e9990afaf1340427b79813dc6db13cbfe81614e4bc9e57855a93b3506f1e1995

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 03:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pcvisit_15_SiT_K-Modul.exe
Size 8.0MB
Sample260728-dndfmsak5z
SHA256 e9990afaf1340427b79813dc6db13cbfe81614e4bc9e57855a93b3506f1e1995
MD5 54cf29ecac4c2207b5e248289cbe6569
SHA1 f7b85ad3e0ed49a865b9be58882e19e210b1ddf5
SHA512 8ae75028e334dee663f8e44a6c0108c8fec16a426f934d6d2934779a655a123bf672a2f5e454ddfb4a63ab68fbbadfa5adfa8b53b771aed9cfe607a739e67f54
SSDEEP 196608:BG2R46Lu3/UBkOuTNacE1Wvtn6xf3CHzEBn/iW9AnQ:1R466sB0TNaBOtnaqHzCiWP
TLSH
T1A486337E95ED1880D06CBEF3C8E13DDA95691F1DF0D203E6D5B8B82D28981A327DE245
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000d00000001c4f2-11.dat	acprotect

Executes dropped EXE 5 IoCs

pid	Process
4848	pcvisit_client.exe
5376	pcvisit_client.exe
1596	pcvisit_client.exe
5844	pcvisit_client.exe
5572	pcvisit_client.exe

Loads dropped DLL 64 IoCs

pid	Process
1536	pcvisit_15_SiT_K-Modul.exe
1536	pcvisit_15_SiT_K-Modul.exe
1536	pcvisit_15_SiT_K-Modul.exe
1536	pcvisit_15_SiT_K-Modul.exe
1536	pcvisit_15_SiT_K-Modul.exe
1536	pcvisit_15_SiT_K-Modul.exe
1536	pcvisit_15_SiT_K-Modul.exe
1536	pcvisit_15_SiT_K-Modul.exe
1536	pcvisit_15_SiT_K-Modul.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
1536	pcvisit_15_SiT_K-Modul.exe
1536	pcvisit_15_SiT_K-Modul.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
5376	pcvisit_client.exe
5376	pcvisit_client.exe
5376	pcvisit_client.exe
5376	pcvisit_client.exe
5376	pcvisit_client.exe
5376	pcvisit_client.exe
5376	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
5376	pcvisit_client.exe
4848	pcvisit_client.exe
5376	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
1596	pcvisit_client.exe
1596	pcvisit_client.exe
1596	pcvisit_client.exe
1596	pcvisit_client.exe
1596	pcvisit_client.exe
1596	pcvisit_client.exe
1596	pcvisit_client.exe
1596	pcvisit_client.exe
5844	pcvisit_client.exe
5844	pcvisit_client.exe
5844	pcvisit_client.exe
5844	pcvisit_client.exe
5844	pcvisit_client.exe
5844	pcvisit_client.exe
5844	pcvisit_client.exe
5844	pcvisit_client.exe
5844	pcvisit_client.exe
4848	pcvisit_client.exe
1596	pcvisit_client.exe
5844	pcvisit_client.exe
5572	pcvisit_client.exe
5572	pcvisit_client.exe
5572	pcvisit_client.exe
5572	pcvisit_client.exe
5572	pcvisit_client.exe
5572	pcvisit_client.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c4f2-11.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcvisit_client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcvisit_client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcvisit_client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcvisit_15_SiT_K-Modul.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcvisit_client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcvisit_client.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	pcvisit_client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pcvisit_client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pcvisit_client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pcvisit_client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	pcvisit_client.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pcvisit_client.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	pcvisit_client.exe

Modifies data under HKEY_USERS 33 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent\	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	pcvisit_client.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\pcvisit Software (caloa)\SharedConfig\connectTo	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	wmic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\Consent\	pcvisit_client.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\Consent\pcvisit_client.exe = "4"	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wmic.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\pcvisit Software (caloa)\pcvisit client\priv_STARTED_AS_SERVICE_session_0_app_pcvisit client = "/"	pcvisit_client.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\pcvisit Software (caloa)\pcvisit client\priv_STARTED_AS_SERVICE_session_0_app_pcvisit client = "127.0.0.1:18708/"	pcvisit_client.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\wmic.exe\VBScriptSetScriptStateStarted = "240727734"	wmic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wmic.exe	wmic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script	wmic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\wmic.exe	wmic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\Consent	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\pcvisit Software (caloa)\SharedConfig	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Consent\	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	pcvisit_client.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\pcvisit Software (caloa)\pcvisit client\priv_STARTED_BY_USER_LEVELD_AS_NON_INTERACTIVE_session_1_app_pcvisit client = "/"	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	wmic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry	wmic.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting	pcvisit_client.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\Windows Error Reporting\Consent\pcvisit_client.exe = "4"	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\pcvisit Software (caloa)	pcvisit_client.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\pcvisit Software (caloa)\SharedConfig\connectTo	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\pcvisit Software (caloa)\pcvisit client	pcvisit_client.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\pcvisit Software (caloa)\pcvisit client\priv_STARTED_BY_USER_LEVELD_AS_NON_INTERACTIVE_session_1_app_pcvisit client = "127.0.0.1:48457/"	pcvisit_client.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	pcvisit_client.exe

Suspicious behavior: AddClipboardFormatListener 5 IoCs

pid	Process
4848	pcvisit_client.exe
5376	pcvisit_client.exe
5844	pcvisit_client.exe
1596	pcvisit_client.exe
5572	pcvisit_client.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
2112	wmic.exe
2112	wmic.exe
2112	wmic.exe
2112	wmic.exe
5300	wmic.exe
5300	wmic.exe
5300	wmic.exe
5300	wmic.exe
1804	wmic.exe
1804	wmic.exe
4752	wmic.exe
4752	wmic.exe
1804	wmic.exe
1804	wmic.exe
4752	wmic.exe
4752	wmic.exe
5376	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
5376	pcvisit_client.exe
2784	wmic.exe
2784	wmic.exe
2784	wmic.exe
2784	wmic.exe
4592	wmic.exe
4592	wmic.exe
4592	wmic.exe
4592	wmic.exe
5844	pcvisit_client.exe
5844	pcvisit_client.exe
1812	wmic.exe
1812	wmic.exe
1812	wmic.exe
1812	wmic.exe
3176	wmic.exe
3176	wmic.exe
3176	wmic.exe
3176	wmic.exe
1596	pcvisit_client.exe
1596	pcvisit_client.exe
3752	wmic.exe
3752	wmic.exe
3752	wmic.exe
3752	wmic.exe
4624	wmic.exe
4624	wmic.exe
4624	wmic.exe
4624	wmic.exe
5572	pcvisit_client.exe
5572	pcvisit_client.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4848	pcvisit_client.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2112	wmic.exe
Token: SeSecurityPrivilege	2112	wmic.exe
Token: SeTakeOwnershipPrivilege	2112	wmic.exe
Token: SeLoadDriverPrivilege	2112	wmic.exe
Token: SeSystemProfilePrivilege	2112	wmic.exe
Token: SeSystemtimePrivilege	2112	wmic.exe
Token: SeProfSingleProcessPrivilege	2112	wmic.exe
Token: SeIncBasePriorityPrivilege	2112	wmic.exe
Token: SeCreatePagefilePrivilege	2112	wmic.exe
Token: SeBackupPrivilege	2112	wmic.exe
Token: SeRestorePrivilege	2112	wmic.exe
Token: SeShutdownPrivilege	2112	wmic.exe
Token: SeDebugPrivilege	2112	wmic.exe
Token: SeSystemEnvironmentPrivilege	2112	wmic.exe
Token: SeRemoteShutdownPrivilege	2112	wmic.exe
Token: SeUndockPrivilege	2112	wmic.exe
Token: SeManageVolumePrivilege	2112	wmic.exe
Token: 33	2112	wmic.exe
Token: 34	2112	wmic.exe
Token: 35	2112	wmic.exe
Token: 36	2112	wmic.exe
Token: SeIncreaseQuotaPrivilege	5300	wmic.exe
Token: SeSecurityPrivilege	5300	wmic.exe
Token: SeTakeOwnershipPrivilege	5300	wmic.exe
Token: SeLoadDriverPrivilege	5300	wmic.exe
Token: SeSystemProfilePrivilege	5300	wmic.exe
Token: SeSystemtimePrivilege	5300	wmic.exe
Token: SeProfSingleProcessPrivilege	5300	wmic.exe
Token: SeIncBasePriorityPrivilege	5300	wmic.exe
Token: SeCreatePagefilePrivilege	5300	wmic.exe
Token: SeBackupPrivilege	5300	wmic.exe
Token: SeRestorePrivilege	5300	wmic.exe
Token: SeShutdownPrivilege	5300	wmic.exe
Token: SeDebugPrivilege	5300	wmic.exe
Token: SeSystemEnvironmentPrivilege	5300	wmic.exe
Token: SeRemoteShutdownPrivilege	5300	wmic.exe
Token: SeUndockPrivilege	5300	wmic.exe
Token: SeManageVolumePrivilege	5300	wmic.exe
Token: 33	5300	wmic.exe
Token: 34	5300	wmic.exe
Token: 35	5300	wmic.exe
Token: 36	5300	wmic.exe
Token: SeIncreaseQuotaPrivilege	2112	wmic.exe
Token: SeSecurityPrivilege	2112	wmic.exe
Token: SeTakeOwnershipPrivilege	2112	wmic.exe
Token: SeLoadDriverPrivilege	2112	wmic.exe
Token: SeSystemProfilePrivilege	2112	wmic.exe
Token: SeSystemtimePrivilege	2112	wmic.exe
Token: SeProfSingleProcessPrivilege	2112	wmic.exe
Token: SeIncBasePriorityPrivilege	2112	wmic.exe
Token: SeCreatePagefilePrivilege	2112	wmic.exe
Token: SeBackupPrivilege	2112	wmic.exe
Token: SeRestorePrivilege	2112	wmic.exe
Token: SeShutdownPrivilege	2112	wmic.exe
Token: SeDebugPrivilege	2112	wmic.exe
Token: SeSystemEnvironmentPrivilege	2112	wmic.exe
Token: SeRemoteShutdownPrivilege	2112	wmic.exe
Token: SeUndockPrivilege	2112	wmic.exe
Token: SeManageVolumePrivilege	2112	wmic.exe
Token: 33	2112	wmic.exe
Token: 34	2112	wmic.exe
Token: 35	2112	wmic.exe
Token: 36	2112	wmic.exe
Token: SeIncreaseQuotaPrivilege	5300	wmic.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe

Suspicious use of SendNotifyMessage 28 IoCs

pid	Process
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4848	pcvisit_client.exe
5376	pcvisit_client.exe
5844	pcvisit_client.exe
1596	pcvisit_client.exe
5572	pcvisit_client.exe
5572	pcvisit_client.exe
5572	pcvisit_client.exe
4848	pcvisit_client.exe
4848	pcvisit_client.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 4848	1536	pcvisit_15_SiT_K-Modul.exe	89
PID 1536 wrote to memory of 5376	1536	pcvisit_15_SiT_K-Modul.exe	90
PID 4848 wrote to memory of 2112	4848	pcvisit_client.exe	91
PID 5376 wrote to memory of 5300	5376	pcvisit_client.exe	93
PID 5376 wrote to memory of 4752	5376	pcvisit_client.exe	96
PID 4848 wrote to memory of 1804	4848	pcvisit_client.exe	97
PID 5844 wrote to memory of 2784	5844	pcvisit_client.exe	103
PID 5844 wrote to memory of 4592	5844	pcvisit_client.exe	105
PID 1596 wrote to memory of 1812	1596	pcvisit_client.exe	107
PID 1596 wrote to memory of 3176	1596	pcvisit_client.exe	109
PID 1596 wrote to memory of 5572	1596	pcvisit_client.exe	111
PID 5572 wrote to memory of 3752	5572	pcvisit_client.exe	112
PID 5572 wrote to memory of 4624	5572	pcvisit_client.exe	114

C:\Users\Admin\AppData\Local\Temp\pcvisit_15_SiT_K-Modul.exe
"C:\Users\Admin\AppData\Local\Temp\pcvisit_15_SiT_K-Modul.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\pcvisit_client.exe
  "C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\pcvisit_client.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic os
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic logicaldisk where "deviceid = 'c:'" get volumeserialnumber,freespace
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1804
- C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\pcvisit_client.exe
  "C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\pcvisit_client.exe" --StartMode AsLiftRightsForClient
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5376
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic os
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5300
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic logicaldisk where "deviceid = 'c:'" get volumeserialnumber,freespace
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4752

C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\pcvisit_client.exe
"C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\pcvisit_client.exe" --StartMode AsLiftRightsForClient --session 1
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic os
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1812
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic logicaldisk where "deviceid = 'c:'" get volumeserialnumber,freespace
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3176
- C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\pcvisit_client.exe
  --StartMode AsClient --startPrivilege STARTED_BY_USER_LEVELD_AS_NON_INTERACTIVE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic os
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3752
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic logicaldisk where "deviceid = 'c:'" get volumeserialnumber,freespace
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4624

C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\pcvisit_client.exe
"C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\pcvisit_client.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5844
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic os
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2784
- C:\Windows\SysWOW64\Wbem\wmic.exe
  wmic logicaldisk where "deviceid = 'c:'" get volumeserialnumber,freespace
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

768l78nv-p21z-4031-y819-417a5tevok1x.tmp

Path C:\Users\Admin\AppData\Local\Temp\768l78nv-p21z-4031-y819-417a5tevok1x.tmp
Size 10KB
SHA256 fbf0761592dc5b50457df5412ab3042f1533e60a17af73d4be228d77d9b79f7c
MD5 b86367529b69dfb9567796aa1b1fff7f
SHA1 a2a788be8758432b333f883249d3a26b71144ff3
SHA512 15dc0ce41c8fdb78948e52789ca921889c3d6e8c6cac245edb847b1c8908474e0fd1566c52447ee5e1487cd6612bbaece305a4fb3473a8ab2efced4d9d033e00
SSDEEP 192:HcHfriTDURSzkc6A9gNJGTaHcwDsqPncupriTiqaVcFZFP5pVJIJoacJkjkD4qtV:HPTDU8kC9gN0aH5NnITixoTpVJ8B84qD
TLSH
T1D9223CB78F403D892D83D09AE2BF2446CD1845320AEEE0E74D94BC429706D95A79CADE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AccessControl.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf1D24.tmp\AccessControl.dll
Size 8KB
SHA256 8a8f5bafc105186c85f14e017ab6da33ae8f88a9635e51756f90b6d95381d80d
MD5 9f1a88b953fd2a2c23b09703b253186c
SHA1 29d5a5a24e7f782a07e9f5d2ec1d1a6218fec737
SHA512 10b3a812c92b7324bddcd23adf923fcaec2532f31bdd9fbf17494fc33f99aa0a0a48b94f1fdd6599fa0189567626a90b324a1d132bf9cb8b00a6afc547e64018
SSDEEP 192:RmcLe8uWVNz5ZalBK/7rUlYg5q5LcywvX5:RJdNzMKXUlYg5qPq5
TLSH
T1E3029D8643A40179E8730BFC4FAD4C1A1B2EFFB0CBB1569D2158356F6820B1488B6F31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf1D24.tmp\System.dll
Size 11KB
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T113325B5993A0C1F3D5A0823C0DA73A7B1379722016B14FA3CFA35841AE196D7AC7D237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UAC.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf1D24.tmp\UAC.dll
Size 14KB
SHA256 32dd7269abf5a0e5db888e307d9df313e87cef4f1b597965a9d8e00934658822
MD5 4814167aa1c7ec892e84907094646faa
SHA1 a57a5ecbdfa9a8777a3c587f1acb02b783afc5ee
SHA512 fb1f35e393997ecd2301f371892b59574ee6b666095c3a435336160481f6ef7ed5635c90ce5d2cf88e5ef4a5affb46cb841b7d17e7981bd6e998531193f5d067
SSDEEP 384:3A7q72y8XYDSDJe7H+KXKKK2KRKuKZrjVo787foI7:3sygyraXjQ7Zl99
TLSH
T13B626D6652988BFFD321113AB6A333235BE591103770715F4AA36F947C34A93A63D326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf1D24.tmp\nsis7z.dll
Size 171KB
SHA256 ce6fc1b521e64ea89f4532cbd74f06f85d21018ac5196b4f8169627926e40971
MD5 a26d3887a69ea3e03c1cc4367494e080
SHA1 e25b63467aadc27b2ee7daa93ea886c01f90025e
SHA512 97e0343b5c1a478f886132d0a41737e41499485451fe2fa74fa3898ddbb15013ec424a84ecc19426d59e9b9870e283735d29ccba1d73d448e0f3ae320a741a7c
SSDEEP 3072:vOyXSMpGO+JNP7FyE8R2TX/u5IiNNKdTmTfL5sY03tzZaq5bXi:rXSe76tByH87/aIiWdT6fL56tME
TLSH
T122049D2237D0C23AD30F1675DD56EBA166BDF6204A62D58B3F890E6D4F326848F2D706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LIBEAY32.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\LIBEAY32.dll
Size 1.2MB
SHA256 d5d04998f466fb4977857b130fa930f7948d25eb8ea4b94fa610fbe16ade96dc
MD5 25cccdee69d6f04e6bb15901dfbb7372
SHA1 faae6d44c691f3a1534e3afe0c3c8df9f72b87f9
SHA512 269b36aea9702cfda0a0436752e967bb282814a15f4ebee7ba63c285b46b8b4c8ecfb57c521b69eb8567e3eeaf0751a34703a5cd08a042bdb6476b4edc4f1ca6
SSDEEP 24576:EPN+KpPQPxcjGf/eAWeUXJdXtXNwYgWRiHh6JtPpDvJ+8RzBtA3:UUcjG6djMB6JtPpbJ1VBtA3
TLSH
T1F2458D03BB8199B2F5CE427C52B7677E893A46049328CAC39EA578D59C235D1673F3C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCP120.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\MSVCP120.dll
Size 444KB
SHA256 87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
MD5 fd5cabbe52272bd76007b68186ebaf00
SHA1 efd1e306c1092c17f6944cc6bf9a1bfad4d14613
SHA512 1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
SSDEEP 12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
TLSH
T11AA45B237B864CF2D19E53B231C9531557FAFC6441B1F343ABEEE1692FA6282E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Core.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\Qt5Core.dll
Size 4.5MB
SHA256 17ddd791de4ae838dfcec0b5a1e109734a473565ee060ccfca592767baa163cc
MD5 f863c71ecf4b1c406c16909c9c19c86b
SHA1 57282b95914c39b5d5c90a6b4b80b2a973dc1b4e
SHA512 592325ceabacaaaa0612b179ca1ea1b871a326be0bce1ade4d8e5e01d3b1d570762cb0c878a1e5863a766f6520f118000fbc88ecf701522f9e68314b935f7fad
SSDEEP 98304:AUMSpTccoLf3askYfNzWOJsv6tWKFdu9C7D:A7TfNqOJsv6tWKFdu9C7
TLSH
T1E0267DA3E797C1B2FA92827508ABD72A0536AD1587118AD7F34C360798716F13E3F14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Gui.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\Qt5Gui.dll
Size 3.1MB
SHA256 97768839ba01ba5898b7cb9c83bce9986dd7c248f7ff300410319e741fd1cab6
MD5 5a4444035db5b170fa6728457d2ce037
SHA1 a9dcd8d6a4f56166d1ef5c36341555ef1d44d855
SHA512 8fc7e6ff836b0a90a74badeeb9eb2951c3798df8914c0d39fc52bed5cb216d36bba5469bb9951cb44ee4f3260fd2e035284deb3297e3979480595afbb51e77da
SSDEEP 49152:ELIHfye71r6H0jMKfgmpNU5UCyN5oxtOxnZrTsIpYGtU9PgAwhwWPQ:ZPmHqMLmqU9PoxtO5iWP
TLSH
T191E59E93F29310B1C885D2B4795DBB6BC9396119831DC2E3D3F8AD47E5253E22E7B281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Network.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\Qt5Network.dll
Size 801KB
SHA256 3a61ce9aafd766d56a23b476d3dad337fc97c7f1d53aa81bf313091daae92783
MD5 e5c8371a6dc067233762f73d9a792608
SHA1 86c9c42788cf2407ec3d9770b155efd4a8ffc435
SHA512 dd88c27625350bb31fd5660126847207a07b6a27c2d77d9e5a4705200fcf69b54401e11cd12d3f7dd7de0ada0f1c8c5b0075f1062c8ca0ae63b78dc2ea2a4ee3
SSDEEP 12288:/wdk3fHdAEEGhO6tpQ9RaHyfc9McLYdOgKzMjdekRVjUETxlsa+rR+R176ZHpG60:/wdk3fHdsGhTtpnHyk9BM06+S76h0
TLSH
T194053C92FBAE01B3E95483B5461DAB67C17DF11947721AC7A31CAA1A40633E13D3F1E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Svg.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\Qt5Svg.dll
Size 245KB
SHA256 dfbb641536b9757002d6b18d18ba09da39cb307e345399e583b485f5226f4211
MD5 64904587b7ce0af9fd91ef51d1b0d817
SHA1 0aa7fc0799ad26bec05445fe62214f8ec70a5711
SHA512 1ca17c423d62a66433d349eb0fa69e584785ad3dc921013ceed5fb5b470a12b3d37e842232e68dab17fd7cb6581a0e0c006986a7c72179dba8cd42c2c0dd4c0b
SSDEEP 6144:QZpwdWMQEkSinMoh2ItSQx+RGcy8DvcnxNxdtFkMEW/cUwnLD0uxP0n:QZpwwMQrSiM22It9Q29
TLSH
T1A5343B52B2924D71F48BD3785C1F5A17993EA00A037E83EB97E89C21D4683F76DBA341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Qt5Widgets.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\Qt5Widgets.dll
Size 4.3MB
SHA256 fa116d542571d9cf1362eca4e212c672f31209420f136c71a86593a1a20113a0
MD5 31e6b7b43738bf2f302225591ee19f84
SHA1 1615b1863eab3108122da3795794304974ddf0f7
SHA512 f587efd7fb33407254abd0e33afb02f7d75f13aceb5ae3d1cbf5bf0ff18e1eeb9f0a92a1885dbc28413723e6fdcbf416fc666a627755a3b163b5f98d1100a068
SSDEEP 49152:r43/1LOCMOsG2JvZfNSMHX8j5nqg5mSXkRCZYQELHrH+xw1e:Mv1BsGCvmDj7mSH6LHt1e
TLSH
T10C269E92B2C341F5C887D1B40C1EDB53C5B9B1084B5B63D7E39CAE8668E92F11D7A389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SSLEAY32.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\SSLEAY32.dll
Size 289KB
SHA256 47d2641c300bdbdc8d6bfb23e512e96b5b3fc3037b9b761dbcba5f9e664c2a17
MD5 fd6a64e6ae79eb2948fd1af0c7d259c3
SHA1 bf9328be43042d18a4021bf3630ac71a94cfa605
SHA512 d3bf7434907b40aa83b50a92d272b03e1520d9a79c497dbc1f4454bc072467a9af62b3935ec1aa59fdbe21f0cbff1e9213b62f8bd5be39e7d7902543de938a74
SSDEEP 6144:KdKzMrgtJl7mWPbPrelsKkVyuMHgJ8+mbp/e9zSjUYQmuc7VDi3WpV8A4OMKpSJG:K5gtJl7FPbPrelsXVyuMHgJ8+mbp/eVS
TLSH
T1EC547C03F69182E3E4924774117B57BA3D7E6A026369C1C7CBA06D2C8C226D16B3D7ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

application_en.qm

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\application_en.qm
Size 6KB
SHA256 d42b69ce2173dd043ef28346924971a4e5b1f8884a867aad3bffc3726e047554
MD5 3eb00cea2f95c8b81eced08a37745a62
SHA1 4f2b04ad81575110046027ad4d3843f9a3be5778
SHA512 a17a7758685ba07b249cb989747de83be239a0f02ba6c34dffc1b3e45b9afcf8abaaf256d53c44cf24405d941b599f6e7b51a90d19315d4b3c7296d774b6f0ee
SSDEEP 96:EZVMFPEHeklUCcKp+EVgj1VYoy07AKiUfGUPRPtj2s6K62LJqzveH2suF88Fx+Rr:yAEHqqGYMARUd5V76R2Lwy2srt62
TLSH
T1ECD12D5127FD612CF2F37FB5263B51259B76BC666C38CA1E4380A06D0562DA4CE3A327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qgif.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\imageformats\qgif.dll
Size 24KB
SHA256 40a5e7f6770181cad19badbda7b7797d3757e64ef933c7acaaecc7f8dc03ee70
MD5 ba3ce6fcfc283bf6cb39575676524d8f
SHA1 f7c02e826185b6049609937f9e419e0843469580
SHA512 ce60cda89e5b0aca0b67ba810e32ac6e28cee0eaab20dd20d215e50d77ef39bab99c736a236fe6dd3f99b095df60b7e4fa6e0a5e935394c4ab3edc6632c87fb4
SSDEEP 384:It+FIyi2Ib6eCZnOrxJPxuk3IPAVbBNES5IbGbFMI9LQLj3vL1:VFIyi2+OqPxuk3OAVbBNJ5Iy5MwQLDvL
TLSH
T177B25C50B6A581F2E51B17B0B9992F22A63EE3344FD497C3EF43AA251C253E32E71315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qico.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\imageformats\qico.dll
Size 24KB
SHA256 4dbd24c240047bd2cb74fa3272eb759d70a49e82928e37fff2e53c8768c3826d
MD5 e9a6c2bd707fb023586515c4050ab1b7
SHA1 50bc1e42fbf949eae1ce9712120ac5b20d6433ec
SHA512 431e25888a90a9c9f08fcb3a998b37013b603c88543fd945fbad37a638c962a5751ee299a09d7e6169030545d04bd55d0a68b307ba4c4d264d97d83d8397f541
SSDEEP 768:A48YMTq2rtQYPMul+U3hDhB7w41gL6h/Q:nqT13MuoyhDhB7wIgWho
TLSH
T19AB24BA5E21680F2E25B4671395A9F2BE53EB3718BD253C3EF539E1A1C623E25D30305
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qjpeg.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\imageformats\qjpeg.dll
Size 237KB
SHA256 ec5d133a779df567f678699a650e02db3721d8f3fc5cfa481c56c4562e9669b3
MD5 8238aec87ba25fa396e50659820005e6
SHA1 ad29b833e2cfe4f208acb8b70007a2020ceab655
SHA512 0588c369230bd646c0433c2a8a7465591a3db5827585e93b18cf76b5739a966764bfdd57ad1e878c569aff95930b150f7993ae75825bb5c9c6bb6af560d0719e
SSDEEP 6144:1ej12LtcTE485XverqOsiaPB9JhjfVcdy10usnhsu4pzR6Fj1L:0j12ionOfaPB9JhjdIML
TLSH
T14B349E80BBAF16E5CC462975409FBA6B1A34572E0715D1F3D2903D12F821BD3AEB92DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qsvg.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\imageformats\qsvg.dll
Size 18KB
SHA256 2a16661719bc01520eee171496be8bc4fe178f114c91787c44bbb712e69894ea
MD5 97c107797ca94ba6ee07a0c937f8d00a
SHA1 32d8badc946029dabf1f44214b22deba01e795e6
SHA512 5894e1e314e4386bd0cc6db59f279eab8e196b9a32e0e55f8dca192e1d2d7b3d13d7db206ff6d3486a4b41c093ddd811536110164908b72185145349e90b817c
SSDEEP 384:/xmc8kVBGvW2NM3NCKsniy8TwbUKj4I9kgLjJY9JJ:/xmc8kEW2IN95a7j4HgLlY
TLSH
T18F822815B65B90B2D16A93B439584B23E93BF2204BE2D7C39E639E182C793D12E71307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr120.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\msvcr120.dll
Size 948KB
SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 034ccadc1c073e4216e9466b720f9849
SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
TLSH
T10F25BE12B982C0B2C57202B1152DE772197FBA71443598B7BBD98F0E1DB46C0FB67A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcvisit_client.exe

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\pcvisit_client.exe
Size 7.0MB
SHA256 e53615dd382bad0ba357f8c8e66f65a00bdeea0b40bb5f0c8e77aa168fd253eb
MD5 b1ab5e1f52b3c97f021c01808d0c1b47
SHA1 7df9380e122d62774e127b9270681b018018c8e4
SHA512 f411029cc31630e06f47d1dbda2d025eff2dc884cf68cd9e9261a3e5f700885c339451827ee4cc43571075e79fa35c3b4d2f1765a00e029d20b957e0044d5d84
SSDEEP 98304:UanbcngZ4dDysG1RRgRdE7wEBj1auC74rETCkprSkwz6cdGDEORRB+m1uCWF+nxW:Fnd4dD2EElauC74Whp3IXOhuFqx7sUkH
TLSH
T1B9769E333EB9C43EF23383728699A7E696FDA97089735113639486FE1B31483A514D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcvisit_client_en.qm

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\pcvisit_client_en.qm
Size 26KB
SHA256 1aa0394b4c3934d0bae1c59a64f2a0880d23ea26a1208af10acadd442c2219ed
MD5 8d42959add27c0b93000f3020bba0fef
SHA1 c81595d71715d152e6a3d7bdae789ed33f5513d5
SHA512 dc725e806851df42d6864d81ed8a4316bcd4357da8115f1a5dd28df25c24de084a132531722326d6acef7129ea54efff5589f157e0a1c43c154fc444d2c53d63
SSDEEP 192:e2J/wwNJxks5s8AlDoGtnKtspWQPlvKcZ9t454ZQZ34as9SHN1ThxxWdyuw+5boU:e2VNJNgDxpDCcZTVIoRcNVn0KCI+
TLSH
T1BEC2EE422BF9920CF5F63FB8697645255F3ABCA2BC39C62E4244A16E0671E50CC79733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qwindows.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\platforms\qwindows.dll
Size 921KB
SHA256 0d9cf7f7ced5584c6b98d1058520583069336d4ecee7fdcff086307c927bf261
MD5 5d9c99e1677941a21ff652a1e9cf35d1
SHA1 84ec160cd9690e42a0b5c3daec757e1671272cb0
SHA512 3acaed05d3d5e8b975ee4b4f76cd94b858b67a81a4512b6a21439b104746a1cebfa471ae5e725bd3bba793235a8e55bf6d28f506c59b1ca699259f9d5f1f11e9
SSDEEP 24576:WibD/eF21TkQYhChfUT6LlFwh7gExn3LZOWs:TqhAY6Jq3d
TLSH
T186159E81F35601F1D1C742F9103EAB378A36A1060F21D7D7D264B996B9113E3AA7E39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shared_app_elements_en.qm

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\shared_app_elements_en.qm
Size 152KB
SHA256 ff3db0304d97acbe09c90bf4e73f7e4f94f64f1390f2b9154c4d3cec3ef11425
MD5 29c29ed9b674fb81b9ebd6eb659dae34
SHA1 ca3b378423e78198932a3e689055b1be4d0971c1
SHA512 041edd7f91ab338c2570e0ea102737d6f65e9109d534cfa66b78ac8c8b9e25d0c53285a466dfeaecfc54de4e4879674c81c8df89384049464c629e1165edb342
SSDEEP 3072:qymlsG9fn4hRK9xpF3Ab/Fivf/t3hSSqb5/P5:qymaSqB5
TLSH
T175E3ED4127F9111CF5F77F78A97602611E3A7C65BD38D62D0344A06E0A72A90DEFAB23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wodTunnel.dll

Path C:\Users\Admin\AppData\Local\pcvisit Software AG\caloa\pcvisit.Support.guest.15\release\15.0.29.2234\wodTunnel.dll
Size 319KB
SHA256 6b484895bde72a5dcc7d54b1e36acd9477393de020c02e3aeaa4508275d2119c
MD5 5851d43622b7e5a8e1a80132789ed91b
SHA1 21e4b8ee68da37748b35a17ee522f3024617c3bc
SHA512 59be333d67a4ce5b49b5be1587eb3e021e94ee62de6c72f3ab7d4128087a4163d1b5371ddf4a52aff8c9c40c07fb160980c50ecbef6b2204c703daa236cb17c9
SSDEEP 6144:MhLrkOBVrv7c1LbbIMIpcipNojRLiND8fhQqFFelOcfWnQTWE6j0HdiLYx0O4MMq:qLrRAGmiOfhQqFF2LfWaK0HdiLYx0ONH
TLSH
T183647C15E5431872D1A242309AFF66256778A6350EFD9253F78C9BBC2DB12936308F8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1536-23-0x00000000022E0000-0x0000000002311000-memory.dmp

Download

memory/1536-14-0x0000000074EA0000-0x0000000074EAA000-memory.dmp

Download