beb52a413574718b00f8976f4757a"},{"name":".rdata","entropy":5.24156027208,"virtual_address":"0x29000","virtual_size":"0xb88c","raw_size":"0xba00","md5":"a0b66a2e5ff52d237d981571741aca1c"},{"name":".data","entropy":4.7526367397,"virtual_address":"0x35000","virtual_size":"0x32a4","raw_size":"0xa00","md5":"4e091ae172644ce95227b55f88aab72d"},{"name":".rsrc","entropy":3.63756321173,"virtual_address":"0x39000","virtual_size":"0x1d48","raw_size":"0x1e00","md5":"602279bed92a9d60b83f04f2cf15dca7"},{"name":".reloc","entropy":6.74840723019,"virtual_address":"0x3b000","virtual_size":"0x2b78","raw_size":"0x2c00","md5":"56a4ae43e05d8016dfde83e0cbfbccb4"}],"file_imports":[{"module":"ADVAPI32.dll","functions":["GetTokenInformation","OpenProcessToken","RegCloseKey","RegEnumKeyExW","RegEnumValueW","RegOpenKeyExA","RegOpenKeyExW","RegQueryInfoKeyW","RegQueryValueExA","RegQueryValueExW"]},{"module":"GDI32.dll","functions":["CreateRectRgn","CreateRoundRectRgn","CreateSolidBrush","DeleteEnhMetaFile","DeleteObject","Escape","FillRgn","GetDeviceCaps","GetEnhMetaFileA","GetStockObject","LPtoDP","PlayEnhMetaFile","SetBkColor","SetTextColor"]},{"module":"KERNEL32.dll","functions":["CallNamedPipeW","CloseHandle","CopyFileA","CreateDirectoryA","CreateEventA","CreateFileA","CreateFileMappingA","CreateFileW","CreateMutexW","CreateProcessW","CreateSemaphoreA","CreateThread","DecodePointer","DeleteCriticalSection","DeleteFileA","EncodePointer","EnterCriticalSection","ExitThread","FindClose","FindFirstFileW","FlushViewOfFile","FormatMessageA","FreeLibrary","GetCurrentProcess","GetCurrentProcessId","GetCurrentThreadId","GetExitCodeProcess","GetFileAttributesW","GetFileSize","GetFileType","GetLastError","GetLocalTime","GetLongPathNameW","GetModuleFileNameA","GetModuleFileNameW","GetModuleHandleA","GetModuleHandleExW","GetModuleHandleW","GetProcAddress","GetSystemDirectoryA","GetSystemTimeAsFileTime","GetTempFileNameA","GetTempPathA","GetTempPathW","GetTickCount","GetVersionExW","GetVolumeInformationW","InitializeCriticalSection","InitializeCriticalSectionEx","IsDebuggerPresent","IsProcessorFeaturePresent","LeaveCriticalSection","LoadLibraryA","LoadLibraryExA","LoadLibraryW","LocalFree","lstrcpyW","lstrlenW","MapViewOfFile","MultiByteToWideChar","OpenFile","OpenFileMappingA","OpenMutexW","OpenProcess","OutputDebugStringA","OutputDebugStringW","QueryPerformanceCounter","RaiseException","ReadFile","ResumeThread","SetEvent","SetFilePointer","SetLastError","SetNamedPipeHandleState","SetThreadPriority","Sleep","TerminateThread","TransactNamedPipe","TryEnterCriticalSection","UnmapViewOfFile","VerifyVersionInfoW","VerSetConditionMask","WaitForSingleObject","WaitNamedPipeW","WideCharToMultiByte","WriteFile"]},{"module":"MSVCP120.dll","functions":["??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z","??0?$basic_iostream@GU?$char_traits@G@std@@@std@@QAE@PAV?$basic_streambuf@GU?$char_traits@G@std@@@1@@Z","??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ","??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAE@XZ","??0_Container_base12@std@@QAE@XZ","??0_Lockit@std@@QAE@H@Z","??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ","??1?$basic_ios@GU?$char_traits@G@std@@@std@@UAE@XZ","??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ","??1?$basic_iostream@GU?$char_traits@G@std@@@std@@UAE@XZ","??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ","??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAE@XZ","??1_Container_base12@std@@QAE@XZ","??1_Lockit@std@@QAE@XZ","??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z","??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z","??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z","??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@K@Z","??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@","??_7?$basic_ios@GU?$char_traits@G@std@@@std@@6B@","??_7ios_base@std@@6B@","??Bid@locale@std@@QAEIXZ","?_BADOFF@std@@3_JB","?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@PBV42@@Z","?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ","?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z","?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ","?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ","?_Orphan_all@_Container_base12@std@@QAEXXZ","?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ","?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ","?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ","?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEPAGXZ","?_Syserror_map@std@@YAPBDH@Z","?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ","?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@UAEXXZ","?_Winerror_map@std@@YAPBDH@Z","?_Xbad_alloc@std@@YAXXZ","?_Xlength_error@std@@YAXPBD@Z","?_Xout_of_range@std@@YAXPBD@Z","?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ","?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ","?gbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z","?getloc@ios_base@std@@QBE?AVlocale@2@XZ","?id@?$ctype@G@std@@2V0locale@2@A","?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z","?imbue@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEXABVlocale@2@@Z","?pbump@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IAEXH@Z","?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z","?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAG_J@Z","?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z","?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z","?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ","?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JXZ","?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z","?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z","?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z","?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ","?sync@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEHXZ","?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ","?uflow@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEGXZ","?uncaught_exception@std@@YA_NXZ","?widen@?$ctype@G@std@@QBEGD@Z","?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z","?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPAG_J@Z","?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z","?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE_JPBG_J@Z"]},{"module":"MSVCR120.dll","functions":["??0bad_cast@std@@QAE@ABV01@@Z","??0bad_cast@std@@QAE@PBD@Z","??0exception@std@@QAE@ABQBDH@Z","??0exception@std@@QAE@ABV01@@Z","??1bad_cast@std@@UAE@XZ","??1exception@std@@UAE@XZ","??1type_info@@UAE@XZ","??2@YAPAXI@Z","??3@YAXPAX@Z","??_V@YAXPAX@Z","?terminate@@YAXXZ","?what@exception@std@@UBEPBDXZ","__clean_type_info_names_internal","__CppXcptFilter","__crtTerminateProcess","__crtUnhandledException","__CxxFrameHandler3","__dllonexit","_amsg_exit","_calloc_crt","_crt_debugger_hook","_CxxThrowException","_except1","_except_handler4_common","_initterm","_initterm_e","_itoa","_itow_s","_lock","_malloc_crt","_mbscmp","_onexit","_purecall","_set_invalid_parameter_handler","_snwprintf","_snwprintf_s","_stricmp","_strnicmp","_time64","_unlink","_unlock","_vsnprintf","_vsnprintf_s","_waccess_s","_wcsdup","_wcsicmp","_wcslwr_s","_wcsnicmp","_wfopen_s","_wgetenv","_wmakepath_s","_wputenv_s","_wsplitpath_s","_wtof","_wtol","calloc","fclose","fopen","fread","free","fseek","fwrite","fwscanf_s","iswdigit","localeconv","malloc","memchr","memcmp","memcpy","memcpy_s","memmove","memmove_s","memset","setlocale","sprintf","sprintf_s","sscanf","strcat","strcat_s","strchr","strcmp","strcpy","strcpy_s","strlen","strncmp","strncpy","strrchr","strstr","swprintf_s","tmpfile","tolower","towlower","vsprintf_s","wcscat","wcscat_s","wcscpy_s","wcslen","wcsncat_s","wcsncmp","wcsncpy_s","wcsrchr","wcsstr","wcstok_s","wcstol"]},{"module":"ole32.dll","functions":["CoCreateInstance","CoTaskMemFree"]},{"module":"SHELL32.dll","functions":["SHGetFolderPathA"]},{"module":"USER32.dll","functions":["CallWindowProcA","ClientToScreen","CreateDialogParamA","CreateWindowExW","DefWindowProcA","DestroyCursor","DestroyWindow","DispatchMessageA","DispatchMessageW","EndDialog","EnumWindows","FindWindowA","FindWindowW","GetActiveWindow","GetAncestor","GetClassNameA","GetClientRect","GetDesktopWindow","GetDlgItem","GetFocus","GetForegroundWindow","GetMessageA","GetMessageW","GetParent","GetPropA","GetPropW","GetSubMenu","GetWindow","GetWindowLongA","GetWindowRect","GetWindowRgn","GetWindowThreadProcessId","InvalidateRect","IsChild","IsWindow","IsWindowUnicode","IsWindowVisible","KillTimer","LoadCursorA","LoadMenuA","LoadStringA","LoadStringW","MessageBoxA","MsgWaitForMultipleObjects","PeekMessageA","PostMessageA","PostMessageW","PostQuitMessage","RegisterWindowMessageA","RemovePropA","RemovePropW","SendDlgItemMessageA","SendDlgItemMessageW","SendMessageA","SetCursor","SetFocus","SetPropA","SetPropW","SetTimer","SetWindowLongA","SetWindowPos","SetWindowRgn","ShowScrollBar","ShowWindow","SystemParametersInfoA","TranslateMessage","UpdateWindow","WaitForInputIdle","wsprintfW"]},{"module":"UxTheme.dll","functions":["SetWindowTheme"]},{"module":"VERSION.dll","functions":["GetFileVersionInfoSizeW","GetFileVersionInfoW","VerQueryValueW"]}],"file_exports":[{"name":"NP_GetEntryPoints","ordinal":1,"address":"0x1000d6dd"},{"name":"NP_Initialize","ordinal":2,"address":"0x1000d74f"},{"name":"NP_Shutdown","ordinal":3,"address":"0x1000d7a0"},{"name":"NP_ApolloEntry","ordinal":4,"address":"0x1000be9d"},{"name":"NP_AcrobatProtectedInitialize","ordinal":5,"address":"0x1000c63f"}]}},{"name":"ccme_base.dll","file_path":null,"file_size":405505,"md5":"56faf1e7fb7039df1a1fadfeb27970ad","sha1":"1ac39cf5ee8772b5bcdf7d5636fe378a4c20665d","sha256":"99ba859d9df64dd9d59a2901b65435f854473c2e88b444a22ccdf3f91d5ab03d","sha512":"7c856a82c61ca191514d0722b8bad57d2ea80040876a78b760b80ca55d134c0980d615745856ad1cb44f3d888306dc30ce24cbd7a2e45a34076859e0122c3e27","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":{"filename":"ccme_base.dll","size":405505,"description":null,"architecture":"32 Bit","ssdeep":"6144:LFnloXmoFFhEN8/QZh0/EzipIMtQyxnnnj0/nsyYbJ7u/U+/GOVqqDLS45hVe:tlopF+ba/EzipIMfPhIVGOYqnzVe","imphash":"5e7309f7f41ec26327e1184844bca933","authentihash":"0befd23b72fac8ea23837fafc90b3b0180c541d92ff971c6400dcf4dd2ce717a","entrypoint_bytes":null,"packer":"Borland Delphi 3.0 (???)","version_info":[{"id":"LegalCopyright","value":"Copyright 2011 by RSA Security Inc. All rights reserved."},{"id":"InternalName","value":"ccme_base"},{"id":"FileVersion","value":"4.1.2.0"},{"id":"CompanyName","value":"RSA - The Security Division of EMC"},{"id":"ProductName","value":"RSA BSAFE Crypto-C ME"},{"id":"ProductVersion","value":"4.1.2.0"},{"id":"FileDescription","value":"{TARGETDESC}"},{"id":"OriginalFilename","value":"ccme_base"},{"id":"Translation","value":"0x0409 0x04e4"}],"file_sections":[{"name":".text","entropy":6.61622111868,"virtual_address":"0x1000","virtual_size":"0x442a2","raw_size":"0x44400","md5":"5ebb5c88a3bcbbbbcffc3064e4605ec4"},{"name":".rdata","entropy":5.69308988295,"virtual_address":"0x46000","virtual_size":"0x18aba","raw_size":"0x18c00","md5":"6e567dc8b405e56dfb2f43c59b87a3b7"},{"name":".data","entropy":5.43324994816,"virtual_address":"0x5f000","virtual_size":"0x1474","raw_size":"0x1000","md5":"c040c634fcc18ad9567a6c4831b8c00a"},{"name":".rsrc","entropy":3.10235136406,"virtual_address":"0x61000","virtual_size":"0x3a0","raw_size":"0x400","md5":"17e392274d4a561456e369f89b1930dc"},{"name":".reloc","entropy":6.56864172504,"virtual_address":"0x62000","virtual_size":"0x42c8","raw_size":"0x4400","md5":"329e4c0acfc64dd5908af93ba22f9ea7"}],"file_imports":[{"module":"ADVAPI32.dll","functions":["RegCloseKey","RegOpenKeyExA","RegQueryValueExA"]},{"module":"GDI32.dll","functions":["BitBlt","CreateCompatibleBitmap","CreateCompatibleDC","CreateDCA","DeleteDC","DeleteObject","GetBitmapBits","GetDeviceCaps","GetObjectA","SelectObject"]},{"module":"IPHLPAPI.DLL","functions":["GetIfTable"]},{"module":"KERNEL32.dll","functions":["CloseHandle","CreateFileA","DecodePointer","DisableThreadLibraryCalls","EncodePointer","GetCurrentProcess","GetCurrentProcessId","GetCurrentThread","GetCurrentThreadId","GetProcessIoCounters","GetProcessTimes","GetProcessWorkingSetSize","GetStartupInfoA","GetSystemTime","GetSystemTimeAsFileTime","GetSystemTimes","GetThreadTimes","GlobalMemoryStatusEx","HeapAlloc","HeapCreate","HeapDestroy","HeapFree","HeapReAlloc","IsDebuggerPresent","IsProcessorFeaturePresent","K32EnumProcesses","K32GetProcessMemoryInfo","OpenProcess","QueryPerformanceCounter","ReadFile","SystemTimeToFileTime"]},{"module":"MSVCR120.dll","functions":["__clean_type_info_names_internal","__CppXcptFilter","__crtTerminateProcess","__crtUnhandledException","__dllonexit","_amsg_exit","_calloc_crt","_crt_debugger_hook","_difftime64","_except1","_except_handler4_common","_initterm","_initterm_e","_lock","_malloc_crt","_onexit","_stat64i32","_time64","_unlock","fclose","fopen","fread","free","getenv","isdigit","memcpy","memcpy_s","memmove","memmove_s","memset","sprintf","toupper"]},{"module":"USER32.dll","functions":["GetActiveWindow","GetCapture","GetCaretPos","GetClipboardOwner","GetClipboardViewer","GetCursorPos","GetFocus","GetMessagePos","GetMessageTime","GetOpenClipboardWindow","GetQueueStatus"]}],"file_exports":[{"name":"R_FIPS_MODULE_resource","ordinal":1,"address":"0x10001000"}]}},{"name":"AGM.dll","file_path":null,"file_size":5136881,"md5":"1740e7bff6c2362548ef00c6db9716fb","sha1":"bc1c018628ab877d63e6368badf82cd6466ffbfa","sha256":"c378d3a66aaf98e57e19a11f89b13357019b2fa5fda85cd23c535bf444352365","sha512":"9e873ef85ba1695202c39c8ee9c3fe647efb933df2faed08805bbe532618e4cf940a9873fc4b7f0e1d1e588432f9c3662c894b16a561f31d0ffe79b5c0d613bd","type_tags":["pedll","executable"],"description":"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows","runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"upx.exe","file_path":null,"file_size":306177,"md5":"c34599fdd2b0fa06051c1650701e280b","sha1":"00f7aca0b4e888a01aad86dbd48825f054bb1dca","sha256":"7424491f0bdca16061dd9f8453f3f7c4539a79ae5316ba0ebc847508c6b99e89","sha512":"c42f7e5212c53a988533a52e0abaeb42be63424749cff469c2f1d81199c01045b482a07d72a63e685747f40275255dae0196e148c1fadbc2dc07f177388e37e9","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"_Excel1.xls","file_path":null,"file_size":399361,"md5":"f877a0eefe93ce517496251d210336e8","sha1":"1ff7b9f5d41c52bc5dcc602374b2423c0f772d39","sha256":"6f14d5a2ee6d5f65fe1b31ba990135daadc17940e007c70027f3e0ec751cb39e","sha512":"ab1421ee850897399bf2bf1ec0d4c2cd518b3364975c9a755dba99485cd12f78c81b2c820374b02f4c38ef0eab12ca4fce1fff82586ac781b6b3c6d7d375a04f","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"32BitMAPIBroker.exe","file_path":null,"file_size":105969,"md5":"cf7e2c0afacfb387443e9d6c735a8cde","sha1":"1d7322e84cdb72d2e71c54201d10f4229f874e2d","sha256":"68777bb19e6556e490ac87b2a5070327bf37e000d9385cc5b7af6652bcb75a03","sha512":"9e77c1a6d5fd0d81001654cef5a650c4975cfb98523b9d012dbdcc2e2bea42b7d37b2fc48fde3df5a9f07a50d8c88bc275338519c29874f1a823ad191ec803cd","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"7zFM.exe","file_path":null,"file_size":496872,"md5":"3676729b08985cd27820eda3dce3f985","sha1":"66e765ce63a58a540c8199e368361e2499a09e59","sha256":"61ab7e6d9f32c9398188a98fc104511a0a38e3fbabe94293afe844f1ff94bf54","sha512":"330afe21cdc23e23e89b22d3d30a7ab097308e567fcdf421cc4193b8e4914c630999ee9bc9643a0500a9e0507ff300944795c1ff7c670598c1fee3197b7bfeb5","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"reader_sl.exe","file_path":null,"file_size":54865,"md5":"4513d075dad443cc7a7d7858e43a5ff2","sha1":"c9a36ab71a6f2caf64570134e6d803933781c620","sha256":"b78228bcc3c637f738bc8e7a224d9bc31ae560c5ee8bd5f3dedf7535fc5b0dec","sha512":"a1f9a17bae3d8f1899f7fc21b9d26ba7cbdf4db3ef8fd6895817a047a99b20a06ae62a08d1d80f12fa504d53c54b787502b7aaa7ef641a627ac7ae6636e7c478","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"airappinstaller.exe","file_path":null,"file_size":313329,"md5":"05c7c7559d12115ad1169ab822291ac3","sha1":"6fd08581f76c7c32dfe028fae8359d8af84fab37","sha256":"60e9b11e3db19c23ef4e4288713f1d38d8e938d89230c09199c951e81e9ad69b","sha512":"fdb1258b9ca08bd37773cadfcb84da89dbfe2b91cd88e1a06221023f223713eb5f028fa18749046bcbba2ab97bf3ffcc616e1e6eee9db2c3e96abafcc00e1bf3","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"AutoIt3_x64.exe","file_path":null,"file_size":1059121,"md5":"8e81cd00b0fefd6fa1666bebb116e2f2","sha1":"3cd182b02038cc6f8ea0a4be99b31339d9000327","sha256":"9e989902edffaf9b22763e5ab7ef6c15148a4689c71de41e0d3d6e64b32923d3","sha512":"696a5807b7338e562e47580b332458c0d8eb056c520e095eb7d8980f8f0250e9fb2705baa6009eafefd495dfea2113fa92f79d4fad074edd0a598ada8a781219","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"PDFPrevHndlr.dll","file_path":null,"file_size":98465,"md5":"f37cccad5ecf798438e9bd9398594fcb","sha1":"0dfa240ee1b9fc707172cdc3e1cbc56ab2fa3632","sha256":"644870244830644ba41abb3e01a8b0ffec0d00f9b793b7e8edf55e4812081d3c","sha512":"fb5fc6be005d8492edbacd342383fd04eed8c3c9e2e95c79de278f8ccef69777403cba885a18832f8cf02507a441cf17b7843b1cb14a739a4369241714843af5","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"JP2KLib.dll","file_path":null,"file_size":771569,"md5":"469ad0b4df2e8a0e374e89711acc4c2a","sha1":"4640d6e143b36e3c4ea136943a2ad5831c65be32","sha256":"f112b9e3ca40430185cc2c6a4dcfd11eea7138d4351e6b3b2e8f097318472908","sha512":"99a8875dc7f19605ceed8e6cb829052bcedc802bccb9356940a839c061bbed67fa2d6bf96657b55e76890b79900997b13f3e10247c4a0fa036e8a24d8091bfbd","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"Resources.dll","file_path":null,"file_size":309761,"md5":"1626dcf4e034207705ce0571753ac640","sha1":"fde7338657581a6c82a2cc45e8ef973b2e2b74b4","sha256":"dc17c011e06b1542eecaf293f9af1615464d05d2d9edb5a18ff85bf8d479f8bd","sha512":"3d571d51b0b23ff1e5f513d3d1e3220d499931e907ce51ae5f6762ce03561620a3b1f5061c22b3541ec8e33a756f12f7c68bb40e7cb31d3eb2f84f4036812cb8","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"A3DUtils.dll","file_path":null,"file_size":167921,"md5":"9dca8cea4cad21153d811ff9ce8ec859","sha1":"ffce090c076db6102c60993df9d3e2841ca4105a","sha256":"67c57ccfcda83ffdaaf833bfa08d862f079fc7fb9074b95e9eadd60fa1c25f1e","sha512":"6c4ccfd4292b30aa17f705fdd5f6fee9e9dac7e85129d2085da1c5106e11e2e7f6c0204ff0c205a6e0e4d18750a5816cdb7e100dcb3664636f8af700483f926b","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"AdobeLinguistic.dll","file_path":null,"file_size":517617,"md5":"f2c398764f861a5154fe1a561a184cf3","sha1":"21c0e37da94e3f008810cc524c136657693aba83","sha256":"91d95ae4bf7e9a3ba529448867e8afeb9c515604e7131938a6b9364610d81645","sha512":"b59a5704ab693d57124cb6c295a5a9aa423ead61310a0203f4b504d7dc9875d314f35116ce31f5be01c003eb511a2bd9f118b19335271975165cc96090707293","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"cryptocme.dll","file_path":null,"file_size":219649,"md5":"7e4387bbe0316d59638f4d7db43ee477","sha1":"b3c6a2b31dd614f3e2d190c205db9b2c0b84045e","sha256":"7c1235d63085c684fc2be763cba24455788d2d4fa727b995f9911a1ee1b442b6","sha512":"225b6b669cc6aff9e10ce488774b195062778560d468fc0b73f13fc0aa9490a77469ba8c733f9201559dcec0db99b4e56aa066112b1b1929b717b42540acb93c","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"JSByteCodeWin.bin","file_path":null,"file_size":3590387,"md5":"8306ad625866bd445f43dea45abc4f75","sha1":"ffdd802322b46e21ae9f51c31e240d6b7d88988a","sha256":"8ba8cba03411b4a3c81925a4a533b37f65d88814fdc3f96092727963fd5e8ab6","sha512":"08b268ca34e10023e8fd9662b6557483c1e5c43ffa600829d3d5a0f71cdc4536e3a52df9ccc62e3e463e6e8fc0e961c2169cf01f3ba1ff072cb706dbf32572c9","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"ADelRCP.exe","file_path":null,"file_size":139761,"md5":"514bef9a0f54ed688fe929bd458e1393","sha1":"760421824c9dcfd5820159c26c39224ff74547c0","sha256":"6326286837e9347efd5b38da8ce08891fbda2e5a5e44cac8aaf44431c337375b","sha512":"7844847f0131d43561fc232c4d09ef855bcec304709674e78e6090fd4242b0958fe7797b22d665bae33988ec4ec8bd7deb12a76e6ba77c90ce8f934ed65438a8","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"Aut2exe.exe","file_path":null,"file_size":1392953,"md5":"82a02f12593f022f8e7ac6e45725e105","sha1":"c8db3d60048772faaf8cb054e1df1b287e68eb27","sha256":"ab3d65c2f1c985cd347d6eb6ab418f3456c4850e75d5708b43913b54d97a7c40","sha512":"0b9d00f40118fd2bfaf6f0391d19f2a5513e913731b0a482df854acab25375899a0b644c1e5367c3b2c2313fd2effb55e5f0e99eacf2a53c39a5a91a9deb0de7","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"AutoItX3.Assembly.dll","file_path":null,"file_size":42297,"md5":"fc2d6d528297966267752158a2754469","sha1":"9fc1fb204ea8a782e73f3808c135f379d09d5dbc","sha256":"c8b17f318fd50adddeca473c805c3d2650171ed8c592ee256079038f6dd543b0","sha512":"d46ce549570a9d821ceaa063574a6ede3d083ab866402ef14ea6a067b38a1565532db0ced129c79b2b0f78ab5c7e5361ba4da571413fca494f48a90985816016","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"7z.dll","file_path":null,"file_size":1075432,"md5":"e05f8457da20bb3a6f80d0eadd1003da","sha1":"f516a29a119834bd0b99a012fd4050e3386bb3e6","sha256":"d8ba3a8a86709e7375a3ad8f89c0f36e720ab27062d5412159e5c33c50081c7c","sha512":"9632de6b2be8ad02877604bbcc78691e1b9a8563829b84dbccd57aa412eaf0ff8f3496dcff52ef3d49b1e6b1376c0aa10bc8463e2dad057601863b6e6c588fb6","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"Au3Info_x64.exe","file_path":null,"file_size":229185,"md5":"869db2f60fcf6d5e7a2f20745bf61ad1","sha1":"cbe44428cb98811be9ade24e5b32256645f0e267","sha256":"55bafee65642c8110f77d8703f7a34d9b94e07e1030f73a0f4eb2597fff74705","sha512":"5b14bb2de90c820c187331bbf9605255051aa5a3c98e1f7669c46327fd4a3c6580a60fcb7d06fd3b436de3ad9ce00ddcd21dc0b6dc53e0abf82de6ee3d1fc12d","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"AutoItX3.PowerShell.dll","file_path":null,"file_size":51001,"md5":"2e2daf56ab8014082ba41968539efc0e","sha1":"d9b482ba7e6ca6b6bc6fb15f49918a6d28420bc8","sha256":"3a3b39a04f221a1dc704933f7e253ddefefe825b9c13135458d5fd25017a2197","sha512":"66a9e7357c993a1b72bf4c65e07c99e3960a91d8736ba9f528903a40f5da3c958770811539d44e0312e51abc371b3bcfd384ee0a04135c10970e1590cb05f7d3","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"RTC.der","file_path":null,"file_size":1123,"md5":"ace68d7fd81fbf43e64755f839f5bdf1","sha1":"4124f2035653ebf1acee11dda5c5532f88d23e03","sha256":"09dc6c272749d158ba22c1f94da6696f1d05238a7c7bf0a92b94003067f73daf","sha512":"5df85999772a4c7e585c81f4c1e0c29d477af2311af687092b54b70d052cc14000d6524ebf311b31884f31f2e8cc7e41279d3635018b1f0b8e95024abcf5b136","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"Au3Info.exe","file_path":null,"file_size":209217,"md5":"d4d4212c53f1c06194939aeab583d0d1","sha1":"aca6bd78569f5bb6f3aa7e7c2e08cd0896825860","sha256":"9585e16c9cef141694c7fa35f44d49546d6a4a16027b3d85c0a3550003135c44","sha512":"1b47ef5703f6c23c150d3bc8f3f8a5ecb746c8672bd901a6fd8ba5481a613c6bf0f19034fe2406163e2fe5cb7f775f7e4031587f6e7194f637d6e9b684655a27","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"AcroTextExtractor.exe","file_path":null,"file_size":46065,"md5":"b49507f0d1f749ed19a3d407adb02c38","sha1":"89c8db70373c46a5395fa4caaff8abe779b2885e","sha256":"f18d8aa06a8b16c3fa049286feef095ef102087b9f4b99c77372cb36682adcb0","sha512":"0c4508745917716ad7acc6127b36cd2a764d251471810424406ea9ab647eb3fa09b6665cffd49fd7c05d360fa3d20a0754163e5f81559c0a8e613eb625603f3b","type_tags":["unknown"],"description":null,"runtime_process":null,"threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null}],"file_metadata":{"file_compositions":[],"imported_objects":[],"file_analysis":[],"total_file_compositions_imports":null},"processes":[{"uid":"00040016-00003344","parentuid":null,"name":"f1d0df0e6b4e050703056fa3cad9b690c45ee7d239d5a45faf3e0cdf6b0ebd20.bin.exe","normalized_path":"C:\\f1d0df0e6b4e050703056fa3cad9b690c45ee7d239d5a45faf3e0cdf6b0ebd20.bin.exe","command_line":null,"sha256":"f1d0df0e6b4e050703056fa3cad9b690c45ee7d239d5a45faf3e0cdf6b0ebd20","av_label":"Gen:Variant.Jacard","av_matched":37,"av_total":69,"pid":"3344","icon":"$25","process_flags":[{"name":"Extracted Streams","data":null},{"name":"Multiscan Match","data":"37/69"}]},{"uid":"00041352-00003228","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C cscript //e:vbscript //nologo \"%TEMP%\\temp.txt\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3228","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00041360-00004440","parentuid":"00041352-00003228","name":"cscript.exe","normalized_path":"%WINDIR%\\System32\\cscript.exe","command_line":"cscript //e:vbscript //nologo \"%TEMP%\\temp.txt\"","sha256":"4792c0eb4f975d7130d589c81f39e537657381de09de0e41fd801249c1b136cb","av_label":null,"av_matched":null,"av_total":null,"pid":"4440","icon":null,"process_flags":[{"name":"Logged Script Calls","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00042914-00002812","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2812","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00042921-00003924","parentuid":"00042914-00002812","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"3924","icon":null,"process_flags":[{"name":"Extracted Streams","data":null}]},{"uid":"00043252-00002572","parentuid":"00042914-00002812","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"2572","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00043278-00004716","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"4716","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00043286-00002728","parentuid":"00043278-00004716","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"2728","icon":null,"process_flags":[{"name":"Extracted Streams","data":null}]},{"uid":"00043689-00004740","parentuid":"00043278-00004716","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"4740","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00043786-00004644","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"4644","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00043806-00004788","parentuid":"00043786-00004644","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"4788","icon":null,"process_flags":[{"name":"Extracted Streams","data":null}]},{"uid":"00044519-00004892","parentuid":"00043786-00004644","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"4892","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00044560-00004932","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"4932","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00044609-00004808","parentuid":"00044560-00004932","name":"bcdedit.exe","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"e5bc427ba84627fa84861c54044df8ac3c3b3c3ed3d007265c6b18f588d0ca8a","av_label":null,"av_matched":null,"av_total":null,"pid":"4808","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00044643-00004728","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"4728","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00044672-00005120","parentuid":"00044643-00004728","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"5120","icon":null,"process_flags":[{"name":"Extracted Streams","data":null}]},{"uid":"00045360-00005000","parentuid":"00044643-00004728","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"5000","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00044733-00002104","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C bcdedit /set {default} recoveryenabled no","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2104","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00044795-00005028","parentuid":"00044733-00002104","name":"bcdedit.exe","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled no","sha256":"e5bc427ba84627fa84861c54044df8ac3c3b3c3ed3d007265c6b18f588d0ca8a","av_label":null,"av_matched":null,"av_total":null,"pid":"5028","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00044872-00005232","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C wbadmin delete catalog -quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"5232","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00044920-00005368","parentuid":"00044872-00005232","name":"wbadmin.exe","normalized_path":"%WINDIR%\\System32\\wbadmin.exe","command_line":"wbadmin delete catalog -quiet","sha256":"be527c6085cd944097de35b9740fc4dd24d455567bec596e9cc300d70c5a392d","av_label":null,"av_matched":null,"av_total":null,"pid":"5368","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00045499-00004992","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"4992","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00045528-00005620","parentuid":"00045499-00004992","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"5620","icon":null,"process_flags":[{"name":"Extracted Streams","data":null}]},{"uid":"00046299-00005392","parentuid":"00045499-00004992","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"5392","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00045724-00005632","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C wbadmin delete systemstatebackup","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"5632","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00045781-00005676","parentuid":"00045724-00005632","name":"wbadmin.exe","normalized_path":"%WINDIR%\\System32\\wbadmin.exe","command_line":"wbadmin delete systemstatebackup","sha256":"be527c6085cd944097de35b9740fc4dd24d455567bec596e9cc300d70c5a392d","av_label":null,"av_matched":null,"av_total":null,"pid":"5676","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00046038-00006104","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C wbadmin delete backup","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"6104","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00046091-00005348","parentuid":"00046038-00006104","name":"wbadmin.exe","normalized_path":"%WINDIR%\\System32\\wbadmin.exe","command_line":"wbadmin delete backup","sha256":"be527c6085cd944097de35b9740fc4dd24d455567bec596e9cc300d70c5a392d","av_label":null,"av_matched":null,"av_total":null,"pid":"5348","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00046232-00005316","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C wmic shadowcopy delete","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"5316","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00046285-00005176","parentuid":"00046232-00005316","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","command_line":"wmic shadowcopy delete","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","av_label":null,"av_matched":null,"av_total":null,"pid":"5176","icon":null,"process_flags":[{"name":"Extracted Streams","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00046453-00005788","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"5788","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00046476-00005188","parentuid":"00046453-00005788","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"5188","icon":null,"process_flags":[{"name":"Extracted Streams","data":null}]},{"uid":"00047180-00005460","parentuid":"00046453-00005788","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"5460","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00047226-00005984","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C vssadmin delete shadows /all /quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"5984","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00047269-00005624","parentuid":"00047226-00005984","name":"vssadmin.exe","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","command_line":"vssadmin delete shadows /all /quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","av_label":null,"av_matched":null,"av_total":null,"pid":"5624","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00047356-00005088","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"5088","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00047389-00005660","parentuid":"00047356-00005088","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"5660","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00048156-00000956","parentuid":"00047356-00005088","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"956","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00047445-00005748","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\" /va /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"5748","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00047528-00005152","parentuid":"00047445-00005748","name":"reg.exe","normalized_path":"%WINDIR%\\System32\\reg.exe","command_line":"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\" /va /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","av_label":null,"av_matched":null,"av_total":null,"pid":"5152","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00047635-00003312","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\" /f","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3312","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00047667-00003288","parentuid":"00047635-00003312","name":"reg.exe","normalized_path":"%WINDIR%\\System32\\reg.exe","command_line":"reg delete \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\" /f","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","av_label":null,"av_matched":null,"av_total":null,"pid":"3288","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00047810-00002524","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2524","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00047863-00003952","parentuid":"00047810-00002524","name":"reg.exe","normalized_path":"%WINDIR%\\System32\\reg.exe","command_line":"reg add \"HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\"","sha256":"36414c7e57afa6136d77fd47f4c55102e35f2475fbcd719728da7d14b1590e2a","av_label":null,"av_matched":null,"av_total":null,"pid":"3952","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00048007-00004040","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C attrib \"%userprofile%\\documents\\Default.rdp\" -s -h","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"4040","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00048072-00000904","parentuid":"00048007-00004040","name":"attrib.exe","normalized_path":"%WINDIR%\\System32\\attrib.exe","command_line":"attrib \"%USERPROFILE%\\documents\\Default.rdp\" -s -h","sha256":"db24550c3183fc38f9440134322f124447dfe0a3564490180418305d7899d159","av_label":null,"av_matched":null,"av_total":null,"pid":"904","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00048164-00005992","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C del \"%userprofile%\\documents\\Default.rdp\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"5992","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00048319-00005484","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"5484","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00048343-00005380","parentuid":"00048319-00005484","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"5380","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00048970-00005428","parentuid":"00048319-00005484","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"5428","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00049100-00006008","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"6008","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00049124-00003968","parentuid":"00049100-00006008","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"3968","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00049744-00004092","parentuid":"00049100-00006008","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"4092","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00049873-00002660","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2660","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00049895-00000316","parentuid":"00049873-00002660","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"316","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00050533-00002980","parentuid":"00049873-00002660","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"2980","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00050673-00001036","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"1036","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00050694-00003680","parentuid":"00050673-00001036","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"3680","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00051307-00002256","parentuid":"00050673-00001036","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"2256","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00051445-00003536","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3536","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00051474-00005648","parentuid":"00051445-00003536","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"5648","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00052136-00004180","parentuid":"00051445-00003536","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"4180","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00052263-00004308","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"4308","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00052302-00003424","parentuid":"00052263-00004308","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"3424","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00052950-00001736","parentuid":"00052263-00004308","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"1736","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00053078-00002152","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"2152","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00053096-00002088","parentuid":"00053078-00002152","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"2088","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00053762-00003292","parentuid":"00053078-00002152","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"3292","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00053912-00003884","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3884","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00053929-00004232","parentuid":"00053912-00003884","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"4232","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00054549-00002804","parentuid":"00053912-00003884","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"2804","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00054693-00001704","parentuid":"00040016-00003344","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C chcp 1250 && net view","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"1704","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00054718-00003888","parentuid":"00054693-00001704","name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"3888","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00055410-00003792","parentuid":"00054693-00001704","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"net view","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"3792","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00056374-00002932","parentuid":null,"name":"chcp.com","normalized_path":"%WINDIR%\\System32\\chcp.com","command_line":"chcp 1250","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","av_label":null,"av_matched":0,"av_total":93,"pid":"2932","icon":"$26","process_flags":[{"name":"Reduced Monitoring","data":null}]}],"mitre_attcks":[{"tactic":"Execution","technique":"Service Execution","attck_id":"T1035","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Opened the service control manager"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Execution","technique":"Windows Management Instrumentation","attck_id":"T1047","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Contains references to WMI/WMIC","Reads system information using Windows Management Instrumentation Commandline (WMIC)"],"informative_identifiers_count":1,"informative_identifiers":["Executes WMI queries"],"parent":null},{"tactic":"Persistence","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attck_id":"T1215","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains ability to enumerate processes/modules/threads"],"informative_identifiers_count":1,"informative_identifiers":["Opens the Kernel Security Device Driver (KsecDD) of Windows"],"parent":null},{"tactic":"Privilege Escalation","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Writes data to a remote process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1107","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","malicious_identifiers_count":4,"malicious_identifiers":["Deletes system state backups (often used by ransomware)","Deletes backup catalog","Tries to delete registry keys using reg.exe","Deletes volume snapshots (often used by ransomware)"],"suspicious_identifiers_count":1,"suspicious_identifiers":["Marks file for deletion"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Writes data to a remote process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"Code Signing","attck_id":"T1116","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["The input sample is signed with a certificate"],"parent":null},{"tactic":"Credential Access","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Installs hooks/patches the running process"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"File and Directory Discovery","attck_id":"T1083","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Contains ability to query volume size"],"parent":null},{"tactic":"Discovery","technique":"System Time Discovery","attck_id":"T1124","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":2,"informative_identifiers":["Contains ability to query machine time","Contains ability to query the machine timezone"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Reads the cryptographic machine GUID","Reads information about supported languages"],"informative_identifiers_count":2,"informative_identifiers":["Monitors specific registry key for changes","Reads the active computer name"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Queries process information"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"System Information Discovery","attck_id":"T1082","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Contains ability to query CPU information"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attck_id":"T1076","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":3,"suspicious_identifiers":["Changes the attributes of the Desktop.rdp configuration file","Reads terminal service related keys (often RDP related)","Sets terminal service related keys (often RDP related)"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Exfiltration","technique":"Data Compressed","attck_id":"T1002","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Matched Compiler/Packer signature"],"parent":null}],"network_mode":"tor","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"api-10","type":6,"relevance":6,"name":"Queries kernel debugger information","description":"\"wbadmin.exe\" at 00044920-00005368-00000105-163804099850\n \"WMIC.exe\" at 00046285-00005176-00000105-208672808772\n \"vssadmin.exe\" at 00047269-00005624-00000105-239747319699","description_v2":["\"wbadmin.exe\" at 00044920-00005368-00000105-163804099850","\"WMIC.exe\" at 00046285-00005176-00000105-208672808772","\"vssadmin.exe\" at 00047269-00005624-00000105-239747319699"],"description_v3":[{"type":"text","value":"\"wbadmin.exe\" at 00044920-00005368-00000105-163804099850"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" at 00046285-00005176-00000105-208672808772"},{"type":"linebreak"},{"type":"text","value":"\"vssadmin.exe\" at 00047269-00005624-00000105-239747319699"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"stream-4","type":1,"relevance":1,"name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00042921-00003924-49343-41-00CF1E27\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00043286-00002728-52959-40-00381E27\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00043806-00004788-57808-40-00D31E27\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00044672-00005120-62440-40-00F71E27\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00045528-00005620-2885-40-00E31E27\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00046476-00005188-36509-40-00731E27","description_v2":["SetUnhandledExceptionFilter@KERNEL32.DLL at 00042921-00003924-49343-41-00CF1E27","SetUnhandledExceptionFilter@KERNEL32.DLL at 00043286-00002728-52959-40-00381E27","SetUnhandledExceptionFilter@KERNEL32.DLL at 00043806-00004788-57808-40-00D31E27","SetUnhandledExceptionFilter@KERNEL32.DLL at 00044672-00005120-62440-40-00F71E27","SetUnhandledExceptionFilter@KERNEL32.DLL at 00045528-00005620-2885-40-00E31E27","SetUnhandledExceptionFilter@KERNEL32.DLL at 00046476-00005188-36509-40-00731E27"],"description_v3":[{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00042921-00003924-49343-41-00CF1E27","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00042921-00003924-49343-41-00CF1E27?childUid=00042921-00003924","process":{"name":"chcp.com","process_uid":"00042921-00003924","pid":"3924"}},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00043286-00002728-52959-40-00381E27","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00043286-00002728-52959-40-00381E27?childUid=00043286-00002728","process":{"name":"chcp.com","process_uid":"00043286-00002728","pid":"2728"}},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00043806-00004788-57808-40-00D31E27","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00043806-00004788-57808-40-00D31E27?childUid=00043806-00004788","process":{"name":"chcp.com","process_uid":"00043806-00004788","pid":"4788"}},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00044672-00005120-62440-40-00F71E27","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00044672-00005120-62440-40-00F71E27?childUid=00044672-00005120","process":{"name":"chcp.com","process_uid":"00044672-00005120","pid":"5120"}},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00045528-00005620-2885-40-00E31E27","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00045528-00005620-2885-40-00E31E27?childUid=00045528-00005620","process":{"name":"chcp.com","process_uid":"00045528-00005620","pid":"5620"}},{"type":"linebreak"},{"type":"text","value":"SetUnhandledExceptionFilter@KERNEL32.DLL"},{"type":"stream","stream_uid":"00046476-00005188-36509-40-00731E27","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00046476-00005188-36509-40-00731E27?childUid=00046476-00005188","process":{"name":"chcp.com","process_uid":"00046476-00005188","pid":"5188"}}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":{"modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00042921-00003924-49343-41-00CF1E27?childUid=00042921-00003924","name":"chcp.com","pid":3924}},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Reverse Engineering","identifier":"static-5","type":0,"relevance":10,"name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero","description_v2":["Raw size of \".bss\" is zero","Raw size of \".tls\" is zero"],"description_v3":[{"type":"text","value":"Raw size of \".bss\" is zero"},{"type":"linebreak"},{"type":"text","value":"Raw size of \".tls\" is zero"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-2","type":1,"relevance":1,"name":"Contains ability to query machine time","description":"GetLocalTime@kernel32.dll at 14302-1990-00406904\n GetLocalTime@KERNEL32.DLL at 00040016-00003344-27154-683-0040976C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00042921-00003924-49343-21-00CF1D91\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00043286-00002728-52959-20-00381D91\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00043806-00004788-57808-20-00D31D91\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00044672-00005120-62440-20-00F71D91\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00045528-00005620-2885-20-00E31D91\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00046476-00005188-36509-20-00731D91","description_v2":["GetLocalTime@kernel32.dll at 14302-1990-00406904","GetLocalTime@KERNEL32.DLL at 00040016-00003344-27154-683-0040976C","GetSystemTimeAsFileTime@KERNEL32.DLL at 00042921-00003924-49343-21-00CF1D91","GetSystemTimeAsFileTime@KERNEL32.DLL at 00043286-00002728-52959-20-00381D91","GetSystemTimeAsFileTime@KERNEL32.DLL at 00043806-00004788-57808-20-00D31D91","GetSystemTimeAsFileTime@KERNEL32.DLL at 00044672-00005120-62440-20-00F71D91","GetSystemTimeAsFileTime@KERNEL32.DLL at 00045528-00005620-2885-20-00E31D91","GetSystemTimeAsFileTime@KERNEL32.DLL at 00046476-00005188-36509-20-00731D91"],"description_v3":[{"type":"text","value":"GetLocalTime@kernel32.dll"},{"type":"stream","stream_uid":"14302-1990-00406904","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/14302-1990-00406904","process":null},{"type":"linebreak"},{"type":"text","value":"GetLocalTime@KERNEL32.DLL"},{"type":"stream","stream_uid":"00040016-00003344-27154-683-0040976C","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00040016-00003344-27154-683-0040976C","process":{"name":"f1d0df0e6b4e050703056fa3cad9b690c45ee7d239d5a45faf3e0cdf6b0ebd20.bin.exe","process_uid":"00040016-00003344","pid":"3344"}},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"stream","stream_uid":"00042921-00003924-49343-21-00CF1D91","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00042921-00003924-49343-21-00CF1D91?childUid=00042921-00003924","process":{"name":"chcp.com","process_uid":"00042921-00003924","pid":"3924"}},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"stream","stream_uid":"00043286-00002728-52959-20-00381D91","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00043286-00002728-52959-20-00381D91?childUid=00043286-00002728","process":{"name":"chcp.com","process_uid":"00043286-00002728","pid":"2728"}},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"stream","stream_uid":"00043806-00004788-57808-20-00D31D91","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00043806-00004788-57808-20-00D31D91?childUid=00043806-00004788","process":{"name":"chcp.com","process_uid":"00043806-00004788","pid":"4788"}},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"stream","stream_uid":"00044672-00005120-62440-20-00F71D91","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00044672-00005120-62440-20-00F71D91?childUid=00044672-00005120","process":{"name":"chcp.com","process_uid":"00044672-00005120","pid":"5120"}},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"stream","stream_uid":"00045528-00005620-2885-20-00E31D91","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00045528-00005620-2885-20-00E31D91?childUid=00045528-00005620","process":{"name":"chcp.com","process_uid":"00045528-00005620","pid":"5620"}},{"type":"linebreak"},{"type":"text","value":"GetSystemTimeAsFileTime@KERNEL32.DLL"},{"type":"stream","stream_uid":"00046476-00005188-36509-20-00731D91","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00046476-00005188-36509-20-00731D91?childUid=00046476-00005188","process":{"name":"chcp.com","process_uid":"00046476-00005188","pid":"5188"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","stream_data":{"modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/14302-1990-00406904","name":"f1d0df0e6b4e050703056fa3cad9b690c45ee7d239d5a45faf3e0cdf6b0ebd20.bin.exe","pid":3344}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-48","type":1,"relevance":1,"name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 42172-1944-10024254","description_v2":["GetTimeZoneInformation@KERNEL32.dll at 42172-1944-10024254"],"description_v3":[{"type":"text","value":"GetTimeZoneInformation@KERNEL32.dll at 42172-1944-10024254"}],"origin":"Hybrid Analysis Technology","attck_id":"T1124","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-3","type":1,"relevance":1,"name":"Contains ability to query the machine version","description":"GetVersionExA@kernel32.dll at 14302-2299-0040693C\n GetVersionExA@KERNEL32.DLL at 00040016-00003344-27154-971-0040BC84","description_v2":["GetVersionExA@kernel32.dll at 14302-2299-0040693C","GetVersionExA@KERNEL32.DLL at 00040016-00003344-27154-971-0040BC84"],"description_v3":[{"type":"text","value":"GetVersionExA@kernel32.dll"},{"type":"stream","stream_uid":"14302-2299-0040693C","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/14302-2299-0040693C","process":null},{"type":"linebreak"},{"type":"text","value":"GetVersionExA@KERNEL32.DLL"},{"type":"stream","stream_uid":"00040016-00003344-27154-971-0040BC84","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00040016-00003344-27154-971-0040BC84","process":{"name":"f1d0df0e6b4e050703056fa3cad9b690c45ee7d239d5a45faf3e0cdf6b0ebd20.bin.exe","process_uid":"00040016-00003344","pid":"3344"}}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":{"modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/14302-2299-0040693C","name":"f1d0df0e6b4e050703056fa3cad9b690c45ee7d239d5a45faf3e0cdf6b0ebd20.bin.exe","pid":3344}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-37","type":1,"relevance":3,"name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@kernel32.dll at 14302-1979-004068CC\n GetDiskFreeSpaceA@KERNEL32.DLL at 00040016-00003344-27154-673-00408538","description_v2":["GetDiskFreeSpaceA@kernel32.dll at 14302-1979-004068CC","GetDiskFreeSpaceA@KERNEL32.DLL at 00040016-00003344-27154-673-00408538"],"description_v3":[{"type":"text","value":"GetDiskFreeSpaceA@kernel32.dll"},{"type":"stream","stream_uid":"14302-1979-004068CC","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/14302-1979-004068CC","process":null},{"type":"linebreak"},{"type":"text","value":"GetDiskFreeSpaceA@KERNEL32.DLL"},{"type":"stream","stream_uid":"00040016-00003344-27154-673-00408538","modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/00040016-00003344-27154-673-00408538","process":{"name":"f1d0df0e6b4e050703056fa3cad9b690c45ee7d239d5a45faf3e0cdf6b0ebd20.bin.exe","process_uid":"00040016-00003344","pid":"3344"}}],"origin":"Hybrid Analysis Technology","attck_id":"T1083","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","stream_data":{"modal_link":"/bff/report/5c5b30387ca3e1653d1b1d33/processes/00040016-00003344/streams/0/14302-1979-004068CC","name":"f1d0df0e6b4e050703056fa3cad9b690c45ee7d239d5a45faf3e0cdf6b0ebd20.bin.exe","pid":3344}},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-56","type":6,"relevance":10,"name":"Executes WMI queries","description":"\"WMIC.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\"\n \"WMIC.exe\" issued a query \"$objects\"","description_v2":["\"WMIC.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\"","\"WMIC.exe\" issued a query \"$objects\""],"description_v3":[{"type":"text","value":"\"WMIC.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\""},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" issued a query \"$objects\""}],"origin":"API Call","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-39","type":1,"relevance":10,"name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"je 10024458h\" at 42172-1944-10024254","description_v2":["Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"je 10024458h\" at 42172-1944-10024254"],"description_v3":[{"type":"text","value":"Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"je 10024458h\" at 42172-1944-10024254"}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"stream-31","type":1,"relevance":1,"name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 42172-1433-10014418\n GetProcessHeap@KERNEL32.dll at 42172-1434-100144F1\n GetProcessHeap@KERNEL32.dll at 42172-1389-100144C5\n GetProcessHeap@KERNEL32.dll at 42172-2554-10005946\n GetProcessHeap@KERNEL32.dll at 42172-1985-100248BC","description_v2":["GetProcessHeap@KERNEL32.dll at 42172-1433-10014418","GetProcessHeap@KERNEL32.dll at 42172-1434-100144F1","GetProcessHeap@KERNEL32.dll at 42172-1389-100144C5","GetProcessHeap@KERNEL32.dll at 42172-2554-10005946","GetProcessHeap@KERNEL32.dll at 42172-1985-100248BC"],"description_v3":[{"type":"text","value":"GetProcessHeap@KERNEL32.dll at 42172-1433-10014418"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.dll at 42172-1434-100144F1"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.dll at 42172-1389-100144C5"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.dll at 42172-2554-10005946"},{"type":"linebreak"},{"type":"text","value":"GetProcessHeap@KERNEL32.dll at 42172-1985-100248BC"}],"origin":"Hybrid Analysis Technology","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"External Systems","identifier":"suricata-0","type":18,"relevance":10,"name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\"","description_v2":["Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\""],"description_v3":[{"type":"text","value":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\""}],"origin":"Suricata Alerts","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"network-0","type":7,"relevance":1,"name":"Contacts domains","description":"\"ocsp.startssl.com\"\n \"evcs-ocsp.ws.symantec.com\"","description_v2":["\"ocsp.startssl.com\"","\"evcs-ocsp.ws.symantec.com\""],"description_v3":[{"type":"text","value":"\"ocsp.startssl.com\""},{"type":"linebreak"},{"type":"text","value":"\"evcs-ocsp.ws.symantec.com\""}],"origin":"Network Traffic","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-7","type":2,"relevance":1,"name":"Contains PDB pathways","description":"\"chcp.pdb\"\n \"WMIC.pdb\"\n \"adoberfp.pdb\"","description_v2":["\"chcp.pdb\"","\"WMIC.pdb\"","\"adoberfp.pdb\""],"description_v3":[{"type":"text","value":"\"chcp.pdb\""},{"type":"linebreak"},{"type":"text","value":"\"WMIC.pdb\""},{"type":"linebreak"},{"type":"text","value":"\"adoberfp.pdb\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-4","type":6,"relevance":1,"name":"Creates a writable file in a temporary directory","description":"\" Microsoft\"","\"CCEnhancer-4.5.1.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","\"adoberfp.dll\" was detected as \"Borland Delphi 3.0 (???)\"","\"ccme_ecc.dll\" was detected as \"Borland Delphi 3.0 (???)\"","\"AdobeXMP.dll\" was detected as \"Borland Delphi 3.0 (???)\"","\"logsession.dll\" was detected as \"Borland Delphi 3.0 (???)\"","\"Acrofx32.dll\" was detected as \"Borland Delphi 3.0 (???)\"","\"ccme_base_non_fips.dll\" was detected as \"Borland Delphi 3.0 (???)\"","\"Eula.exe\" was detected as \"VC8 -> Microsoft Corporation\"","\"arh.exe\" was detected as \"VC8 -> Microsoft Corporation\"","\"ccme_asym.dll\" was detected as \"Borland Delphi 3.0 (???)\"","\"Au3Check.exe\" was detected as \"VC8 -> Microsoft Corporation\"","\"BIB.dll\" was detected as \"Borland Delphi 3.0 (???)\"","\"AutoItX3.dll\" was detected as \"Borland Delphi 3.0 (???)\"","\"nppdf32.dll\" was detected as \"Borland Delphi 3.0 (???)\"","\"ccme_base.dll\" was detected as \"Borland Delphi 3.0 (???)\""],"description_v3":[{"type":"text","value":"\"f1d0df0e6b4e050703056fa3cad9b690c45ee7d239d5a45faf3e0cdf6b0ebd20.bin\" was detected as \"EXE -> \""},{"type":"linebreak"},{"type":"text","value":"\"CHCP.COM.5C5B4381.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\""},{"type":"linebreak"},{"type":"text","value":"\"CCEnhancer-4.5.1.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\""},{"type":"linebreak"},{"type":"text","value":"\"adoberfp.dll\" was detected as \"Borland Delphi 3.0 (???)\""},{"type":"linebreak"},{"type":"text","value":"\"ccme_ecc.dll\" was detected as \"Borland Delphi 3.0 (???)\""},{"type":"linebreak"},{"type":"text","value":"\"AdobeXMP.dll\" was detected as \"Borland Delphi 3.0 (???)\""},{"type":"linebreak"},{"type":"text","value":"\"logsession.dll\" was detected as \"Borland Delphi 3.0 (???)\""},{"type":"linebreak"},{"type":"text","value":"\"Acrofx32.dll\" was detected as \"Borland Delphi 3.0 (???)\""},{"type":"linebreak"},{"type":"text","value":"\"ccme_base_non_fips.dll\" was detected as \"Borland Delphi 3.0 (???)\""},{"type":"linebreak"},{"type":"text","value":"\"Eula.exe\" was detected as \"VC8 -> Microsoft Corporation\""},{"type":"linebreak"},{"type":"text","value":"\"arh.exe\" was detected as \"VC8 -> Microsoft Corporation\""},{"type":"linebreak"},{"type":"text","value":"\"ccme_asym.dll\" was detected as \"Borland Delphi 3.0 (???)\""},{"type":"linebreak"},{"type":"text","value":"\"Au3Check.exe\" was detected as \"VC8 -> Microsoft Corporation\""},{"type":"linebreak"},{"type":"text","value":"\"BIB.dll\" was detected as \"Borland Delphi 3.0 (???)\""},{"type":"linebreak"},{"type":"text","value":"\"AutoItX3.dll\" was detected as \"Borland Delphi 3.0 (???)\""},{"type":"linebreak"},{"type":"text","value":"\"nppdf32.dll\" was detected as \"Borland Delphi 3.0 (???)\""},{"type":"linebreak"},{"type":"text","value":"\"ccme_base.dll\" was detected as \"Borland Delphi 3.0 (???)\""}],"origin":"Static Parser","attck_id":"T1002","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Detection/Stealthyness","identifier":"api-9","type":6,"relevance":4,"name":"Queries process information","description":"\"