Edit tour

Windows Analysis Report
Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Overview

General Information

Sample name:	Installer eSPT Masa PPh versi 2.0#U007e26022009.exe renamed because original name is a hash value
Original sample name:	Installer eSPT Masa PPh versi 2.0~26022009.exe
Analysis ID:	1581812
MD5:	0be92f00cc946557bbf1dec87b708224
SHA1:	26dfe06acdb876d3b14535eefd8ede889c1822d4
SHA256:	b13e900d876cc76cd8cb649f56ae984ddb488c97e5b383bc34524e3fec0b7daf
Tags:	exeuser-MAM
Infos:

Detection

BlackMoon

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Suricata IDS alerts for network traffic

Yara detected BlackMoon Ransomware

Connects to many ports of the same IP (likely port scanning)

Contains functionality to detect sleep reduction / modifications

Drops executables to the windows directory (C:\Windows) and starts them

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Creates or modifies windows services

Creates processes with suspicious names

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a global mouse hook

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

Installer eSPT Masa PPh versi 2.0#U007e26022009.exe (PID: 5324 cmdline: "C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe" MD5: 0BE92F00CC946557BBF1DEC87B708224)

Installer eSPT Masa PPh versi 2.0#U007e26022009.exe (PID: 2688 cmdline: "C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe" /i "C:\Program Files (x86)\WindowsInstallerFB\7AF5081\DAN_127.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\BtDDIFUEHLCR" SECONDSEQUENCE="1" CLIENTPROCESSID="5324" AI_MORE_CMD_LINE=1 MD5: 0BE92F00CC946557BBF1DEC87B708224)

msiexec.exe (PID: 7072 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6780 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 1D35FE1868B50914AC73C4C1E92E866C C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 5568 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding D34C0DB36F96DC933127EB55CBA7C9C2 MD5: 9D09DC1EDA745A5F87553048E57620CF)

MSI7DAF.tmp (PID: 7544 cmdline: "C:\Windows\Installer\MSI7DAF.tmp" MD5: BE4ED0D3AA0B2573927A046620106B13)

e8a0d5af432b7e64DBD.exe (PID: 7580 cmdline: "C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\TLGCBXAGVFLQ.KBI" -o"C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1" -pJHKQFETWJKTIHLLBOKO -aos -y MD5: FAE7D0A530279838C8A5731B086A081B)

conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

e8a0d5af432b7e64DBD.exe (PID: 7692 cmdline: "C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\SUGIPFIMNRQE.TMA" -o"C:\Program Files (x86)\BtDDIFUEHLCR" -pMNHWOTMLOHTPVRFXPCH -aos -y MD5: FAE7D0A530279838C8A5731B086A081B)

conhost.exe (PID: 7700 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

e8a0d5af432b7e64DBD.exe (PID: 7784 cmdline: "C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\TMGJRLDUDWLQ.FCU" -o"C:\Users\user\AppData\Roaming" -pPXOEWCVFPIJPLHQSQSX -aos -y MD5: FAE7D0A530279838C8A5731B086A081B)

conhost.exe (PID: 7792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Bor32-update-flase.exe (PID: 7872 cmdline: "C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe" MD5: 938C33C54819D6CE8D731B68D9C37E38)

Bor32-update-flase.exe (PID: 7916 cmdline: "C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe" MD5: 938C33C54819D6CE8D731B68D9C37E38)

Haloonoroff.exe (PID: 7952 cmdline: "C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe" MD5: 0D318144BD23BA1A72CC06FE19CB3F0C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
KrBanker, BlackMoon	ThreatPost describes KRBanker (Blackmoon) as a banking Trojan designed to steal user credentials from various South Korean banking institutions. It was discovered in early 2014 and since then has adopted a variety of infection and credential stealing techniques.	No Attribution	http://researchcenter.paloaltonetworks.com/2016/05/unit42-krbanker-targets-south-korea-through-adware-and-exploit-kits-2/ https://fidelissecurity.com/threatgeek/threat-intelligence/blackmoon-banking-trojan-new-framework/ https://www.peppermalware.com/2019/03/analysis-of-blackmoon-banking-trojans.html https://www.proofpoint.com/us/threat-insight/post/Updated-Blackmoon-Banking-Trojan https://www.rapid7.com/blog/post/2023/07/13/old-blackmoon-trojan-new-monetization-approach/	https://malpedia.caad.fkie.fraunhofer.de/details/win.krbanker

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Program Files (x86)\BtDDIFUEHLCR\HackPatch.dll	Mimikatz_Gen_Strings	Detects Mimikatz by using some special strings	Florian Roth	0x6b86c:$s5: Ask debug privilege
C:\Program Files (x86)\BtDDIFUEHLCR\HackPatch.dll	Mimikatz_Strings	Detects Mimikatz strings	Florian Roth	0x6bf04:$x6: Lists LM & NTLM credentials
C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HackPatch.dll	Mimikatz_Gen_Strings	Detects Mimikatz by using some special strings	Florian Roth	0x6b86c:$s5: Ask debug privilege
C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HackPatch.dll	Mimikatz_Strings	Detects Mimikatz strings	Florian Roth	0x6bf04:$x6: Lists LM & NTLM credentials
C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\rtl120.bpl	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 1 entries

Memory Dumps

Source	Rule	Description	Author
00000009.00000003.2021130019.0000000002EE6000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
0000000F.00000000.2077543981.0000000000401000.00000020.00000001.01000000.00000010.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
Process Memory Space: e8a0d5af432b7e64DBD.exe PID: 7580	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Bor32-update-flase.exe PID: 7916	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
18.2.Bor32-update-flase.exe.310950e.5.raw.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
18.2.Bor32-update-flase.exe.310950e.5.raw.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x45ba:$s1: blackmoon 0x45fa:$s2: BlackMoon RunTime Error:
15.0.Bor32-update-flase.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
18.2.Bor32-update-flase.exe.310950e.5.unpack	JoeSecurity_blackmoon	Yara detected BlackMoon Ransomware	Joe Security
18.2.Bor32-update-flase.exe.310950e.5.unpack	MALWARE_Win_BlackMoon	Detects executables using BlackMoon RunTime	ditekSHen	0x45ba:$s1: blackmoon 0x45fa:$s2: BlackMoon RunTime Error:

Suricata Signatures

ET MALWARE Anonymous RAT CnC Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-29T02:00:59.160911+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49738	154.82.113.139	63701	TCP
2024-12-29T02:01:59.365782+0100	2052875	1	A Network Trojan was detected	192.168.2.4	49738	154.82.113.139	63701	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe

File opened: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC90.CRT\msvcr90.dll

Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\oDayProtect.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\ddvsm\out\Intermediate\vscommon\perfwatson2.csproj_FB008427_ret\objr\amd64\PerfWatson2.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp100.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000046D4000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMOfficeScan.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QQPCHwNetwork.pdbRR#GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\vmagent_new\bin\joblist\622859\src\x\x86_ntvbld\objfre_win7_x86\i386\ntvbld.pdb` source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\build\ob\bora-19436861\cayman_gettext\gettext\MSVC14\libintl_dll\Release\libintl_dll.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\gitproj\7z2201-src\CPP\7zip\UI\Console\Release\Console.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000002.2048756739.0000000000728000.00000002.00000001.01000000.0000000E.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000000.2000088539.0000000000728000.00000002.00000001.01000000.0000000E.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000000.2049813150.0000000000728000.00000002.00000001.01000000.0000000E.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000002.2064919257.0000000000728000.00000002.00000001.01000000.0000000E.sdmp, e8a0d5af432b7e64DBD.exe, 0000000D.00000002.2068010090.0000000000728000.00000002.00000001.01000000.0000000E.sdmp, e8a0d5af432b7e64DBD.exe, 0000000D.00000000.2066593628.0000000000728000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\build\ob\bora-20800274\bora\build\build\LIBRARIES\vmwarestring\win32\release\vmwarestring.pdb!! source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMOfficeScanX64.pdb'' GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\KWSING\trunk\KwResource\pdb\release\HTTPRequest.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mfc90.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004378000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-20800274\bora\build\build\LIBRARIES\vmwarestring\win32\release\vmwarestring.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\8168\vc98\dev\bin\vcspawn.pdbMZ source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcr120.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMDns.pdbDD!GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar32\Release\RAR.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\InstallerAnalytics.pdbz source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005246000.00000004.00001000.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMDns.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\KWSING\trunk\KwResource\pdb\release\KwCommonUI.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wininet.pdbUGP source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1707035647.0000000005014000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000003.00000003.1784899160.0000000003881000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\vmagent_new\bin\joblist\622869\src\x\x64_ntvbld\objfre_win7_amd64\amd64\ntvbld64.pdbL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-22583795\bora\build\build\authd\release\win32\vmware-authd.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\vmagent_new\bin\joblist\622859\src\x\x86_ntvbld\objfre_win7_x86\i386\ntvbld.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: h:\ch1\src\sandbox\wow_helper\wow_helper.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMEventBus.pdbZZ source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcr110.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\419058\out\Release\360AppCore.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMAVProxy.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\build\ob\bora-19188697\cayman_glib\glib\src\build\win32\vs14\Release\Win32\bin\gmodule-2.0.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
Source:	Binary string: D:\build\ob\bora-22583795\bora\build\build\vmware-autostart\release\win32\vmware-autostart.pdb.. source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000047FB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000044D2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\Decoder.pdb8 source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
Source:	Binary string: msvcp90.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QQFileFlt.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_2.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000047FB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000044D2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: libEGL.dll.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\vmagent_new\bin\joblist\622869\src\x\x64_ntvbld\objfre_win7_amd64\amd64\ntvbld64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-22583795\bora\build\build\authd\release\win32\vmware-authd.pdb-- source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\bin\x86\embeddeduiproxy.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005313000.00000004.00001000.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1676650198.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000003.00000003.1784669552.000000000421B000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000003.00000003.1781109686.000000000131F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\build\ob\bora-21885936\cayman_zlib\build\release\win32_vc140\zlib\build\zlib1.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042962146.0000000003BC5000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000005051000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMRtpDLL.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\MemDefrag.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, MemDefrag.dll.9.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\InstallerAnalytics.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005246000.00000004.00001000.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\test\intelligentDemo\PackageMgr\Release\PackageMgr.pdb//' source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdbo source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMAVProxy.pdb__(GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1707035647.0000000005014000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000003.00000003.1784899160.0000000003881000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcr90.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004CF9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\build\ob\bora-21885936\cayman_zlib\build\release\win32_vc140\zlib\build\zlib1.pdb$$ source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042962146.0000000003BC5000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000005051000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\KWSING\trunk\KwResource\pdb\release\KwLayoutMgr.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QQFileFlt.pdb.. GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-20800274\bora\build\build\LIBRARIES\vmauthd-log\win32\release\vmauthd.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\KWSING\trunk\KwResource\pdb\release\KwLayoutMgr.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\MemDefrag.pdbII#GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, MemDefrag.dll.9.dr
Source:	Binary string: D:\a\_work\1\s\obj\VS\Microsoft.VisualStudio.Web.Host\Release\Microsoft.VisualStudio.Web.Host.pdbf source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\KWSING\trunk\KwResource\pdb\release\KwLib.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .pdb% source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2131881089.0000000002568000.00000040.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMEventBus.pdb source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.0000000004080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\Decoder.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMOfficeScan.pdbLL%GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\etcp5.0\Release\etcp.pdb source: Bor32-update-flase.exe, 00000012.00000002.2131881089.0000000002560000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: libEGL.dll.pdbs source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcr80.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp120.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000047FB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000044D2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcr100.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000044D2000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, Bor32-update-flase.exe, 00000012.00000002.2138244917.000000006F7F1000.00000020.00000001.01000000.00000017.sdmp
Source:	Binary string: d:\build\ob\bora-19436861\cayman_gettext\gettext\MSVC14\libintl_dll\Release\libintl_dll.pdb11 source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp110.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000046D4000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\oDayProtect.pdbAA#GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp80.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000047FB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\8168\vc98\dev\bin\vcspawn.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QQPCHwNetwork.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: G:\CLIENT\fhbemb\src\bin\Release\fhjyy.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005313000.00000004.00001000.00020000.00000000.sdmp, MSI7DAF.tmp, 00000008.00000000.1998413401.000000000023E000.00000002.00000001.01000000.0000000C.sdmp, MSI7DAF.tmp, 00000008.00000002.2068600823.000000000023E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\test\intelligentDemo\PackageMgr\Release\PackageMgr.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\KWSING\trunk\KwResource\pdb\release\kwlogsvr.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMOfficeScanX64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\KWSING\trunk\KwResource\pdb\release\KwLib.pdbp source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000047FB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000044D2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: h:\ch1\src\sandbox\wow_helper\wow_helper.pdbp source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-22583795\bora\build\build\vmware-autostart\release\win32\vmware-autostart.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: G:\CLIENT\fhbemb\src\bin\Release_NL\fhbmini.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, Haloonoroff.exe, 00000013.00000000.2112966039.0000000000B9E000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\368203\out\Release\HipsLog.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMRtpDLL.pdbWW'GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: G:\CLIENT\WallPaper_feihuo\windows\FFWallpaper\bin\Release\bfcipc.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \WallPaper\windows\FFWallpaper\bin\Release\FFWallpaper.pdb source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr
Source:	Binary string: D:\a\_work\1\s\obj\VS\Microsoft.VisualStudio.Web.Host\Release\Microsoft.VisualStudio.Web.Host.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-20800274\bora\build\build\LIBRARIES\basichttp\win32\release\basichttp.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005000000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: z:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: x:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: v:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: t:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: r:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: p:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: n:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: l:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: j:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: h:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: f:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: b:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: y:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: w:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: u:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: s:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: q:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: o:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: m:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: k:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: i:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: g:
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: e:
Source: C:\Windows\Installer\MSI7DAF.tmp	File opened: c:	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File opened: a:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File opened: [:

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D40640 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	0_2_00D40640
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C20880 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,PathIsUNCW,	0_2_00C20880
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D1B1B0 FindFirstFileW,GetLastError,FindClose,	0_2_00D1B1B0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D4A4B0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_00D4A4B0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D4A8B0 FindFirstFileW,FindClose,	0_2_00D4A8B0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D1A850 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,	0_2_00D1A850
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D28F30 FindFirstFileW,FindClose,FindClose,	0_2_00D28F30
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00CFFE80 FindFirstFileW,FindNextFileW,FindClose,	0_2_00CFFE80
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C61D070 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,	0_2_6C61D070
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C627870 FindFirstFileW,FindClose,GetLastError,FindClose,	0_2_6C627870
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00D1B1B0 FindFirstFileW,GetLastError,FindClose,	3_2_00D1B1B0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00D1ABE0 FindFirstFileW,	3_2_00D1ABE0
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006A8BA4 __EH_prolog3_GS,FindFirstFileA,FindFirstFileW,FindFirstFileW,	9_2_006A8BA4
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_0070D9C1 FindFirstFileExW,	9_2_0070D9C1
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_0070D996 FindFirstFileExA,	9_2_0070D996
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_0093657C GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	18_2_0093657C
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00938E6A FindFirstFileA,FindClose,	18_2_00938E6A
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00938E6C FindFirstFileA,FindClose,	18_2_00938E6C
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B32298 FindFirstFileA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,	18_2_00B32298
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00A6A696 FindFirstFileA,FindClose,	18_2_00A6A696
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00A6A698 FindFirstFileA,FindClose,	18_2_00A6A698
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00A6A7A8 FindFirstFileA,FindClose,	18_2_00A6A7A8
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00AB27D0 FindFirstFileA,FindClose,FileTimeToDosDateTime,	18_2_00AB27D0
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00A6AAB4 FindFirstFileA,GetLastError,	18_2_00A6AAB4
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00A66B80 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	18_2_00A66B80
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B2EDA0 FindFirstFileA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,	18_2_00B2EDA0

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00D49310 _wcsrchr,_wcsrchr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

0_2_00D49310

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2052875 - Severity 1 - ET MALWARE Anonymous RAT CnC Checkin : 192.168.2.4:49738 -> 154.82.113.139:63701

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 154.82.113.139 ports 63701,0,1,3,6,7

Source: global traffic

TCP traffic: 192.168.2.4:49738 -> 154.82.113.139:63701

Source: Joe Sandbox View

ASN Name: ROOTNETWORKSUS ROOTNETWORKSUS

Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139
Source: unknown	TCP traffic detected without corresponding DNS query: 154.82.113.139

Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: "https://www.facebook.com/iobitsoft equals www.facebook.com (Facebook)
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000000.1660597971.0000000000E39000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: FlashWindowExFlashWindowGetPackagePathKernel32.dllhttp://www.google.comTESTtin9999.tmphttp://www.yahoo.comhttp://www.example.com.partGET "filenameattachment=123POSTcharsetDLDISO-8859-1US-ASCIIutf-8utf-16FTP Server/AdvancedInstallerLocal Network ServerIf-Modified-Since: %s equals www.yahoo.com (Yahoo)
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	String found in binary or memory: TFlashWindowExFlashWindowGetPackagePathKernel32.dllhttp://www.google.comTESTtin9999.tmphttp://www.yahoo.comhttp://www.example.com.partGET "filenameattachment=123POSTcharsetDLDISO-8859-1US-ASCIIutf-8utf-16FTP Server/AdvancedInstallerLocal Network ServerIf-Modified-Since: %s equals www.yahoo.com (Yahoo)
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	String found in binary or memory: http://www.yahoo.com equals www.yahoo.com (Yahoo)

Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004378000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: ftp://http://HTTP/1.0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ascstats.iobit.com/active.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ascstats.iobit.com/moreuse.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ascstats.iobit.com/multi_app/app_db3promote.php?action=insert
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ascstats.iobit.com/other/db_driverinstall.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ascstats.iobit.com/other/db_extlink_download.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ascstats.iobit.com/other/db_temp_download.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ascstats.iobit.com/other/insert.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ascstats.iobit.com/usage.php
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2086612668.0000000005870000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAs
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, MemDefrag.dll.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA.crt0
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005313000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042962146.0000000003BC5000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000005051000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, MemDefrag.dll.9.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, MemDefrag.dll.9.dr, OTGContainer.exe.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005246000.00000004.00001000.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: http://collect.installeranalytics.com
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005313000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000046D4000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004378000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.2084043292.0000000005E26000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2086750409.0000000005E27000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.2081577812.0000000005E21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicer
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, MemDefrag.dll.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005313000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042962146.0000000003BC5000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000005051000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, MemDefrag.dll.9.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, MemDefrag.dll.9.dr, OTGContainer.exe.18.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigning-g1.crl03
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005313000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042962146.0000000003BC5000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000005051000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigning-g1.crl0K
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/COMODOTimeStampingCA_2.crt0#
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005313000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2084554605.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.2083210861.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000003.00000002.2077428524.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2086303450.0000000003A7F000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.2081490565.0000000003A71000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000003.00000002.2077428524.00000000012D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1703664200.0000000000765000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1703743080.000000000078D000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1703514174.000000000072C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?8d85772bdf54d
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2138125089.000000006B296000.00000008.00000001.01000000.00000021.sdmp	String found in binary or memory: http://curl.haxx.se/V
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2138125089.000000006B296000.00000008.00000001.01000000.00000021.sdmp	String found in binary or memory: http://curl.haxx.se/docs/copyright.htmlDVarFileInfo$
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, Bor32-update-flase.exe, 00000012.00000002.2137992653.000000006B282000.00000002.00000001.01000000.00000021.sdmp	String found in binary or memory: http://curl.haxx.se/docs/http-cookies.html
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ec.360bc.cnhttp://www.eyybc.com/forumdisplay.php?fid=17/memcp.php/ip.asp/time.asp/gonggao.txt
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://forums.iobit.com/forum/driver-booster/driver-booster-5
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://forums.iobit.com/showthread.php?t=16792
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://idb.iobit.com/check.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://install-log.kuwo.cn/music.yl
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://klog.kuwo.cn/music.yl
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://klog.kuwo.cn/music.ylhttp://install-log.kuwo.cn/music.ylhttp://log.kuwo.cn/music.ylrwSend
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://log.kuwo.cn/music.yl
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005313000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042962146.0000000003BC5000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000005051000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, MemDefrag.dll.9.dr, OTGContainer.exe.18.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, MemDefrag.dll.9.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: http://ocsp.digicert.com0L
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, MemDefrag.dll.9.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005313000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000046D4000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004378000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/pca3-g5.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com06
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s.symcd.com0_
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crl0a
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcd.com0&
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://stats.iobit.com/active_day.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://stats.iobit.com/active_month.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://stats.iobit.com/register.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://stats.iotransfer.net/active.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sw.symcb.com/sw.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sw.symcd.com0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sw1.symcb.com/sw.crt0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	String found in binary or memory: http://t2.symcb.com0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	String found in binary or memory: http://tl.symcd.com0&
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000046D4000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004378000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000046D4000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004378000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000046D4000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004378000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://update.iobit.com/infofiles/db2/Freeware-db.upt
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://update.iobit.com/infofiles/db2/db2_free.upt
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://update.iobit.com/infofiles/db2/db2_oth.upt
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://update.iobit.com/infofiles/db2/db2_pro.upt
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://update.iobit.com/infofiles/db3/embhtml/update.upt
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://updatestats.cd4o.com/api.php?act=update
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.360.cn
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.bsplayer.com
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cd4o.com/drivers/
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.cd4o.com/drivers/wlst/v.json
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005313000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042962146.0000000003BC5000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000005051000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	String found in binary or memory: http://www.google.com
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/language-subtag-registry
Source: Bor32-update-flase.exe, 00000012.00000002.2130974363.0000000000BBD000.00000020.00000001.01000000.0000001F.sdmp	String found in binary or memory: http://www.indyproject.org/
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042962146.0000000003BC5000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=activateweb
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=activateweb-%d
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=bannerbuy
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=compare
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=dbproduct
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=download
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=expired
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=faq
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=feature
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=feedback
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=filerupt
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=forum
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=gaexpired
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=help
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=helptranslate
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=htmlfailed
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=index
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=install
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=likefb
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=lostcode
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=multipcexpired
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=othupdate
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=proupdate
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=purchase
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=purchase-%d
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=regexpired
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=reggaexpired
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=regovermax
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=revokedkey
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=update
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=usermanual
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/appgoto.php?to=vertoold
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/cloud/db/index.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/compare/db/index.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/driver-booster-pro.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/faq.php?product=db
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/feedback/db/feedback.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/goto.php?id=dbproregister
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/goto.php?id=dbsurvey
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/goto.php?id=likefb01_DB
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/goto.php?id=plusgp01_DB
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/goto.php?id=plusgp01_DBU
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/hotquestions-db.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/install/db/index.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/lostcode.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.iobit.com/productfeedback.php?product=driver-booster
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000046D4000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004378000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.kuwo.cn0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.ludashi.com0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.rfc-editor.org/rfc/bcp/bcp47.txt
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.super-ec.cn
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sysinternals.com
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: http://www.winimage.com/zLibDll
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: http://www.winimage.com/zLibDll1.2.3
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	String found in binary or memory: http://www.yahoo.com
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042962146.0000000003BC5000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000005051000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.zlib.net/D
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/BaiZhu/Request
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/DesktopComponent/GetPopupList
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/Device/ClientHardwareConfig
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/LockWallpaper/Get
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/LockWallpaper/Gethttps://bizhi.hfnuola.com/pc/LockWallpaper/Wallpaperht
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/LockWallpaper/Wallpaper
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/adApi/plugRecommendNew
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/adApi/plugRecommendNew%s?channel=%shttps://bizhi.hfnuola.com/pc/desktop
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/agg/StartUp
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/agg/hour
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/desktopSubject
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/fhbzApi/checkFile
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/v/AfterLocalSet
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/v/AfterLocalSethttps://bizhi.hfnuola.com/pc/DesktopComponent/GetPopupLi
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/v/FilterPayWallpaper
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/v/wallpaperInfoMulti
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhi.hfnuola.com/pc/v/wallpaperInfoMulti%sFFSL.exe
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhiweb.hfnuola.com/clientNew/index.html
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhiweb.hfnuola.com/clientNew/index.htmlchrome-error://chromewebdata_err:firstNav_
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhiweb.hfnuola.com/web/advertising.html?type=
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhiweb.hfnuola.com/web/advertising.html?type=9IagJ4qlKos8A8lm
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://bizhiweb.hfnuola.com/web/vip.htmlhttps://bizhiweb.hfnuola.com/web/payNew.html%s?channel=%s&p
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005246000.00000004.00001000.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://collect.installeranalytics.com
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005246000.00000004.00001000.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmp	String found in binary or memory: https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0)
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0.
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://hao.360.cnstrtolwcstombsmbstowcsiexplore.exe360chrome.exe360se.exeSafehmpgHelperkslaunchwsaf
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://idea.hfnuola.com
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://idea.hfnuola.com20012rgbautoStartauto_start_slienthideDesktopIconpauseVidoset_mute_on_fullsc
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	String found in binary or memory: https://installeranalytics.com
Source: OTGContainer.exe.18.dr	String found in binary or memory: https://logs.hfnuola.com
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://s1.driverboosterscan.com/worker.php
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://s2.driverboosterscan.com/worker.php
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005313000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0B
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://twitter.com/iobitsoft
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	String found in binary or memory: https://www.advancedinstaller.com
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2130186591.0000000000A44000.00000002.00000001.01000000.0000001D.sdmp, MemDefrag.dll.9.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/03
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/06
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.gnu.org/licenses/
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://www.hfnuola.com
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	String found in binary or memory: https://www.hfnuola.com/select
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.itrus.com.cn0
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	String found in binary or memory: https://www.thawte.com/cps0/
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	String found in binary or memory: https://www.thawte.com/repository0W

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe

Code function: 18_2_00AD0F5C OpenClipboard,GlobalAlloc,GlobalLock,EmptyClipboard,SetClipboardData,GlobalUnlock,

18_2_00AD0F5C

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe

Code function: 18_2_00AD0F5C OpenClipboard,GlobalAlloc,GlobalLock,EmptyClipboard,SetClipboardData,GlobalUnlock,

18_2_00AD0F5C

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe

Code function: 18_2_00ABC328 GetClipboardData,CopyEnhMetaFileA,GetEnhMetaFileHeader,

18_2_00ABC328

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00CFA2A0 SendMessageW,GetParent,GetParent,GetWindowRect,GetParent,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,MapWindowPoints,FillRect,DeleteDC,SendMessageW,SendMessageW,SendMessageW,

0_2_00CFA2A0

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe

Code function: 18_2_00AF7AD4 GetMessagePos,GetKeyboardState,

18_2_00AF7AD4

Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe

Windows user hook set: 0 mouse low level C:\Windows\SYSTEM32\DINPUT8.dll

Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp

Binary or memory string: RegisterRawInputDevices

memstr_29bc8dec-4

Source: Yara match

File source: Process Memory Space: e8a0d5af432b7e64DBD.exe PID: 7580, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Yara detected BlackMoon Ransomware

Source: Yara match	File source: 18.2.Bor32-update-flase.exe.310950e.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.Bor32-update-flase.exe.310950e.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Bor32-update-flase.exe PID: 7916, type: MEMORYSTR

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe

Code function: 18_2_00B2F1A0 OpenDesktopA,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateDesktopA,

18_2_00B2F1A0

System Summary

Malicious sample detected (through community Yara rule)

Source: 18.2.Bor32-update-flase.exe.310950e.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: 18.2.Bor32-update-flase.exe.310950e.5.unpack, type: UNPACKEDPE	Matched rule: Detects executables using BlackMoon RunTime Author: ditekSHen
Source: C:\Program Files (x86)\BtDDIFUEHLCR\HackPatch.dll, type: DROPPED	Matched rule: Detects Mimikatz by using some special strings Author: Florian Roth
Source: C:\Program Files (x86)\BtDDIFUEHLCR\HackPatch.dll, type: DROPPED	Matched rule: Detects Mimikatz strings Author: Florian Roth
Source: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HackPatch.dll, type: DROPPED	Matched rule: Detects Mimikatz by using some special strings Author: Florian Roth
Source: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HackPatch.dll, type: DROPPED	Matched rule: Detects Mimikatz strings Author: Florian Roth

Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D5F0D0 NtdllDefWindowProc_W,	0_2_00D5F0D0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00CD7A10 GetSystemDirectoryW,LoadLibraryExW,NtdllDefWindowProc_W,	0_2_00CD7A10
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C22390 KillTimer,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DeleteCriticalSection,	0_2_00C22390
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00CBC330 NtdllDefWindowProc_W,	0_2_00CBC330
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C144A0 GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00C144A0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C1E540 NtdllDefWindowProc_W,	0_2_00C1E540
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C1E6B0 IsWindow,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00C1E6B0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C14BC0 SysFreeString,SysAllocString,GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,SysFreeString,NtdllDefWindowProc_W,SysFreeString,	0_2_00C14BC0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C710D0 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00C710D0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C17190 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DestroyWindow,	0_2_00C17190
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C15220 NtdllDefWindowProc_W,	0_2_00C15220
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C358F0 NtdllDefWindowProc_W,	0_2_00C358F0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C178B0 NtdllDefWindowProc_W,	0_2_00C178B0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C27AC0 NtdllDefWindowProc_W,	0_2_00C27AC0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C17E70 NtdllDefWindowProc_W,	0_2_00C17E70
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00CD7A10 GetSystemDirectoryW,LoadLibraryExW,NtdllDefWindowProc_W,	3_2_00CD7A10
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C710D0 NtdllDefWindowProc_W,	3_2_00C710D0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C17190 NtdllDefWindowProc_W,	3_2_00C17190
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C15220 NtdllDefWindowProc_W,	3_2_00C15220
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C22390 NtdllDefWindowProc_W,DeleteCriticalSection,	3_2_00C22390
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00CBC330 NtdllDefWindowProc_W,	3_2_00CBC330
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C144A0 NtdllDefWindowProc_W,GlobalAlloc,GlobalLock,GlobalUnlock,NtdllDefWindowProc_W,	3_2_00C144A0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C1E540 NtdllDefWindowProc_W,	3_2_00C1E540
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C1E6B0 NtdllDefWindowProc_W,	3_2_00C1E6B0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C358F0 NtdllDefWindowProc_W,	3_2_00C358F0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C178B0 NtdllDefWindowProc_W,	3_2_00C178B0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C27AC0 NtdllDefWindowProc_W,	3_2_00C27AC0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C17E70 NtdllDefWindowProc_W,	3_2_00C17E70
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_009769D8 inet_addr,ntohl,lstrcmpiA,	18_2_009769D8
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00976A24 ntohl,inet_ntoa,	18_2_00976A24
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B2CA0C inet_addr,ntohl,lstrcmpiA,	18_2_00B2CA0C
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B2CA58 ntohl,inet_ntoa,	18_2_00B2CA58

Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe

Code function: 9_2_006AA063: __EH_prolog3,GetFileInformationByHandle,DeviceIoControl,

9_2_006AA063

Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe

File created: C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGXlong.sys

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5a2ae2.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2C69.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2CC8.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2D07.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2D66.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2D96.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI516B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI519B.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{AF084EDE-DB6F-45F9-8AB2-9750C7AF5081}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI52B5.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI788D.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7DAF.tmp	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\windows\Installer\libjyy.dll	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI2C69.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C20880	0_2_00C20880
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D34CA0	0_2_00D34CA0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C28080	0_2_00C28080
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C2C116	0_2_00C2C116
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C2C127	0_2_00C2C127
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C24200	0_2_00C24200
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C045FE	0_2_00C045FE
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C745B0	0_2_00C745B0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C1EAF0	0_2_00C1EAF0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00CFAA20	0_2_00CFAA20
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00DCCBBA	0_2_00DCCBBA
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00DBCEC0	0_2_00DBCEC0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D2CFD0	0_2_00D2CFD0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C03010	0_2_00C03010
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00DBD24E	0_2_00DBD24E
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C2F4E0	0_2_00C2F4E0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C2B461	0_2_00C2B461
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00DD1639	0_2_00DD1639
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C2DAC0	0_2_00C2DAC0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C61D070	0_2_6C61D070
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C60DB00	0_2_6C60DB00
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C639460	0_2_6C639460
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C61F420	0_2_6C61F420
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C637C1A	0_2_6C637C1A
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C619690	0_2_6C619690
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C649FE7	0_2_6C649FE7
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C6400FA	0_2_6C6400FA
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C63788C	0_2_6C63788C
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C642100	0_2_6C642100
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C60F180	0_2_6C60F180
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C643B89	0_2_6C643B89
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C28080	3_2_00C28080
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C03010	3_2_00C03010
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C24200	3_2_00C24200
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C2F4E0	3_2_00C2F4E0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C2B461	3_2_00C2B461
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C045FE	3_2_00C045FE
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C745B0	3_2_00C745B0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00DD1639	3_2_00DD1639
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00DCF711	3_2_00DCF711
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C2DAC0	3_2_00C2DAC0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C1EAF0	3_2_00C1EAF0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00CFAA20	3_2_00CFAA20
Source: C:\Windows\Installer\MSI7DAF.tmp	Code function: 8_2_0023D237	8_2_0023D237
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006CE319	9_2_006CE319
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006C23DA	9_2_006C23DA
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006C45F7	9_2_006C45F7
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006DEB3E	9_2_006DEB3E
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006AC09C	9_2_006AC09C
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_0071C140	9_2_0071C140
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_00700104	9_2_00700104
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006DC111	9_2_006DC111
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_00700361	9_2_00700361
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006E6565	9_2_006E6565
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_007005BE	9_2_007005BE
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_0071C680	9_2_0071C680
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006B4712	9_2_006B4712
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_0070082A	9_2_0070082A
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006E68D7	9_2_006E68D7
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006EA8BE	9_2_006EA8BE
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006C8A0D	9_2_006C8A0D
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006BEAC4	9_2_006BEAC4
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_0071CB30	9_2_0071CB30
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006E6B81	9_2_006E6B81
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_0071ACC2	9_2_0071ACC2
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006E6E48	9_2_006E6E48
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006BAE29	9_2_006BAE29
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006D8EC1	9_2_006D8EC1
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006FEF0B	9_2_006FEF0B
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006FF13A	9_2_006FF13A
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006E7103	9_2_006E7103
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006A1000	9_2_006A1000
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006FF374	9_2_006FF374
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006BF352	9_2_006BF352
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006C7395	9_2_006C7395
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006F34AD	9_2_006F34AD
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006AD490	9_2_006AD490
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006C15F5	9_2_006C15F5
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006FF5A3	9_2_006FF5A3
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006BD6F3	9_2_006BD6F3
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006FF7D2	9_2_006FF7D2
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006BF783	9_2_006BF783
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_00721890	9_2_00721890
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006D59C7	9_2_006D59C7
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006FFA0C	9_2_006FFA0C
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006FFC3B	9_2_006FFC3B
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006BFCAB	9_2_006BFCAB
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006FFE98	9_2_006FFE98
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_009322F4	18_2_009322F4
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B1629C	18_2_00B1629C
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00A623E4	18_2_00A623E4
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B0C3E8	18_2_00B0C3E8
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00A66510	18_2_00A66510
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B0A6B0	18_2_00B0A6B0
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B166CC	18_2_00B166CC
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00AE87D0	18_2_00AE87D0
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B169C8	18_2_00B169C8
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B0AA79	18_2_00B0AA79
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B18E88	18_2_00B18E88
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B15094	18_2_00B15094
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B15510	18_2_00B15510
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B17628	18_2_00B17628
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B0F668	18_2_00B0F668
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00AD77F4	18_2_00AD77F4
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B11B34	18_2_00B11B34
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B722E4	18_2_00B722E4
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B0AE5C	18_2_00B0AE5C

Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe

Process token adjusted: Security

Source: C:\Windows\Installer\MSI7DAF.tmp	Code function: String function: 002329E0 appears 33 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: String function: 006E2F70 appears 63 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: String function: 00709CD9 appears 60 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: String function: 006F0FCC appears 87 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: String function: 006E31BA appears 36 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: String function: 006E31A7 appears 31 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: String function: 006E3225 appears 36 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: String function: 006E31F1 appears 336 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: String function: 006E325C appears 35 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: String function: 0070BEAC appears 31 times
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: String function: 00DB2072 appears 33 times
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: String function: 00DB4A5A appears 42 times
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: String function: 00DB5370 appears 38 times
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: String function: 00D182C0 appears 58 times
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: String function: 00C07160 appears 99 times
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: String function: 00C07270 appears 40 times
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: String function: 00C092A0 appears 68 times
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: String function: 00C070B0 appears 49 times
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: String function: 00C07D00 appears 683 times
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: String function: 6C6308F0 appears 50 times
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: String function: 00C20880 appears 47 times
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: String function: 00C09800 appears 71 times
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: String function: 00DCE2CD appears 33 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: String function: 00952FEC appears 96 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: String function: 00A72524 appears 33 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: String function: 00934F08 appears 33 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: String function: 009351FC appears 36 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: String function: 00A89318 appears 96 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: String function: 00A65220 appears 44 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: String function: 00A6514C appears 32 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: String function: 00A65274 appears 34 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: String function: 00A67C18 appears 82 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: String function: 00934EE4 appears 110 times
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: String function: 00A65538 appears 36 times

Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Static PE information: invalid certificate

Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Static PE information: Resource name: RT_VERSION type: PDP-11 overlaid pure executable not stripped
Source: fixsc.dll.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: fixsc64.dll.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: libcurrant.dll.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: libzdtp.dll.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: libzdtp64.dll.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: fixsc.dll.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: fixsc64.dll.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 18.2.Bor32-update-flase.exe.310950e.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: 18.2.Bor32-update-flase.exe.310950e.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_BlackMoon author = ditekSHen, description = Detects executables using BlackMoon RunTime
Source: C:\Program Files (x86)\BtDDIFUEHLCR\HackPatch.dll, type: DROPPED	Matched rule: Mimikatz_Gen_Strings date = 2017-06-19, hash3 = f35b589c1cc1c98c4c4a5123fd217bdf0d987c00d2561992cbfb94bd75920159, hash2 = eefd4c038afa0e80cf6521c69644e286df08c0883f94245902383f50feac0f85, author = Florian Roth, description = Detects Mimikatz by using some special strings, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 058cc8b3e4e4055f3be460332a62eb4cbef41e3a7832aceb8119fd99fea771c4
Source: C:\Program Files (x86)\BtDDIFUEHLCR\HackPatch.dll, type: DROPPED	Matched rule: Mimikatz_Strings date = 2016-06-08, author = Florian Roth, description = Detects Mimikatz strings, score = , reference = not set, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HackPatch.dll, type: DROPPED	Matched rule: Mimikatz_Gen_Strings date = 2017-06-19, hash3 = f35b589c1cc1c98c4c4a5123fd217bdf0d987c00d2561992cbfb94bd75920159, hash2 = eefd4c038afa0e80cf6521c69644e286df08c0883f94245902383f50feac0f85, author = Florian Roth, description = Detects Mimikatz by using some special strings, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, super_rule = 058cc8b3e4e4055f3be460332a62eb4cbef41e3a7832aceb8119fd99fea771c4
Source: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HackPatch.dll, type: DROPPED	Matched rule: Mimikatz_Strings date = 2016-06-08, author = Florian Roth, description = Detects Mimikatz strings, score = , reference = not set, license = https://creativecommons.org/licenses/by-nc/4.0/

Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: D:\dbs\el\ddvsm\out\Intermediate\vscommon\perfwatson2.csproj_FB008427_ret\objr\amd64\PerfWatson2.pdb

Source: classification engine

Classification label: mal84.rans.troj.spyw.evad.winEXE@23/435@0/1

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00D1E5B0 FormatMessageW,GetLastError,

0_2_00D1E5B0

Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006B828A GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,		9_2_006B828A
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006AB687 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,CloseHandle,FreeLibrary,		9_2_006AB687

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00D4B860 GetDiskFreeSpaceExW,

0_2_00D4B860

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00D63E80 CoCreateInstance,

0_2_00D63E80

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00C09160 LoadResource,LockResource,SizeofResource,

0_2_00C09160

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

File created: C:\Program Files (x86)\WindowsInstallerFB

Jump to behavior

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

File created: C:\Users\user\AppData\Local\AdvinstAnalytics

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7700:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7792:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7588:120:WilError_03
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Mutant created: \Sessions\1\BaseNamedObjects\??
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Mutant created: \Sessions\1\BaseNamedObjects\NIpizDg64rfvhLyrCQMywaHQBENjzMv1R6uEoR8NfcvFEqARIU

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

File created: C:\Users\user\AppData\Local\Temp\INA8055.tmp

Jump to behavior

Source: Yara match	File source: 15.0.Bor32-update-flase.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.2021130019.0000000002EE6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.2077543981.0000000000401000.00000020.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\rtl120.bpl, type: DROPPED
Source: Yara match	File source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe, type: DROPPED

Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	String found in binary or memory: https://installeranalytics.com
Source: Bor32-update-flase.exe	String found in binary or memory: ISO_6937-2-add
Source: Bor32-update-flase.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: Bor32-update-flase.exe	String found in binary or memory: jp-ocr-b-add
Source: Bor32-update-flase.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: Bor32-update-flase.exe	String found in binary or memory: jp-ocr-hand-add
Source: Bor32-update-flase.exe	String found in binary or memory: NATS-DANO-ADD
Source: Bor32-update-flase.exe	String found in binary or memory: NATS-SEFI-ADD
Source: Bor32-update-flase.exe	String found in binary or memory: addon-installstart
Source: Bor32-update-flase.exe	String found in binary or memory: addon-installover

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

File read: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe "C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1D35FE1868B50914AC73C4C1E92E866C C
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Process created: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe "C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe" /i "C:\Program Files (x86)\WindowsInstallerFB\7AF5081\DAN_127.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\BtDDIFUEHLCR" SECONDSEQUENCE="1" CLIENTPROCESSID="5324" AI_MORE_CMD_LINE=1
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding D34C0DB36F96DC933127EB55CBA7C9C2
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI7DAF.tmp "C:\Windows\Installer\MSI7DAF.tmp"
Source: C:\Windows\Installer\MSI7DAF.tmp	Process created: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe "C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\TLGCBXAGVFLQ.KBI" -o"C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1" -pJHKQFETWJKTIHLLBOKO -aos -y
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Installer\MSI7DAF.tmp	Process created: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe "C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\SUGIPFIMNRQE.TMA" -o"C:\Program Files (x86)\BtDDIFUEHLCR" -pMNHWOTMLOHTPVRFXPCH -aos -y
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Installer\MSI7DAF.tmp	Process created: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe "C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\TMGJRLDUDWLQ.FCU" -o"C:\Users\user\AppData\Roaming" -pPXOEWCVFPIJPLHQSQSX -aos -y
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe "C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe"
Source: unknown	Process created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe "C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe"
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Process created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe "C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe"
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Process created: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe "C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe" /i "C:\Program Files (x86)\WindowsInstallerFB\7AF5081\DAN_127.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\BtDDIFUEHLCR" SECONDSEQUENCE="1" CLIENTPROCESSID="5324" AI_MORE_CMD_LINE=1	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 1D35FE1868B50914AC73C4C1E92E866C C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding D34C0DB36F96DC933127EB55CBA7C9C2	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI7DAF.tmp "C:\Windows\Installer\MSI7DAF.tmp"	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process created: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe "C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\TLGCBXAGVFLQ.KBI" -o"C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1" -pJHKQFETWJKTIHLLBOKO -aos -y	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process created: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe "C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\SUGIPFIMNRQE.TMA" -o"C:\Program Files (x86)\BtDDIFUEHLCR" -pMNHWOTMLOHTPVRFXPCH -aos -y	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process created: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe "C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\TMGJRLDUDWLQ.FCU" -o"C:\Users\user\AppData\Roaming" -pPXOEWCVFPIJPLHQSQSX -aos -y	Jump to behavior
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Process created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe "C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe"

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: libjyy.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: version.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: wsock32.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: upsdk.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: tdpcontrol.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: tdpstat.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: libcurl.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: mpr.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: wininet.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: tdpinfo.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: wship6.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: hipsdiamain.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: msvcr100.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: sspicli.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: napinsp.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: pnrpnsp.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: wshbth.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: nlaapi.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: mswsock.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: winrnr.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: apphelp.dll
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: libmini.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: netdevenvspeed.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: dinput8.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: inputhost.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: hid.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: devobj.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: mmdevapi.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: ksuser.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: avrt.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: audioses.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: msacm32.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: midimap.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: devenum.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: msdmo.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: avicap32.dll
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Section loaded: msvfw32.dll

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

File written: C:\Users\user\AppData\Local\AdvinstAnalytics\6627be3e20a59ade4c1add8b\1.1.6\tracking.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Static file information: File size 28924664 > 1048576

Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe

File opened: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC90.CRT\msvcr90.dll

Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x237c00

Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\oDayProtect.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\dbs\el\ddvsm\out\Intermediate\vscommon\perfwatson2.csproj_FB008427_ret\objr\amd64\PerfWatson2.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp100.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000046D4000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMOfficeScan.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QQPCHwNetwork.pdbRR#GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\vmagent_new\bin\joblist\622859\src\x\x86_ntvbld\objfre_win7_x86\i386\ntvbld.pdb` source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\build\ob\bora-19436861\cayman_gettext\gettext\MSVC14\libintl_dll\Release\libintl_dll.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\gitproj\7z2201-src\CPP\7zip\UI\Console\Release\Console.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000002.2048756739.0000000000728000.00000002.00000001.01000000.0000000E.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000000.2000088539.0000000000728000.00000002.00000001.01000000.0000000E.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000000.2049813150.0000000000728000.00000002.00000001.01000000.0000000E.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000002.2064919257.0000000000728000.00000002.00000001.01000000.0000000E.sdmp, e8a0d5af432b7e64DBD.exe, 0000000D.00000002.2068010090.0000000000728000.00000002.00000001.01000000.0000000E.sdmp, e8a0d5af432b7e64DBD.exe, 0000000D.00000000.2066593628.0000000000728000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: D:\build\ob\bora-20800274\bora\build\build\LIBRARIES\vmwarestring\win32\release\vmwarestring.pdb!! source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMOfficeScanX64.pdb'' GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\KWSING\trunk\KwResource\pdb\release\HTTPRequest.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: mfc90.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004378000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-20800274\bora\build\build\LIBRARIES\vmwarestring\win32\release\vmwarestring.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\8168\vc98\dev\bin\vcspawn.pdbMZ source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcr120.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMDns.pdbDD!GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Projects\WinRAR\rar\build\rar32\Release\RAR.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\InstallerAnalytics.pdbz source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005246000.00000004.00001000.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMDns.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\KWSING\trunk\KwResource\pdb\release\KwCommonUI.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wininet.pdbUGP source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1707035647.0000000005014000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000003.00000003.1784899160.0000000003881000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\vmagent_new\bin\joblist\622869\src\x\x64_ntvbld\objfre_win7_amd64\amd64\ntvbld64.pdbL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-22583795\bora\build\build\authd\release\win32\vmware-authd.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\vmagent_new\bin\joblist\622859\src\x\x86_ntvbld\objfre_win7_x86\i386\ntvbld.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: h:\ch1\src\sandbox\wow_helper\wow_helper.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMEventBus.pdbZZ source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcr110.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\419058\out\Release\360AppCore.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.000000000408F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMAVProxy.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdbb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\build\ob\bora-19188697\cayman_glib\glib\src\build\win32\vs14\Release\Win32\bin\gmodule-2.0.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
Source:	Binary string: D:\build\ob\bora-22583795\bora\build\build\vmware-autostart\release\win32\vmware-autostart.pdb.. source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000047FB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000044D2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\Decoder.pdb8 source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
Source:	Binary string: msvcp90.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QQFileFlt.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_2.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000047FB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000044D2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: libEGL.dll.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\2\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\vmagent_new\bin\joblist\622869\src\x\x64_ntvbld\objfre_win7_amd64\amd64\ntvbld64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-22583795\bora\build\build\authd\release\win32\vmware-authd.pdb-- source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\bin\x86\embeddeduiproxy.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005313000.00000004.00001000.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1676650198.0000000003A80000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000003.00000003.1784669552.000000000421B000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000003.00000003.1781109686.000000000131F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: rundll32.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\build\ob\bora-21885936\cayman_zlib\build\release\win32_vc140\zlib\build\zlib1.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042962146.0000000003BC5000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000005051000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMRtpDLL.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\MemDefrag.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, MemDefrag.dll.9.dr
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\InstallerAnalytics.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005246000.00000004.00001000.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: C:\test\intelligentDemo\PackageMgr\Release\PackageMgr.pdb//' source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdbo source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMAVProxy.pdb__(GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wininet.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1707035647.0000000005014000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000003.00000003.1784899160.0000000003881000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: msvcr90.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004CF9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\build\ob\bora-21885936\cayman_zlib\build\release\win32_vc140\zlib\build\zlib1.pdb$$ source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042962146.0000000003BC5000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000005051000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\KWSING\trunk\KwResource\pdb\release\KwLayoutMgr.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QQFileFlt.pdb.. GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-20800274\bora\build\build\LIBRARIES\vmauthd-log\win32\release\vmauthd.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\KWSING\trunk\KwResource\pdb\release\KwLayoutMgr.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\MemDefrag.pdbII#GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, MemDefrag.dll.9.dr
Source:	Binary string: D:\a\_work\1\s\obj\VS\Microsoft.VisualStudio.Web.Host\Release\Microsoft.VisualStudio.Web.Host.pdbf source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\KWSING\trunk\KwResource\pdb\release\KwLib.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: .pdb% source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2131881089.0000000002568000.00000040.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMEventBus.pdb source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\1\s\\binaries\amd64ret\bin\amd64\\vcruntime140_1.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060498180.0000000003E80000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2060700308.0000000004080000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\stubs\x86\Decoder.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMOfficeScan.pdbLL%GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\Desktop\etcp5.0\Release\etcp.pdb source: Bor32-update-flase.exe, 00000012.00000002.2131881089.0000000002560000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: libEGL.dll.pdbs source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcr80.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp120.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000047FB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000044D2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcr100.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000044D2000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, Bor32-update-flase.exe, 00000012.00000002.2138244917.000000006F7F1000.00000020.00000001.01000000.00000017.sdmp
Source:	Binary string: d:\build\ob\bora-19436861\cayman_gettext\gettext\MSVC14\libintl_dll\Release\libintl_dll.pdb11 source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp110.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000046D4000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\oDayProtect.pdbAA#GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: msvcp80.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000047FB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\8168\vc98\dev\bin\vcspawn.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\AICustAct.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QQPCHwNetwork.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: G:\CLIENT\fhbemb\src\bin\Release\fhjyy.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005313000.00000004.00001000.00020000.00000000.sdmp, MSI7DAF.tmp, 00000008.00000000.1998413401.000000000023E000.00000002.00000001.01000000.0000000C.sdmp, MSI7DAF.tmp, 00000008.00000002.2068600823.000000000023E000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: C:\test\intelligentDemo\PackageMgr\Release\PackageMgr.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\KWSING\trunk\KwResource\pdb\release\kwlogsvr.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMOfficeScanX64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: e:\KWSING\trunk\KwResource\pdb\release\KwLib.pdbp source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\2\s\\binaries\amd64ret\bin\amd64\\msvcp140_1.amd64.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000047FB000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000044D2000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: h:\ch1\src\sandbox\wow_helper\wow_helper.pdbp source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\Prereq.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-22583795\bora\build\build\vmware-autostart\release\win32\vmware-autostart.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: G:\CLIENT\fhbemb\src\bin\Release_NL\fhbmini.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, Haloonoroff.exe, 00000013.00000000.2112966039.0000000000B9E000.00000002.00000001.01000000.00000019.sdmp
Source:	Binary string: C:\vmagent_new\bin\joblist\368203\out\Release\HipsLog.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\qci_workspace\root-workspaces\__qci-pipeline-1196123-1\Basic\Output\BinFinal\QMRtpDLL.pdbWW'GCTL source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: G:\CLIENT\WallPaper_feihuo\windows\FFWallpaper\bin\Release\bfcipc.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \WallPaper\windows\FFWallpaper\bin\Release\FFWallpaper.pdb source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr
Source:	Binary string: D:\a\_work\1\s\obj\VS\Microsoft.VisualStudio.Web.Host\Release\Microsoft.VisualStudio.Web.Host.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\SoftwareDetector.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005000000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\build\ob\bora-20800274\bora\build\build\LIBRARIES\basichttp\win32\release\basichttp.pdb source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\ReleaseAI\win\Release\custact\x86\lzmaextractor.pdb source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005000000.00000004.00001000.00020000.00000000.sdmp

Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: shi8085.tmp.0.dr

Static PE information: 0xC7FEC470 [Wed Apr 29 05:06:56 2076 UTC]

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00D1E740 LoadLibraryW,GetProcAddress,LoadImageW,FreeLibrary,

0_2_00D1E740

Source: NetmTray.dll.0.dr	Static PE information: section name: .menu_sh
Source: NetmTray64.dll.0.dr	Static PE information: section name: .menu_sh
Source: npaxlogin.dll.0.dr	Static PE information: section name: .orpc
Source: Ntvbld64.dll.0.dr	Static PE information: section name: .share
Source: HackPatch.dll.0.dr	Static PE information: section name: PlugImm
Source: HotfixCommon.dll.0.dr	Static PE information: section name: .detourc
Source: HotfixCommon.dll.0.dr	Static PE information: section name: .detourd
Source: HotfixCommon64.dll.0.dr	Static PE information: section name: .detourc
Source: HotfixCommon64.dll.0.dr	Static PE information: section name: .detourd
Source: ieplus.dll.0.dr	Static PE information: section name: .360_iep
Source: ieplus64.dll.0.dr	Static PE information: section name: .360_iep
Source: iNetSafe.dll.0.dr	Static PE information: section name: .shared
Source: iNetSafe64.dll.0.dr	Static PE information: section name: .detourc
Source: iNetSafe64.dll.0.dr	Static PE information: section name: .detourd
Source: libzdtp.dll.0.dr	Static PE information: section name: .detourc
Source: libzdtp.dll.0.dr	Static PE information: section name: .detourd
Source: libzdtp64.dll.0.dr	Static PE information: section name: .detourc
Source: libzdtp64.dll.0.dr	Static PE information: section name: .detourd
Source: shi8085.tmp.0.dr	Static PE information: section name: .wpp_sf
Source: shi8085.tmp.0.dr	Static PE information: section name: .didat
Source: NetmTray.dll.1.dr	Static PE information: section name: .menu_sh
Source: NetmTray64.dll.1.dr	Static PE information: section name: .menu_sh
Source: npaxlogin.dll.1.dr	Static PE information: section name: .orpc
Source: Ntvbld64.dll.1.dr	Static PE information: section name: .share
Source: HackPatch.dll.1.dr	Static PE information: section name: PlugImm
Source: HotfixCommon.dll.1.dr	Static PE information: section name: .detourc
Source: HotfixCommon.dll.1.dr	Static PE information: section name: .detourd
Source: HotfixCommon64.dll.1.dr	Static PE information: section name: .detourc
Source: HotfixCommon64.dll.1.dr	Static PE information: section name: .detourd
Source: ieplus.dll.1.dr	Static PE information: section name: .360_iep
Source: ieplus64.dll.1.dr	Static PE information: section name: .360_iep
Source: iNetSafe.dll.1.dr	Static PE information: section name: .shared
Source: iNetSafe64.dll.1.dr	Static PE information: section name: .detourc
Source: iNetSafe64.dll.1.dr	Static PE information: section name: .detourd

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A15462 push es; ret	0_3_03A1546E
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A15462 push es; ret	0_3_03A1546E
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A06C4F push 600072D9h; ret	0_3_03A06DD9
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A06C4F push 600072D9h; ret	0_3_03A06DD9
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A06DDC pushad ; ret	0_3_03A06DDD
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A06DDC pushad ; ret	0_3_03A06DDD
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A15462 push es; ret	0_3_03A1546E
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A15462 push es; ret	0_3_03A1546E
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A06C4F push 600072D9h; ret	0_3_03A06DD9
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A06C4F push 600072D9h; ret	0_3_03A06DD9
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A06DDC pushad ; ret	0_3_03A06DDD
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A06DDC pushad ; ret	0_3_03A06DDD
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_006E5472 push esi; iretd	0_3_006E552C
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_006E23ED push es; iretd	0_3_006E23EA
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A288B4 pushad ; retf	0_3_03A288B5
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A288B4 pushad ; retf	0_3_03A288B5
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A288B4 pushad ; retf	0_3_03A288B5
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A219BE pushfd ; ret	0_3_03A21A85
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A2049B pushad ; retf	0_3_03A2049C
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A268CC push eax; retf 0072h	0_3_03A268CD
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A268CC push eax; retf 0072h	0_3_03A268CD
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A268CC push eax; retf 0072h	0_3_03A268CD
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A21C3E pushfd ; ret	0_3_03A220C5
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A288B4 pushad ; retf	0_3_03A288B5
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A288B4 pushad ; retf	0_3_03A288B5
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A288B4 pushad ; retf	0_3_03A288B5
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A219BE pushfd ; ret	0_3_03A21A85
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A2049B pushad ; retf	0_3_03A2049C
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A268CC push eax; retf 0072h	0_3_03A268CD
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A268CC push eax; retf 0072h	0_3_03A268CD
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_3_03A268CC push eax; retf 0072h	0_3_03A268CD

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe

Executable created and started: C:\Windows\Installer\MSI7DAF.tmp

Jump to behavior

Sample is not signed and drops a device driver

Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe

File created: C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGXlong.sys

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: \installer espt masa pph versi 2.0#u007e26022009.exe
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: \installer espt masa pph versi 2.0#u007e26022009.exe			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\ntvbld.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\madDisAsm_.bpl	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shiF3C.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\KwLogSvr.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\QseCore.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\imhelper.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\lco.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libzdtp64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\qutmload.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\7z.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\vcruntime140.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\Ntvbld64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp110.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ImAVEng.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vclx120.bpl	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetmTray64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcr110.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\madBasic_.bpl	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\iNetSafe64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\bpchelper.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\zlib1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\HotfixCommon64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\fixsc64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\LeakFixHelper.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	File created: C:\Users\user\AppData\Local\Temp\5951281\....\TemporaryFile (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ieplus64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\ieplus64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\PackageMgr.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\QMDns.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	File created: C:\Users\user\AppData\Local\Temp\5950140\....\TemporaryFile (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\Gme.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\MSI8FEB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\hipslog.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\leakrepair.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\PDown.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\MSI83C3.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\imhelper.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File created: C:\Users\user\AppData\Local\Temp\24601\....\Microsoft.TransCompositia.msi (copy)	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\madExcept_.bpl	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp140_1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi1CCC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\libzdtp.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\http.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\HipsLogCenter.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\jpnative32.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\rar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\qutmipc.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp80.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	File created: C:\Users\user\AppData\Local\Temp\5951218\....\TemporaryFile (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\LeakFixHelper64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\np360SoftMgr.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\RX.EXE	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\qroscfg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\ieplus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\lzmaextractor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HotfixCommon64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NotifyDown.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\MSI9108.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\ATellPhon	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\hipslog.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Ntvbld64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HackPatch.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\oDayProtect.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\fhjyy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ntvbld.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\Gme.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC90.MFC\mfc90.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2D96.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\libmini.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\intl.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\PSpendZ.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\lockkrnl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\npaxlogin.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetmonEP.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\GmeApi64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\PopSoftEng.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Watson2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\fhjyy.exe	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp110.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\PDown.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2D07.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\MemDefrag.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\jpnative64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\INA8055.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMOfficeScanX64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMRtpDLL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\Hamster.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\probe.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QQFileFlt.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp120.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\Netgm.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\Ntvbld64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp120.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\oDayProtect.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libzdtp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetSpeed.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\LiveUpd360.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\jpnative32.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\TDPINFO.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\rtl120.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2CC8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\mobileflux.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\NotifyDown.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\MSI9AEC.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\qutmload.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\LeakFixHelper64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMDns.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shiFBA.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Agent	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libcurrant.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\DrawContent\DrawContentNoname.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\decoder.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\KwLayoutMgr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\heavygate.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\NetmTray64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\iNetSafe64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\libEGL.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\libcurl.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vcl120.bpl	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\APXhttp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\MSI1118.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\iNetSafe.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\MSI90C8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\NetmLogin.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vmauthd.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI519B.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMAVProxy.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetmTray.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\QseCore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\qutmipc.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	File created: C:\Users\user\AppData\Local\Temp\5951250\....\TemporaryFile (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\heavygate.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\UPSDK.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\NetDefender.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\QMAVProxy.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\LeakFixHelper.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Installer\libjyy.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\BBC.exe	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC90.CRT\msvcr90.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	File created: C:\Users\user\AppData\Local\Temp\5950109\....\TemporaryFile (copy)	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\libcurl.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\MSI10E8.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp140_2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File created: C:\Users\user\AppData\Local\Temp\1735434054\....\Microsoft.TransCompositio.msi (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\shi1C6D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\MiniUI.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\KwCommonUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\filemgr.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\netmstart.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\NetmTray.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\fixsc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HotfixCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\ImAVEng.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\netmstart.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\Netgm.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\iNetSafe.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\GmeApi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\libcurrant.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcr120.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\WHelp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2D66.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vcruntime140_1.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\XLGameUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ieplus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\np360SoftMgr.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\NetDevenvSpeed.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\bfcipc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\MSI8FBB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\NetDiagDll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetmLogin.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.Bcl.AsyncInterfaces.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\npaxlogin.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\QMEventBus.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp100.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\LiveUpd360.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp100.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QQPCHwNetwork.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\TDPSTAT.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\OTGContainer.exe	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	File created: C:\Users\user\AppData\Local\Temp\5950203\....\TemporaryFile (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\NetSpeed.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libgravity.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\jpnative64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\mobileflux.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp140_1.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMOfficeScan.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\ebHost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\Hamster.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\KwLib.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	File created: C:\Users\user\AppData\Local\Temp\5951187\....\TemporaryFile (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetDefender.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\HackPatch.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\ipcservice.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\shi2A36.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\PopSoftEng.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\shi8085.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\iopdate.exe	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\N0vaDesktop.exe	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\ntvbld.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\libscent35.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File created: C:\Users\user\AppData\Local\Temp\11835\....\Microsoft.TransCompositib.msi (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI516B.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\zip.exe	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ipcservice.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcr110.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\HotfixCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\filemgr.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\GmeApi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\probe.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\pluginmgr.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\TPClnVM.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\GmeApi64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libscent35.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\leakrepair.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetDiagDll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\fixsc64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\hipslog.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\MiniUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\lockkrnl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\7z.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\qroscfg.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcr80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2C69.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\pluginmgr.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\fixsc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\libgravity.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\TDPCONTROL.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcr100.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\PackageMgr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\MSI900B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7DAF.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\HipsdiaMain.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcr100.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\MSI8103.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp140_2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI788D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\NetmonEP.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\BtDDIFUEHLCR\libzdtp64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Users\user\AppData\Local\Temp\MSI905A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\fhjyy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File created: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HipsLogCenter.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\pp_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\APXmodule-2.0.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC90.CRT\msvcp90.dll	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI516B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI7DAF.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Windows\Installer\libjyy.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI519B.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2D07.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2CC8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2C69.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI788D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2D96.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI2D66.tmp	Jump to dropped file

Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vcl120.bpl	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vclx120.bpl	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Agent	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\ATellPhon	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\madBasic_.bpl	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\madDisAsm_.bpl	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\madExcept_.bpl	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File created: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\rtl120.bpl	Jump to dropped file

Source: C:\Windows\Installer\MSI7DAF.tmp

Code function: 8_2_6C1D10C0 ProcessMain,_memset,CoInitialize,CoCreateGuid,CoCreateGuid,swprintf,CoUninitialize,_memset,lstrlenW,lstrlenW,RegCreateKeyW,RegSetValueExW,RegCreateKeyW,lstrlenW,RegSetValueExW,RegCloseKey,RegCloseKey,RegCreateKeyW,lstrlenW,RegSetValueExW,RegCloseKey,_memset,_memset,_memset,_memset,_memset,_memset,_memset,_memset,_memset,__wcsrev,_memset,lstrcatW,lstrcatW,_memset,_memset,_memset,_memset,_memset,_memset,_memset,_memset,_memset,lstrcmpW,lstrcmpW,lstrcmpW,lstrcatW,lstrcatW,SHGetFolderPathW,SHGetFolderPathW,SHGetFolderPathW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,_memset,wsprintfW,wsprintfW,_memset,wsprintfW,_memset,wsprintfW,_memset,ShellExecuteExW,ShellExecuteExW,WaitForSingleObject,WaitForSingleObject,CloseHandle,ShellExecuteExW,WaitForSingleObject,CloseHandle,ShellExecuteExW,WaitForSingleObject,CloseHandle,

8_2_6C1D10C0

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ziooirdfb1542nmu

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00AC05DC IsIconic,GetWindowPlacement,GetWindowRect,	18_2_00AC05DC
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00AFA5DC IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	18_2_00AFA5DC
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00AD4990 IsIconic,	18_2_00AD4990
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00AD4A0C GetWindowLongA,IsIconic,IsWindowVisible,ShowWindow,SetWindowLongA,SetWindowLongA,ShowWindow,ShowWindow,	18_2_00AD4A0C
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00AFB054 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	18_2_00AFB054
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00AF9CD4 IsIconic,GetCapture,	18_2_00AF9CD4

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe

Code function: 18_2_00B000BC SetErrorMode,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetErrorMode,

18_2_00B000BC

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT	Jump to behavior

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe

Code function: 18_2_009780EC

18_2_009780EC

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\msiexec.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File opened / queried: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\themes\ovf-vmware.xsd
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	File opened / queried: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\themes\ovfenv-vmware.xsd

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe

Code function: GetCurrentThreadId,GetCursorPos,WaitForSingleObject,

18_2_00ADDE9C

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: GetAdaptersInfo,GetAdaptersInfo,

0_2_6C605B60

Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe

Thread delayed: delay time: 86400000

Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Window / User API: threadDelayed 2063
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Window / User API: threadDelayed 1712
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Window / User API: threadDelayed 1502
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Window / User API: foregroundWindowGot 1761

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\ntvbld.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\madDisAsm_.bpl	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shiF3C.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\KwLogSvr.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\QseCore.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\imhelper.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\lco.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libzdtp64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\qutmload.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\7z.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\Ntvbld64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp110.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ImAVEng.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vclx120.bpl	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetmTray64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcr110.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\madBasic_.bpl	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\iNetSafe64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\bpchelper.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\zlib1.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\HotfixCommon64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\fixsc64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\LeakFixHelper.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5951281\....\TemporaryFile (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ieplus64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\ieplus64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\PackageMgr.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\QMDns.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5950140\....\TemporaryFile (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\Gme.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI8FEB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\hipslog.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\leakrepair.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\PDown.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\imhelper.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI83C3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\24601\....\Microsoft.TransCompositia.msi (copy)	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\madExcept_.bpl	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp140_1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi1CCC.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\http.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\libzdtp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\HipsLogCenter.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\rar.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\jpnative32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\qutmipc.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp80.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5951218\....\TemporaryFile (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\LeakFixHelper64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\RX.EXE	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\np360SoftMgr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\qroscfg.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\ieplus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HotfixCommon64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\lzmaextractor.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NotifyDown.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI9108.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\hipslog.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\ATellPhon	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Ntvbld64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HackPatch.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\oDayProtect.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\Gme.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ntvbld.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC90.MFC\mfc90.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2D96.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\PSpendZ.exe	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\intl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\lockkrnl.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\npaxlogin.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetmonEP.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\GmeApi64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\PopSoftEng.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Watson2.exe	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp110.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\PDown.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\MemDefrag.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2D07.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\jpnative64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMOfficeScanX64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\INA8055.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMRtpDLL.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\Hamster.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp120.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\probe.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QQFileFlt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\Netgm.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\Ntvbld64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\oDayProtect.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libzdtp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetSpeed.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\LiveUpd360.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\jpnative32.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\rtl120.bpl	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\mobileflux.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2CC8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\NotifyDown.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI9AEC.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\qutmload.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\LeakFixHelper64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMDns.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shiFBA.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Agent	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libcurrant.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\DrawContent\DrawContentNoname.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\decoder.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\KwLayoutMgr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\heavygate.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\NetmTray64.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\iNetSafe64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\libEGL.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vcl120.bpl	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\APXhttp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\iNetSafe.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI1118.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI90C8.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\NetmLogin.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vmauthd.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMAVProxy.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI519B.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetmTray.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\qutmipc.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5951250\....\TemporaryFile (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\QseCore.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\heavygate.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\NetDefender.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\QMAVProxy.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\LeakFixHelper.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC90.CRT\msvcr90.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5950109\....\TemporaryFile (copy)	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI10E8.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp140_2.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi1C6D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\MiniUI.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\KwCommonUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\filemgr.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\netmstart.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcr120.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\NetmTray.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\ImAVEng.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HotfixCommon.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\fixsc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\netmstart.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\Netgm.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\iNetSafe.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\GmeApi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\libcurrant.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcr120.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\WHelp.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2D66.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vcruntime140_1.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\XLGameUpdate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ieplus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\np360SoftMgr.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\bfcipc.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI8FBB.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\NetDiagDll.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetmLogin.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.Bcl.AsyncInterfaces.exe	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\QMEventBus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\npaxlogin.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp100.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\LiveUpd360.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp100.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QQPCHwNetwork.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\OTGContainer.exe	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5950203\....\TemporaryFile (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\NetSpeed.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\jpnative64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libgravity.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\mobileflux.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp140_1.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMOfficeScan.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\ebHost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\Hamster.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\KwLib.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\5951187\....\TemporaryFile (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetDefender.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\HackPatch.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\ipcservice.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi2A36.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi8085.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\PopSoftEng.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\iopdate.exe	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\N0vaDesktop.exe	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\ntvbld.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\libscent35.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\11835\....\Microsoft.TransCompositib.msi (copy)	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI516B.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\zip.exe	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ipcservice.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcr110.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\HotfixCommon.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\filemgr.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\GmeApi.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\probe.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\pluginmgr.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\TPClnVM.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\GmeApi64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libscent35.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\leakrepair.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetDiagDll.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\hipslog.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\fixsc64.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\MiniUI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\lockkrnl.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\7z.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\qroscfg.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcr80.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\pluginmgr.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI2C69.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\fixsc.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\libgravity.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\PackageMgr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI900B.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI8103.tmp	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp140_2.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI788D.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\NetmonEP.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Program Files (x86)\BtDDIFUEHLCR\libzdtp64.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI905A.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Dropped PE file which has not been started: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HipsLogCenter.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\pp_helper.exe	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\APXmodule-2.0.dll	Jump to dropped file
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC90.CRT\msvcp90.dll	Jump to dropped file

Source: C:\Windows\Installer\MSI7DAF.tmp

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	API coverage: 9.0 %
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	API coverage: 1.0 %

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe

Code function: 18_2_009780EC

18_2_009780EC

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe TID: 3848	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe TID: 7984	Thread sleep time: -172800000s >= -30000s
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe TID: 7992	Thread sleep time: -2063000s >= -30000s
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe TID: 7996	Thread sleep time: -108000s >= -30000s
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe TID: 8004	Thread sleep time: -960000s >= -30000s
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe TID: 3612	Thread sleep time: -31000s >= -30000s
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe TID: 2044	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe TID: 7988	Thread sleep time: -1502000s >= -30000s

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86) FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\Program Files (x86)\WindowsInstallerFB\7AF5081 FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D40640 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	0_2_00D40640
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C20880 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,PathIsUNCW,	0_2_00C20880
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D1B1B0 FindFirstFileW,GetLastError,FindClose,	0_2_00D1B1B0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D4A4B0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_00D4A4B0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D4A8B0 FindFirstFileW,FindClose,	0_2_00D4A8B0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D1A850 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,	0_2_00D1A850
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00D28F30 FindFirstFileW,FindClose,FindClose,	0_2_00D28F30
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00CFFE80 FindFirstFileW,FindNextFileW,FindClose,	0_2_00CFFE80
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C61D070 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,	0_2_6C61D070
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C627870 FindFirstFileW,FindClose,GetLastError,FindClose,	0_2_6C627870
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00D1B1B0 FindFirstFileW,GetLastError,FindClose,	3_2_00D1B1B0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00D1ABE0 FindFirstFileW,	3_2_00D1ABE0
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006A8BA4 __EH_prolog3_GS,FindFirstFileA,FindFirstFileW,FindFirstFileW,	9_2_006A8BA4
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_0070D9C1 FindFirstFileExW,	9_2_0070D9C1
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_0070D996 FindFirstFileExA,	9_2_0070D996
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_0093657C GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	18_2_0093657C
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00938E6A FindFirstFileA,FindClose,	18_2_00938E6A
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00938E6C FindFirstFileA,FindClose,	18_2_00938E6C
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B32298 FindFirstFileA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,	18_2_00B32298
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00A6A696 FindFirstFileA,FindClose,	18_2_00A6A696
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00A6A698 FindFirstFileA,FindClose,	18_2_00A6A698
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00A6A7A8 FindFirstFileA,FindClose,	18_2_00A6A7A8
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00AB27D0 FindFirstFileA,FindClose,FileTimeToDosDateTime,	18_2_00AB27D0
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00A6AAB4 FindFirstFileA,GetLastError,	18_2_00A6AAB4
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00A66B80 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	18_2_00A66B80
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: 18_2_00B2EDA0 FindFirstFileA,SetFileAttributesA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,	18_2_00B2EDA0

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00D49310 _wcsrchr,_wcsrchr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

0_2_00D49310

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00DB19D1 VirtualQuery,GetSystemInfo,

0_2_00DB19D1

Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Thread delayed: delay time: 86400000
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Thread delayed: delay time: 30000

Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CompanyNameVMware, Inc.b
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: <description>"VMware Authorization Service"</description>
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-vmx.exe%s%c..%c%svmware-vmx-debug.exevmware-vmx-stats.exeNo ticket found
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: StartVirtualMachines%s: Failed to retrieve info from %%ALLUSERSPROFILE%%%s.
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMwareAutostartServiceVMAutostartRunServiceStarting service control dispatcher
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: name="VMware.VMware.vmauthd"
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[vmwarestring.dll??0string@utf@@QAE@ABV01@@Z??0string@utf@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z??0string@utf@@QAE@ABV_bstr_t@@@Z??0string@utf@@QAE@ABVubstr_t@@@Z??0string@utf@@QAE@ABVustring@Glib@@@Z??0string@utf@@QAE@PBD@Z??0string@utf@@QAE@PBDW4StringEncoding@@@Z??0string@utf@@QAE@PB_W@Z??0string@utf@@QAE@XZ??1string@utf@@QAE@XZ??4string@utf@@QAEAAV01@V01@@Z??8string@utf@@QBE_NABV01@@Z??9string@utf@@QBE_NABV01@@Z??Astring@utf@@QBEII@Z??Bstring@utf@@QBE?BVubstr_t@@XZ??Bstring@utf@@QBEABVustring@Glib@@XZ??Hstring@utf@@QBE?AV01@ABV01@@Z??Hstring@utf@@QBE?AV01@I@Z??Mstring@utf@@QBE_NABV01@@Z??Nstring@utf@@QBE_NABV01@@Z??Ostring@utf@@QBE_NABV01@@Z??Pstring@utf@@QBE_NABV01@@Z??Ystring@utf@@QAEAAV01@ABV01@@Z??Ystring@utf@@QAEAAV01@I@Z?CopyAndFree@utf@@YA?AVstring@1@PADP6AXPAX@Z@Z?CreateWithBOMBuffer@utf@@YA?AVstring@1@PBXH@Z?CreateWithLength@utf@@YA?AVstring@1@PBXHW4StringEncoding@@@Z?CreateWritableBuffer@utf@@YAXABVstring@1@AAV?$vector@DV?$allocator@D@std@@@std@@@Z?CreateWritableBuffer@utf@@YAXABVstring@1@AAV?$vector@_WV?$allocator@_W@std@@@std@@@Z?GetUtf16Cache@string@utf@@ABEPB_WXZ?IntToStr@utf@@YA?AVstring@1@_J@Z?InvalidateCache@string@utf@@AAEXXZ?Validate@utf@@YA_NABVustring@Glib@@@Z?__autoclassinit2@string@utf@@QAEXI@Z?append@string@utf@@QAEAAV12@ABV12@@Z?append@string@utf@@QAEAAV12@ABV12@II@Z?append@string@utf@@QAEAAV12@PBDI@Z?assign@string@utf@@QAEAAV12@ABV12@@Z?begin@string@utf@@QAE?AV?$ustring_Iterator@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@@Glib@@XZ?begin@string@utf@@QBE?AV?$ustring_Iterator@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@@Glib@@XZ?bytes@string@utf@@QBEIXZ?c_str@string@utf@@QBEPBDXZ?clear@string@utf@@QAEXXZ?compare@string@utf@@QBEHABV12@_N@Z?compare@string@utf@@QBEHIIABV12@@Z?compareLength@string@utf@@QBEHABV12@I_N@Z?compareRange@string@utf@@QBEHIIABV12@II_N@Z?empty@string@utf@@QBE_NXZ?end@string@utf@@QAE?AV?$ustring_Iterator@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@@Glib@@XZ?end@string@utf@@QBE?AV?$ustring_Iterator@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@@Glib@@XZ?endsWith@string@utf@@QBE_NABV12@_N@Z?erase@string@utf@@QAE?AV?$ustring_Iterator@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@@Glib@@V34@0@Z?erase@string@utf@@QAE?AV?$ustring_Iterator@V?$_String_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@@Glib@@V34@@Z?erase@string@utf@@QAEAAV12@II@Z?find@string@utf@@QBEIABV12@I@Z?find@string@utf@@QBEIII@Z?find_first_not_of@string@utf@@QBEIABV12@I@Z?find_first_not_of@string@utf@@QBEIII@Z?find_first_of@string@utf@@QBEIABV12@I@Z?find_first_of@string@utf@@QBEIII@Z?find_last_not_of@string@utf@@QBEIABV12@I@Z?find_last_not_of@string@utf@@QBEIII@Z?find_last_of@string@utf@@QBEIABV12@I@Z?find_last_of@string@utf@@QBEIII@Z?foldCase@string@utf@@QBE?AV12@XZ?insert@string@utf@@QAEAAV
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2043755856.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VGX\Optimizat\themes\ovfenv-vmware.xsdz.
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PANIC: %s599 vmware-authd PANIC: %s
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: D:\build\ob\bora-20800274\bora\build\build\LIBRARIES\vmwarestring\win32\release\vmwarestring.pdb!!
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.2081490565.0000000003AC9000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2086372576.0000000003ACC000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1703604464.0000000003ACE000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.2083458136.0000000003AC9000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1703086836.0000000003ACE000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.2082256697.0000000003AC9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwarebase.DLL
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Unicode_TrimRightvmwarebase.DLL
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2048294440.0000000000A58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VGXVGX/HoursBrokerVGX/HoursBroker/DrawContentVGX/Microsoft.VC90.CRTVGX/Microsoft.VC90.MFCVGX/OptimizatVGX/Optimizat/pluginsVGX/Optimizat/themesVGX/pluginsVGX/plugins/RunHoursVGX/UtilsVGX/versionVGX/BoukenVGX/BoukenPVGX/Browser_2VGX/AgentVGX/APKwait.batVGX/ATellPhonVGX/bbnn.rbgVGX/Blend.visualelementsmanifest.xmlVGX/Browser_1VGX/BseziofVGX/cbg.sigVGX/cdm.sigVGX/chrome_200_percent.pakVGX/contribscr.iniVGX/cor.sigVGX/DataTransform.iniVGX/dmEetfzcFeMLeUVbVGX/HoursBroker/CIM_ResourceAllocationSettingData.xsdVGX/HoursBroker/CIM_VirtualSystemSettingData.xsdVGX/HoursBroker/common.xsdVGX/HoursBroker/hi.pakVGX/HoursBroker/hr.pakVGX/HoursBroker/hu.pakVGX/HoursBroker/li.datVGX/HoursBroker/LICENSE.3rdVGX/HoursBroker/LICENSE.libcodecsVGX/HoursBroker/LICENSE.libdtVGX/HoursBroker/livehis.datVGX/HoursBroker/Microsoft.VC80.ATL.manifestVGX/HoursBroker/Microsoft.VC80.CRT.manifestVGX/HoursBroker/package.jsonVGX/HoursBroker/rpi.datVGX/HoursBroker/slist.datVGX/HoursBroker/versionVGX/HoursBroker/xml.xsdVGX/intchar32VGX/intchar64VGX/LastnamaVGX/LastnameVGX/LastnymcVGX/libtemp.batVGX/LostVGX/LostHeVGX/LostPVGX/LostPHeVGX/LostPSheVGX/LostSheVGX/madBasic_.bplVGX/madDisAsm_.bplVGX/madExcept_.bplVGX/Microsoft.VC80.ATL.manifestVGX/Microsoft.VC80.CRT.manifestVGX/Microsoft.VC90.CRT/Microsoft.VC90.CRT.manifestVGX/Microsoft.VC90.MFC/Microsoft.VC90.MFC.manifestVGX/Microsoft_VC90_CRT_manifestVGX/NetSpeedLogVGX/NULL.binVGX/NVIDIA_GeForce_Experience_jsonVGX/Optimizat/plugins/am.pakVGX/Optimizat/plugins/ar.pakVGX/Optimizat/plugins/bg.pakVGX/Optimizat/plugins/Microsoft.VC80.ATL.manifestVGX/Optimizat/plugins/Microsoft.VC80.CRT.manifestVGX/Optimizat/plugins/vd.icoVGX/Optimizat/plugins/versionVGX/Optimizat/themes/ca.pakVGX/Optimizat/themes/cs.pakVGX/Optimizat/themes/da.pakVGX/Optimizat/themes/isolinux.binVGX/Optimizat/themes/ovf-vmware.xsdVGX/Optimizat/themes/ovfenv-vmware.xsdVGX/Optimizat/themes/sample.flpVGX/Optimizat/vmPerfmon.hVGX/plugins/de.pakVGX/plugins/el.pakVGX/plugins/en-GB.pakVGX/plugins/en-US.pakVGX/plugins/Microsoft.VC80.ATL.manifestVGX/plugins/Microsoft.VC80.CRT.manifestVGX/plugins/RunHours/es-419.pakVGX/plugins/RunHours/es.pakVGX/plugins/RunHours/et.pakVGX/plugins/RunHours/fa.pakVGX/plugins/versionVGX/Ptuity.plxVGX/Ptuityoosty.plxVGX/qvlnk.broVGX/rbVGX/rtl120.bplVGX/settingssVGX/settingss2VGX/somextrainfo.iniVGX/SresoBooster.uiVGX/station.binVGX/SysP1.batVGX/SysP2.batVGX/Theme.icoVGX/TP.iniVGX/vcl120.bplVGX/vclx120.bplVGX/version/AARV1VGX/version/AARV2VGX/version/AuLibV1VGX/version/AuLibV2VGX/version/CharMainoV1VGX/version/CharMainoV2VGX/version/CjLibV1VGX/version/CjLibV2VGX/version/ComeOnVGX/version/globalV1VGX/version/globalV2VGX/version/QdLibV1VGX/version/QdLibV2VGX/version/qvlnkbroV1VGX/version/qvlnkbroV2VGX/version/settingV1VGX/version/settingV2VGX/version/ShellVGX/version/TOFNCVGX/version/WinCallVGX/VNL.iniVGX/WBGvisualelementsmanifestVGX/WGLogin.olgVGX/Win.rbgVGX/7z.dllVGX/APXhttp.dllVGX/APXmodule-2.0.dllVGX/BBC.exeVGX/bfcipc.dllVGX/bpchelper.dllVGX/ebHost.exeVGX/EduW
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 17.5.0 build-22583795VMware Workstation%s Authentication Daemon Version %u.%u for %s %s
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: D:\build\ob\bora-20800274\bora\build\build\LIBRARIES\vmwarestring\win32\release\vmwarestring.pdb
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware
Source: Haloonoroff.exe, 00000013.00000003.2130602491.0000000001307000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VBoxService.exeZv
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2043755856.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\themes\ovfenv-vmware.xsd
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Invalid pathname (too long)Config file not found: %sVMware Server ConsoleYou need read access in order to connect with the %s. Access denied for config file: %sYou need execute access in order to connect with the %s. Access denied for config file: %s%s-fdConnect %sError connecting to %s service instance.Can't create mutex '%s' (%d)Timeout acquiring thread lock.-fdvmauthd.connectionSetupTimeoutCould not open %s process %d. (error %d)Error connecting to vmx process.No such %s process: %s
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware Authorization Service
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: name="VMware.VMware.vmwarestring"
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: HttpURI_ParseAndDecodeURLvmwarebase.DLL
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FileDescriptionVMware BasicHTTP DLLL
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware Server Console
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-autostart.log
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Authorization and authentication service for starting and accessing virtual machinesVMware Authorization ServiceVMAuthdServiceSuccessfully registered %s.
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: D:\build\ob\bora-22583795\bora\build\build\authd\release\win32\vmware-authd.pdb
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FileDescriptionVMware event log sourceL
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMWARE_BASICHTTP_TRACE
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware Workstation
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 599 vmware-authd PANIC: %s
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevmware-authd.exeF
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: : SSL RequiredNFCSSL supported/tServerDaemonProtocol:SOAPVMware%s Authentication Daemon Version %u.%u%s, %s, %s, %s, %s, %s%sError retrieving thumbprintInvalid arguments to '%s%s'Login failed: token key authentication not allowed.GET TOKEN KEY failed: got %s
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-hostd
Source: Bor32-update-flase.exe, 00000012.00000002.2129533385.00000000006F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllY
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005000000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: RegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMWARE_HTTPSPROXYBasicHTTP: AppendRequestHeader failed to append to the request header. Insufficient memory.
Source: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.2081357784.000000000078D000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1703664200.0000000000765000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1703743080.000000000078D000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1703514174.000000000072C000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.2083037286.000000000078D000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2084822308.000000000078D000.00000004.00000020.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1794827924.000000000078D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWha
Source: Haloonoroff.exe, 00000013.00000003.2130602491.0000000001307000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vmtoolsd.exe
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FileDescriptionVMware string libraryL
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevmwarestring.DLLF
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: D:\build\ob\bora-22583795\bora\build\build\vmware-autostart\release\win32\vmware-autostart.pdb
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: <description>"VMware string library"</description>
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: nfcnfcsslvmware-hostdPROXY service %s not found.USER too long.Password required for %s.Login with USER first.InSeCuRePassword not understood.User %s logged in.LOGIN FAILURE from %.128s, %s
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmwarestring.dll
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: StartVirtualMachines
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ProductNameVMware WorkstationP
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \VMware\VMware Workstation\vmAutoStart.xml
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 1998-2023 VMware, Inc.J
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2043755856.0000000000B24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\themes\ovfenv-vmware.xsd
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMWARE_BASICHTTP_TRACE0bora\apps\lib\basicHttp\http.cBasicHTTP: curl_multi_init failed.
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: D:\build\ob\bora-22583795\bora\build\build\vmware-autostart\release\win32\vmware-autostart.pdb..
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: FileDescriptionVMware Authorization ServiceL
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 1998-2022 VMware, Inc.J
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-vmx-debug.exe
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 1998-2022 VMware, Inc.D
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMWARE_HTTPSPROXY
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-vmx-stats.exe
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: File_CreateDirectoryvmwarebase.DLL)_strdup
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: security.host.ruisslvmwareauthd.policy.allowRCForReadvmauthd.startupTimeoutgetpeername failed: %d tid %d
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: User not authorized for vpx agent contactvmware-vpxaUser not authorized for vmx contactConnecting socket=%s
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: D:\build\ob\bora-22583795\bora\build\build\authd\release\win32\vmware-authd.pdb--
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: InternalNamevmwarestringj#
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: \\.\pipe\vmware-authdpipeCreateNamedPipe failed: %s (%d)
Source: Haloonoroff.exe, 00000013.00000003.2130602491.0000000001307000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareTray.exe#v
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: @vmware-autostartVMAutostart_InitGetVMAutostartConfigFilePathCould not get the ALLUSERSPROFILE folder path
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CompanyNameVMware, Inc.R
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: <description>"VMware event log source"</description>
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CompanyNameVMware, Inc.T
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware-client
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-vmx.exe
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: CompanyNameVMware, Inc.X
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 1998-2022 VMware, Inc.@
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware Autostart ServiceCreateService failed (%d)
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: name="VMware.VMware.basichttp"
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: name="VMware.VMware.vmauthd-log"
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-\vmware-autostart.loga+Cannot open file '%s'
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-vpxa
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: vmware-autostart
Source: e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: <description>"VMware BasicHTTP DLL"</description>

Source: C:\Windows\Installer\MSI7DAF.tmp	API call chain: ExitProcess graph end node
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00DB9913 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00DB9913

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00D4D260 CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,FlushFileBuffers,WriteFile,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,OutputDebugStringW,WriteFile,WriteFile,FlushFileBuffers,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,

0_2_00D4D260

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00D1E740 LoadLibraryW,GetProcAddress,LoadImageW,FreeLibrary,

0_2_00D1E740

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00DB41D9 mov esi, dword ptr fs:[00000030h]	0_2_00DB41D9
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00DCE8FB mov eax, dword ptr fs:[00000030h]	0_2_00DCE8FB
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00DCE93F mov eax, dword ptr fs:[00000030h]	0_2_00DCE93F
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00DBFDF7 mov ecx, dword ptr fs:[00000030h]	0_2_00DBFDF7
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C63D57C mov ecx, dword ptr fs:[00000030h]	0_2_6C63D57C
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C6468F9 mov eax, dword ptr fs:[00000030h]	0_2_6C6468F9
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00DB41D9 mov esi, dword ptr fs:[00000030h]	3_2_00DB41D9
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00DCE8FB mov eax, dword ptr fs:[00000030h]	3_2_00DCE8FB
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00DCE93F mov eax, dword ptr fs:[00000030h]	3_2_00DCE93F
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00DBFDF7 mov ecx, dword ptr fs:[00000030h]	3_2_00DBFDF7
Source: C:\Windows\Installer\MSI7DAF.tmp	Code function: 8_2_002360A8 mov eax, dword ptr fs:[00000030h]	8_2_002360A8
Source: C:\Windows\Installer\MSI7DAF.tmp	Code function: 8_2_00238164 mov eax, dword ptr fs:[00000030h]	8_2_00238164
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006F1819 mov eax, dword ptr fs:[00000030h]	9_2_006F1819
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006F18A7 mov eax, dword ptr fs:[00000030h]	9_2_006F18A7

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00DB4245 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

0_2_00DB4245

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C3AEA0 __set_se_translator,SetUnhandledExceptionFilter,	0_2_00C3AEA0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00DB4CCD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00DB4CCD
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00C3D8C0 __set_se_translator,SetUnhandledExceptionFilter,	0_2_00C3D8C0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_00DB9913 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00DB9913
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C6305E5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C6305E5
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C62F87E SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C62F87E
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 0_2_6C634963 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C634963
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C3D8C0 __set_se_translator,SetUnhandledExceptionFilter,	3_2_00C3D8C0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00DB9913 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00DB9913
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00DB4CCD SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00DB4CCD
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: 3_2_00C3AEA0 __set_se_translator,SetUnhandledExceptionFilter,	3_2_00C3AEA0
Source: C:\Windows\Installer\MSI7DAF.tmp	Code function: 8_2_00235453 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_00235453
Source: C:\Windows\Installer\MSI7DAF.tmp	Code function: 8_2_00232920 SetUnhandledExceptionFilter,	8_2_00232920
Source: C:\Windows\Installer\MSI7DAF.tmp	Code function: 8_2_00231EEE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00231EEE
Source: C:\Windows\Installer\MSI7DAF.tmp	Code function: 8_2_0023278E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0023278E
Source: C:\Windows\Installer\MSI7DAF.tmp	Code function: 8_2_6C1D2521 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_6C1D2521
Source: C:\Windows\Installer\MSI7DAF.tmp	Code function: 8_2_6C1D1BC3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_6C1D1BC3
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006E460E IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_006E460E
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006E47A4 SetUnhandledExceptionFilter,	9_2_006E47A4
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_00708B72 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	9_2_00708B72
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: 9_2_006E3395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	9_2_006E3395

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00D02AF0 CreateFileW,CloseHandle,WriteFile,CloseHandle,ShellExecuteExW,

0_2_00D02AF0

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Process created: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe "C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe" /i "C:\Program Files (x86)\WindowsInstallerFB\7AF5081\DAN_127.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\BtDDIFUEHLCR" SECONDSEQUENCE="1" CLIENTPROCESSID="5324" AI_MORE_CMD_LINE=1	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process created: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe "C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\TLGCBXAGVFLQ.KBI" -o"C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1" -pJHKQFETWJKTIHLLBOKO -aos -y	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process created: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe "C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\SUGIPFIMNRQE.TMA" -o"C:\Program Files (x86)\BtDDIFUEHLCR" -pMNHWOTMLOHTPVRFXPCH -aos -y	Jump to behavior
Source: C:\Windows\Installer\MSI7DAF.tmp	Process created: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe "C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\TMGJRLDUDWLQ.FCU" -o"C:\Users\user\AppData\Roaming" -pPXOEWCVFPIJPLHQSQSX -aos -y	Jump to behavior

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Process created: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe "c:\users\user\desktop\installer espt masa pph versi 2.0#u007e26022009.exe" /i "c:\program files (x86)\windowsinstallerfb\7af5081\dan_127.msi" ai_euimsi=1 appdir="c:\program files (x86)\btddifuehlcr" secondsequence="1" clientprocessid="5324" ai_more_cmd_line=1
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Process created: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe "c:\users\user\desktop\installer espt masa pph versi 2.0#u007e26022009.exe" /i "c:\program files (x86)\windowsinstallerfb\7af5081\dan_127.msi" ai_euimsi=1 appdir="c:\program files (x86)\btddifuehlcr" secondsequence="1" clientprocessid="5324" ai_more_cmd_line=1			Jump to behavior

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe

Code function: 18_2_00B2F1A0 OpenDesktopA,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateDesktopA,

18_2_00B2F1A0

Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	Binary or memory string: Fabout:blank:\kernel32.dll*winswinntwin2000win2000serverwinxpwin2003winvistawin2008win7win2008r2win8win2012win11win10GetNativeSystemInfoProgmanSHELLDLL_DefViewWorkerWSysListView32ToolbarWindow32NotifyIconOverflowWindowBUTTON;Versionopen=%s\%sgetNetBarConfig szMainkey:%s szKey:%s szValue:%s getNetBarConfig error szMainkey:%s szKey:%s
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	Binary or memory string: ]wQCFFTaskBarDlg{"fftaskbar":{"%s":1,"color":%d,"percent":%d,"align":%d,"applyType":%d}}-%s %d %d %d %dSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeGameDev.exeSOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\WeGame.exeInstallPath%s\wegame.exeExeFileGetCommandLineWkernelBase.dllGetCmdLinentdllProgram ManagerNVIDIA GeForce OverlayDeskWindowkdeskOSRWindowCcWaterMarkWindowATL:00D719E0TXGuiFoundationFound FullScreen Windows: strWindowName=%s strWndClassName=%s hwnd=0x%xSOFTWARE\Microsoft\Windows\CurrentVersion\RunFFWallpaper.exe -silentFFWallpaperSetAutoRun %d, result: %dFolderViewTXMiniSkinLhb
Source: Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	Binary or memory string: tiCBaseWallPaperPlayer::RemoveAllOldWindowsCBaseWallPaperPlayer: RemoveOldWindowsEx: BasePlayerWnd=0x%xCBaseWallPaperPlayer::RemoveWindows()~CDesktopAttributesCDesktopAttributes::ExitFetchThreadCDesktopAttributes::FetchDesktopInfoThreadNew thread New start @@@@CDesktopAttributes::FetchDesktopInfoThread New exitCDesktopAttributes::FetchDesktopInfoThread New not found Program ManagerCDesktopAttributes::FetchDesktopInfoThread New begin set worker end: #### no explorer.exeCDesktopAttributes::FetchDesktopInfoThread New Err: #### no Program Manager with explorerCDesktopAttributes::monitor explorer err quit bizhiWindows

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_6C630708 cpuid

0_2_6C630708

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,	0_2_00D430D0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_6C649C73
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,	0_2_6C60D5E0
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: EnumSystemLocalesW,	0_2_6C6495FC
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: EnumSystemLocalesW,	0_2_6C6495B1
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: EnumSystemLocalesW,	0_2_6C6415BE
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: EnumSystemLocalesW,	0_2_6C649697
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_6C649722
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: GetLocaleInfoW,	0_2_6C649975
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: GetLocaleInfoW,	0_2_6C641A87
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_6C649A9E
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Code function: GetLocaleInfoW,	0_2_6C649BA4
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: GetLocaleInfoW,	9_2_0070A219
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	9_2_0071335A
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: EnumSystemLocalesW,	9_2_007135D2
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: EnumSystemLocalesW,	9_2_0071363B
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: EnumSystemLocalesW,	9_2_007136D6
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	9_2_00713763
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: EnumSystemLocalesW,	9_2_007097C9
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: EnumSystemLocalesW,	9_2_007098ED
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: EnumSystemLocalesW,	9_2_00709931
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: GetLocaleInfoW,	9_2_007139B3
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	9_2_00713ADC
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: GetLocaleInfoW,	9_2_00713BE3
Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	9_2_00713CB0
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	18_2_00936740
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: GetLocaleInfoA,	18_2_0093C6A8
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: GetLocaleInfoA,	18_2_0093C6F4
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	18_2_0093684C
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: GetLocaleInfoA,	18_2_00A6E194
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: GetLocaleInfoA,	18_2_00A6E1E0
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	18_2_00A66D44
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	18_2_00A66E50
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	18_2_00B76054
Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	18_2_00B76160

Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\three_colors.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\three_colors.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\blue.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\three_colors.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\blue.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\three_colors.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\blue.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\whitesmall.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\whitesmall.jpg VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\whitesmall.jpg VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00D598C0 CreateNamedPipeW,CreateFileW,

0_2_00D598C0

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00D4D180 GetLocalTime,

0_2_00D4D180

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Code function: 0_2_00D581C0 GetUserNameW,GetUserNameW,GetLastError,GetUserNameW,GetEnvironmentVariableW,GetEnvironmentVariableW,RegDeleteValueW,RegCloseKey,RegCloseKey,RegQueryInfoKeyW,RegCloseKey,RegCloseKey,RegDeleteKeyW,RegCloseKey,RegDeleteValueW,RegCloseKey,

0_2_00D581C0

Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe

Code function: 18_2_00A872D0 GetTimeZoneInformation,

18_2_00A872D0

Source: C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe

Code function: 9_2_006E0FC5 __EH_prolog3_catch_GS,GetVersionExA,

9_2_006E0FC5

Source: C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\SysWOW64\msiexec.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	31 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 Create Account	1 DLL Side-Loading	2 Obfuscated Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	1 Screen Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	2 Windows Service	1 Access Token Manipulation	1 Timestomp	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	31 Input Capture	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Windows Service	1 DLL Side-Loading	NTDS	4 File and Directory Discovery	Distributed Component Object Model	3 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	13 Process Injection	1 File Deletion	LSA Secrets	47 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	132 Masquerading	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	141 Virtualization/Sandbox Evasion	DCSync	281 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	13 Process Injection	/etc/passwd and /etc/shadow	141 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	11 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	Embedded Payloads	Keylogging	1 System Network Configuration Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\BtDDIFUEHLCR\7z.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\Gme.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\GmeApi.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\GmeApi64.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\HackPatch.dll	4%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\Hamster.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\HipsLogCenter.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\HotfixCommon.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\HotfixCommon64.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\ImAVEng.dll	3%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\LeakFixHelper.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\LeakFixHelper64.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\LiveUpd360.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\MiniUI.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\NetDefender.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\NetDiagDll.dll	3%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\NetSpeed.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\Netgm.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\NetmLogin.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\NetmTray.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\NetmTray64.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\NetmonEP.dll	3%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\NotifyDown.dll	3%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\Ntvbld64.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\PDown.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\PopSoftEng.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\QseCore.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\fhjyy.exe	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\filemgr.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\fixsc.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\fixsc64.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\heavygate.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\hipslog.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\iNetSafe.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\iNetSafe64.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\ieplus.dll	3%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\ieplus64.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\imhelper.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\ipcservice.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\jpnative32.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\jpnative64.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\leakrepair.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\libcurrant.dll	3%	ReversingLabs	Win32.Malware.MintZard
C:\Program Files (x86)\BtDDIFUEHLCR\libgravity.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\libscent35.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\libzdtp.dll	4%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\libzdtp64.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\lockkrnl.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\mobileflux.dll	3%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\netmstart.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\np360SoftMgr.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\npaxlogin.dll	2%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\ntvbld.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\pluginmgr.dll	2%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\probe.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\qroscfg.dll	3%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\qutmipc.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\qutmload.dll	0%	ReversingLabs
C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://bizhi.hfnuola.com/pc/v/AfterLocalSethttps://bizhi.hfnuola.com/pc/DesktopComponent/GetPopupLi	0%	Avira URL Cloud	safe
http://www.winimage.com/zLibDll1.2.3	0%	Avira URL Cloud	safe
https://www.hfnuola.com	0%	Avira URL Cloud	safe
http://klog.kuwo.cn/music.ylhttp://install-log.kuwo.cn/music.ylhttp://log.kuwo.cn/music.ylrwSend	0%	Avira URL Cloud	safe
http://www.ludashi.com0	0%	Avira URL Cloud	safe
http://updatestats.cd4o.com/api.php?act=update	0%	Avira URL Cloud	safe
http://www.kuwo.cn0	0%	Avira URL Cloud	safe
https://bizhi.hfnuola.com/pc/v/AfterLocalSet	0%	Avira URL Cloud	safe
https://bizhi.hfnuola.com/pc/v/FilterPayWallpaper	0%	Avira URL Cloud	safe
http://install-log.kuwo.cn/music.yl	0%	Avira URL Cloud	safe
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	0%	Avira URL Cloud	safe
http://www.super-ec.cn	0%	Avira URL Cloud	safe
https://bizhi.hfnuola.com/pc/desktopSubject	0%	Avira URL Cloud	safe
https://bizhi.hfnuola.com/pc/agg/StartUp	0%	Avira URL Cloud	safe
https://bizhi.hfnuola.com/pc/LockWallpaper/Wallpaper	0%	Avira URL Cloud	safe
https://bizhi.hfnuola.com/pc/fhbzApi/checkFile	0%	Avira URL Cloud	safe
http://klog.kuwo.cn/music.yl	0%	Avira URL Cloud	safe
https://www.itrus.com.cn0	0%	Avira URL Cloud	safe
https://bizhiweb.hfnuola.com/web/advertising.html?type=	0%	Avira URL Cloud	safe
http://forums.iobit.com/showthread.php?t=16792	0%	Avira URL Cloud	safe
http://www.bsplayer.com	0%	Avira URL Cloud	safe
https://logs.hfnuola.com	0%	Avira URL Cloud	safe
https://idea.hfnuola.com20012rgbautoStartauto_start_slienthideDesktopIconpauseVidoset_mute_on_fullsc	0%	Avira URL Cloud	safe
https://bizhiweb.hfnuola.com/web/vip.htmlhttps://bizhiweb.hfnuola.com/web/payNew.html%s?channel=%s&p	0%	Avira URL Cloud	safe
http://stats.iotransfer.net/active.php	0%	Avira URL Cloud	safe
https://bizhi.hfnuola.com/pc/agg/hour	0%	Avira URL Cloud	safe
https://bizhi.hfnuola.com/pc/LockWallpaper/Gethttps://bizhi.hfnuola.com/pc/LockWallpaper/Wallpaperht	0%	Avira URL Cloud	safe
https://www.hfnuola.com/select	0%	Avira URL Cloud	safe
https://idea.hfnuola.com	0%	Avira URL Cloud	safe
https://bizhi.hfnuola.com/pc/v/wallpaperInfoMulti	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.iobit.com/appgoto.php?to=download	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false		high
http://www.vmware.com/0	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bizhi.hfnuola.com/pc/v/AfterLocalSet	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
http://www.kuwo.cn0	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000046D4000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004378000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iobit.com/goto.php?id=plusgp01_DB	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bizhi.hfnuola.com/pc/v/FilterPayWallpaper	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
http://updatestats.cd4o.com/api.php?act=update	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iobit.com/appgoto.php?to=activateweb-%d	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.hfnuola.com	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
http://crl.sectigo.com/COMODOTimeStampingCA_2.crl0r	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp	false		high
http://stats.iobit.com/register.php	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.indyproject.org/	Bor32-update-flase.exe, 00000012.00000002.2130974363.0000000000BBD000.00000020.00000001.01000000.0000001F.sdmp	false		high
http://www.iobit.com/faq.php?product=db	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.ludashi.com0	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iobit.com/appgoto.php?to=vertoold	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ascstats.iobit.com/active.php	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://update.iobit.com/infofiles/db2/db2_oth.upt	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://klog.kuwo.cn/music.ylhttp://install-log.kuwo.cn/music.ylhttp://log.kuwo.cn/music.ylrwSend	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iobit.com/appgoto.php?to=feature	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://curl.haxx.se/V	e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2138125089.000000006B296000.00000008.00000001.01000000.00000021.sdmp	false		high
http://www.iobit.com/cloud/db/index.php	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://collect.installeranalytics.com	Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005246000.00000004.00001000.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmp	false		high
http://www.iobit.com/appgoto.php?to=bannerbuy	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iobit.com/appgoto.php?to=index	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bizhi.hfnuola.com/pc/v/AfterLocalSethttps://bizhi.hfnuola.com/pc/DesktopComponent/GetPopupLi	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
http://www.iobit.com/appgoto.php?to=lostcode	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iobit.com/appgoto.php?to=proupdate	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false		high
http://ascstats.iobit.com/moreuse.php	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://idb.iobit.com/check.php	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://install-log.kuwo.cn/music.yl	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winimage.com/zLibDll1.2.3	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
https://s1.driverboosterscan.com/worker.php	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iobit.com/goto.php?id=plusgp01_DBU	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iobit.com/appgoto.php?to=compare	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iobit.com/hotquestions-db.php	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iobit.com/driver-booster-pro.php	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iobit.com/appgoto.php?to=regovermax	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iobit.com/appgoto.php?to=usermanual	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.yahoo.com	Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	false		high
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.super-ec.cn	Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://stats.iobit.com/active_month.php	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.symauth.com/cps0(	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://collect.installeranalytics.comhttp://collect.installeranalytics.comhttps://installeranalytic	Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005246000.00000004.00001000.00020000.00000000.sdmp, Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iobit.com/lostcode.php	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ascstats.iobit.com/other/db_temp_download.php	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.rfc-editor.org/rfc/bcp/bcp47.txt	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp	false		high
http://update.iobit.com/infofiles/db2/Freeware-db.upt	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.symauth.com/rpa00	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://forums.iobit.com/showthread.php?t=16792	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iobit.com/appgoto.php?to=install	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.zlib.net/D	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042962146.0000000003BC5000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000005051000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.0000000003A11000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false		high
https://bizhi.hfnuola.com/pc/desktopSubject	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
http://www.info-zip.org/	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042962146.0000000003BC5000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2042672563.00000000039C0000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004FBD000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bizhi.hfnuola.com/pc/agg/StartUp	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/iobitsoft	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bizhi.hfnuola.com/pc/fhbzApi/checkFile	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
https://bizhiweb.hfnuola.com/web/advertising.html?type=	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
https://www.advancedinstaller.com	Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	false		high
http://www.iobit.com/goto.php?id=dbsurvey	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bizhi.hfnuola.com/pc/LockWallpaper/Wallpaper	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
http://klog.kuwo.cn/music.yl	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.itrus.com.cn0	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.360.cn	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.bsplayer.com	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://logs.hfnuola.com	OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
https://idea.hfnuola.com20012rgbautoStartauto_start_slienthideDesktopIconpauseVidoset_mute_on_fullsc	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
http://www.cd4o.com/drivers/	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	Installer eSPT Masa PPh versi 2.0#U007e26022009.exe, 00000000.00000003.1674730579.0000000005313000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false		high
http://www.iobit.com/appgoto.php?to=othupdate	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iobit.com/appgoto.php?to=feedback	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bizhiweb.hfnuola.com/web/vip.htmlhttps://bizhiweb.hfnuola.com/web/payNew.html%s?channel=%s&p	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
http://stats.iotransfer.net/active.php	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.iobit.com/appgoto.php?to=helptranslate	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.hfnuola.com/select	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.sysinternals.com	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bizhi.hfnuola.com/pc/agg/hour	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
http://www.iobit.com/appgoto.php?to=forum	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bizhi.hfnuola.com/pc/LockWallpaper/Gethttps://bizhi.hfnuola.com/pc/LockWallpaper/Wallpaperht	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
http://ascstats.iobit.com/usage.php	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2021130019.000000000324C000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	Bor32-update-flase.exe, 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false		high
http://www.iobit.com/productfeedback.php?product=driver-booster	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://idea.hfnuola.com	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
http://www.iobit.com/appgoto.php?to=filerupt	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000046D4000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000041D9000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.000000000416D000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.00000000049B1000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004378000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000046AB000.00000004.00001000.00020000.00000000.sdmp	false		high
http://update.iobit.com/infofiles/db2/db2_free.upt	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0B	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000004D8E000.00000004.00001000.00020000.00000000.sdmp	false		high
https://installeranalytics.com	Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	false		high
http://update.iobit.com/infofiles/db2/db2_pro.upt	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.iobit.com/	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
https://bizhi.hfnuola.com/pc/v/wallpaperInfoMulti	Bor32-update-flase.exe, 00000012.00000002.2134669600.0000000002B23000.00000040.00001000.00020000.00000000.sdmp, OTGContainer.exe.18.dr	false	Avira URL Cloud: safe	unknown
http://www.google.com	Installer eSPT Masa PPh versi 2.0#U007e26022009.exe	false		high
http://www.iobit.com/appgoto.php?to=revokedkey	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high
http://curl.haxx.se/docs/copyright.htmlDVarFileInfo$	e8a0d5af432b7e64DBD.exe, 0000000B.00000003.2061165544.00000000042C0000.00000004.00001000.00020000.00000000.sdmp, Bor32-update-flase.exe, 00000012.00000002.2138125089.000000006B296000.00000008.00000001.01000000.00000021.sdmp	false		high
http://www.iobit.com/goto.php?id=likefb01_DB	e8a0d5af432b7e64DBD.exe, 00000009.00000003.2045986235.0000000003D00000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
154.82.113.139	unknown	Seychelles		32708	ROOTNETWORKSUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581812
Start date and time:	2024-12-29 01:59:19 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 14m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Installer eSPT Masa PPh versi 2.0#U007e26022009.exe renamed because original name is a hash value
Original Sample Name:	Installer eSPT Masa PPh versi 2.0~26022009.exe
Detection:	MAL
Classification:	mal84.rans.troj.spyw.evad.winEXE@23/435@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 65% Number of executed functions: 98 Number of non-executed functions: 166
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.16.168.102, 2.16.168.117, 4.245.163.56, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-b-net.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:00:12	API Interceptor	1x Sleep call for process: Installer eSPT Masa PPh versi 2.0#U007e26022009.exe modified
20:00:52	API Interceptor	1x Sleep call for process: Bor32-update-flase.exe modified
20:00:54	API Interceptor	513947x Sleep call for process: Haloonoroff.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	SharcHack.exe	Get hash	malicious	Ades Stealer, BlackGuard, NitroStealer, VEGA Stealer, Xmrig	Browse	199.232.214.172
	3KFFG52TBI.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	a2mNMrPxow.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	tzA45NGAW4.lnk	Get hash	malicious	Unknown	Browse	199.232.210.172
	sYPORwmgwQ.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	New Upd v1.1.0.exe	Get hash	malicious	LummaC	Browse	199.232.214.172
	JA7cOAGHym.exe	Get hash	malicious	Vidar	Browse	199.232.214.172
	wp.bat	Get hash	malicious	Unknown	Browse	199.232.210.172
	final.exe	Get hash	malicious	Meterpreter	Browse	199.232.214.172
	n5Szx8qsFB.lnk	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ROOTNETWORKSUS	MicrosoftEdgeUpdateSetup.exe	Get hash	malicious	Unknown	Browse	154.82.68.34
	nshkarm5.elf	Get hash	malicious	Mirai	Browse	154.94.148.181
	x86.elf	Get hash	malicious	Unknown	Browse	154.82.151.143
	bot.x86.elf	Get hash	malicious	Mirai	Browse	38.145.246.125
	nsharm7.elf	Get hash	malicious	Mirai	Browse	156.236.225.1
	akcqrfutuo.elf	Get hash	malicious	Unknown	Browse	154.94.130.206
	jmhgeojeri.elf	Get hash	malicious	Unknown	Browse	154.82.254.162
	maybecreatebesthingswithgreatnicewhichgivenbreakingthingstobe.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	154.82.100.177
	nabx86.elf	Get hash	malicious	Unknown	Browse	154.82.157.214
	iwir64.elf	Get hash	malicious	Mirai	Browse	154.82.103.244

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Program Files (x86)\BtDDIFUEHLCR\7z.dll	ZwmyzMxFKL.exe	Get hash	malicious	BlackMoon	Browse
C:\Program Files (x86)\BtDDIFUEHLCR\7z.dll	ZwmyzMxFKL.exe	Get hash	malicious	BlackMoon	Browse

Created / dropped Files

C:\Config.Msi\5a2ae3.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	224977
Entropy (8bit):	6.7523363977510655
Encrypted:	false
SSDEEP:	3072:hQCR8JziAnrQnzMYywmn3h1sp7/WvCnIukR4BbxKigu/fgl1glfdjgBftJeCEEzK:9RuTQnzXtr7tbxKVuE1gQJeCEMx4T
MD5:	A357DD2A8550821786A607B95E4C5C51
SHA1:	E6C56182799AF5C0BF96C7C7F8174959D1F76674
SHA-256:	379D83EC7D029465B61AB5BC944BEB3B554D960A77F1B7F269AAA98B022D8B3F
SHA-512:	01271B6363025CF38527D98E98382678AE6C4E71B2B8A16871A88FEBE6FFE6699318795313E6ADC6E86561DE789316BB57CE180EC5E9C3D4C9F231E6CD68B746
Malicious:	false
Preview:	...@IXOS.@.....@...Y.@.....@.....@.....@.....@.....@......&.{AF084EDE-DB6F-45F9-8AB2-9750C7AF5081}..Windows..DAN_127.msi.@.....@.....@.....@........&.{FF04FCEE-D135-4246-945D-4A9D97099E64}.....@.....@.....@.....@.......@.....@.....@.......@......Windows......Rollback..ck(W.V.n.d\O:.....RollbackCleanup..ck(W Rd..Y.N.e.N...e.N:. .[.1.].....ProcessComponents..ck(W.f.e.~.N.l.Qh...&.{0BDD925F-9555-4E0F-A320-9E414AC18B7C}&.{AF084EDE-DB6F-45F9-8AB2-9750C7AF5081}.@......&.{FEAD2C16-C7B0-493E-B979-1B01A169ADEA}&.{AF084EDE-DB6F-45F9-8AB2-9750C7AF5081}.@......&.{EC42FCB1-8AAF-4702-9E48-B83254BD3FB0}&.{AF084EDE-DB6F-45F9-8AB2-9750C7AF5081}.@......&.{BDAF5FA3-1BA6-42D1-894D-41DA643F7A2B}&.{AF084EDE-DB6F-45F9-8AB2-9750C7AF5081}.@......&.{25BC8264-C934-445D-B75A-54A198CB23F0}&.{AF084EDE-DB6F-45F9-8AB2-9750C7AF5081}.@......&.{546DDB96-6B8B-4364-8020-B0224286327F}&.{AF084EDE-DB6F-45F9-8AB2-9750C7AF5081}.@......&.{F6C9FDFB-FE64-4F40-A063-A4A1D40934C4}&.{AF084EDE-DB6F-45F9-8AB2-9750C7AF5081}.@......&.{B8

C:\Program Files (x86)\BtDDIFUEHLCR\7z.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1390312
Entropy (8bit):	6.599443687044708
Encrypted:	false
SSDEEP:	24576:w4wwwwscgymwef8Z8Zzj6z1el68mUi1m/ONxdDDHNCU+3kvaBW7839l5Qafgb6L1:pwwwwscgymwefyEQ/U6/NnDDHNCTeaBf
MD5:	292575B19C7E7DB6F1DBC8E4D6FDFEDB
SHA1:	7DBCD6D0483ADB804ADE8B2D23748A3E69197A5B
SHA-256:	9036B502B65379D0FE2C3204D6954E2BB322427EDEEFAB85ECF8E98019CBC590
SHA-512:	D4AF90688D412BD497B8885E154EE428AF66119D62FAF73D90ADFFC3EEF086CF3A25B0380EC6FDC8A3D2F7C7048050EF57FCEA33229A615C5DCDA8B7022FA237
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ZwmyzMxFKL.exe, Detection: malicious, Browse Filename: ZwmyzMxFKL.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0...0...0...9a.=...9c.I...9b.(...b......b.. ...b..&...9...1...9...7...0........4................1....o.1.....1...Rich0...........PE..L....x.c...........!.........~......x7...............................................~....@.........................P...\|......P....p.................P,..........0...............................P...@............................................text............................... ..`.rdata..............................@..@.data...0........4..................@....rsrc.......p......................@..@.reloc...............B..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\Gme.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	400480
Entropy (8bit):	6.6249170967240625
Encrypted:	false
SSDEEP:	12288:ke/EYk6LSMAROeK3nzAPSayAj7+fyJHbVJMs/ubUQ3Q/p:MQ7DAvhpGs/8UQ3QB
MD5:	CC4F1CDFA6A90B6152B8012E8C035DFD
SHA1:	011098BADE1BD47557147B8CF3BAF4A070CB9D7C
SHA-256:	7B9FF465FA54E5EDF69F0794D7CAF7ADC6D7B20534E6DA0181DC93DC062E7CCA
SHA-512:	0084BADEBBAC672904BD7E19019C2D86B4745DEA26229CE82E48E0A5134DF3FA42B4948C673B17432BFE14F13A82B0BAFF3B5D861AA4AB3A951AF40793780CE1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..N>.EN>.EN>.E.qXEM>.EGF[ET>.EGFJE.>.EGFME.>.Ei..E[>.EN>.E.>.EGFDEg>.EGF\EO>.EPlZEO>.EGF_EO>.ERichN>.E................PE..L.....rZ...........!.........*......?#.......................................P......j.....@..........................m.......^..........x................5......H3..0...................................@............................................text............................... ..`.rdata..d...........................@..@.data....q...p...6...Z..............@....rsrc...x...........................@..@.reloc..PM.......N..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\GmeApi.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	427104
Entropy (8bit):	6.602064716561835
Encrypted:	false
SSDEEP:	12288:d54WjgpIW+m/CbqwcAjoZOtjEipBiRuL9JK:avGPJbtjEY2uL7K
MD5:	50B836C0E21FD4EF3F6F6102F9162FEA
SHA1:	704834D4BE32AD186FD761E908CC0518AC2A8117
SHA-256:	8CFC18609E75074EB0FBF3C87C1B41E263DE503083A7EBBB00643E0F05A2920E
SHA-512:	B2C220F954A38B7EBC44FA60454CD8322A21714F1E3D593F32B7C4865113157965E1C8C0821F60F1865270FCB2529EBF8CDD32F1DE44A7626C0D0DB304C72644
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.p...#...#...#..T#...#..W#...#..F#Y..#..A#...#/V.#...#...#...#..H#:..#..P#...#..V#...#..S#...#Rich...#........................PE..L.....rZ...........!.........F.......c....... ............................................@.....................................x....@...............N...5...P..88..."...............................k..@............ ...............................text............................... ..`.rdata..r.... ......................@..@.data...Dm.......6..................@....rsrc........@......................@..@.reloc...Y...P...Z..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\GmeApi64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	572512
Entropy (8bit):	6.263529853370218
Encrypted:	false
SSDEEP:	12288:Azb0JSwmBU/no1rNW23dImf/D/cnlu41T3ork5d:AH0JSwmko1rNW23df/D/cnlhp3d5d
MD5:	984829AFB3ED76FABCAB8AE4BE1FF15C
SHA1:	2498F20AB62E3061FB144C7CEAE5CF254D6C7095
SHA-256:	F257E86E42D7546C37AEABDC7BF1D00BC09E7B26D9AF4478302FF2B872187C33
SHA-512:	5270AE482E8C462B5360DD60C06D8757BE5F7E513A0A7BF993F3F088A67516AAA0A744CDBD034828D3AAF5E6EADAF630317ACF325B03E028398C7EAC12A97B04
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........BG@.....pC.....pR.....pU.L...........f...p\.....pD.....ZB.....pG....Rich...................PE..d.....rZ.........." .....F...:......,T...............................................V....@.....................................................x............p..Tf.......5..........pe...............................................`..X............................text....E.......F.................. ..`.rdata..Tx...`...z...J..............@..@.data............@..................@....pdata..Tf...p...h..................@..@.rsrc................l..............@..@.reloc...............r..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\HackPatch.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	572312
Entropy (8bit):	6.6114481461607175
Encrypted:	false
SSDEEP:	6144:KmuYzDRB54CwW2U0lY4woeFuA0TpxVQ8Y3Ew+zBsPO3erF7q0zoCiJbDjdxzF5og:Ju+469PqNYsBsPTziDjLbCEGne9Z
MD5:	5CC95EA39AB6D7751A1A85F832CCA011
SHA1:	387B60FE4F257BA8A0F5DA566709640F972EAA3B
SHA-256:	4BF5DD0ED84D6C7B4965628A22668F733C167427B20A4B56AE356205381B527F
SHA-512:	6E28E6D3D1A6BF4FB046A7F03F68FE27F8A7151465412EA4126AD3DD2A9DC9C89238923E858C644892D72D318CF2112C4AE60DAE363CC5EC41DEF1663BFDD101
Malicious:	false
Yara Hits:	Rule: Mimikatz_Gen_Strings, Description: Detects Mimikatz by using some special strings, Source: C:\Program Files (x86)\BtDDIFUEHLCR\HackPatch.dll, Author: Florian Roth Rule: Mimikatz_Strings, Description: Detects Mimikatz strings, Source: C:\Program Files (x86)\BtDDIFUEHLCR\HackPatch.dll, Author: Florian Roth
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^.^.?g..?g..?g.=Nf..?g..ac..?g..ad..?g..Yb..?g..Vf..?g.=Nb..?g.<Nb..?g..G...?g..Ya..?g......?g.!ab..?g.!ac..?g.>ac..?g.>ab..?g..ab..?g..Yc..?g.....?g.....?g.H0:..?g..Yf..?g..?f.5=g.!an..?g.!ag..?g.!a...?g..?...?g.!ae..?g.Rich.?g.........................PE..L....Enc...........!.....,...\|...............@............................................@.........................`p.......q.......0...r...........r...I......dK......p...............................@............@...............................text....*.......,.................. ..`.rdata...T...@...V...0..............@..@.data...D_.......$..................@....gfids..............................@..@.tls................................@...PlugImm...... ......................@....rsrc....r...0...t..................@..@.reloc..dK.......L...$..............@..B................................................

C:\Program Files (x86)\BtDDIFUEHLCR\Hamster.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	249768
Entropy (8bit):	6.601810977306283
Encrypted:	false
SSDEEP:	3072:/0jvJ1SDHfvcFHDSU4/eebh4HT4dK62HPWA2F0T7z/LDdUjE2rRNq5N5EuXCRfC:/0jTSrMtceebhz32HPWnoBUw2/G5r
MD5:	2EA3ACA1D36D16F0699261F77EE6ECCE
SHA1:	31C6575F5EC4F48ED3939FD5484F4E3D5869D3DA
SHA-256:	12B2AAA9C7222B13E97A0870006CFC498134F7182009C49FAD0281A85D5CD386
SHA-512:	30057B3491807413603C5A4668D020A384548CE6F41BA9DE6C708C4BF052BE10113AE5AAF41697ACC2AB56E9674EE8DC4669584FA9F838A9359842038F82394E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;...U..U..U.....U....9.U......U.*...U..T.'.U.....U.....U.....U.....U.Rich..U.........................PE..L..._wWX...........!................................................................,.....@..........................M..R....B..d.......l................5......8...`...............................@...@............................................text...o........................... ..`.rdata.."~..........................@..@.data....H...P...,...6..............@....rsrc...l............b..............@..@.reloc...,...........j..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\HipsLogCenter.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	555240
Entropy (8bit):	6.523642703236138
Encrypted:	false
SSDEEP:	12288:RzJibra10t6DBAAxFhNngOsLOsZDvnCjN8d6HVilI5hKRPnQ0FbgB4e:CbzipngOsLOsZL38IKb4PQ0Fbje
MD5:	4B481EA28EC7B065AD6C7FE7674AA363
SHA1:	152FC3DA4A1DF717623E4D57476A1D72ADD7F610
SHA-256:	92AA7045E70E2BBB706DCD1A1D9B41026CFA06FEDF0E48EE0CAE63B8B80084F5
SHA-512:	08F8388322D3623F8DBC23DB60E0542B972754FEAB4071C0FC7382F9EBD54313A8A10E5EBAC9D72E5F4909B23A2FCB4114B44BCF47F3090B029DDEA27CFF21B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\O..=!..=!..=!..E...=!.Kr...=!..E...=!..o...=!..E..b=!..E...=!..= .<!..E..=!..E...=!..o...=!..E...=!.Rich.=!.........PE..L......d...........!.........V...........................................................@.............................w............................L..P,...`..4C..................................8v..@............................................text............................... ..`.rdata..............................@..@.data...\........j..................@....rsrc................@..............@..@.reloc...Z...`...\..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\HotfixCommon.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180800
Entropy (8bit):	6.720835675786583
Encrypted:	false
SSDEEP:	3072:zQPGqss58Kg5dqBLQ8/90/qTQPOfb7+sH1buHv/c6R2Wmjgk4Kq2iSiTHa89B:zQPB4jqBLQ86qsPOf+8RuHXc6tmv4KqZ
MD5:	91D9E316BD0533C92BDE234131EC7AB4
SHA1:	86D1997382E3FE81AC27B88EFE33E1773D095518
SHA-256:	62BAAD0A128B580889091F015384410BD491F21BB101682557B034ACB28E00D9
SHA-512:	BDD41A900EB1299815CA24FD78EE5499F20C78C5E62CAF11934A5348836C557AB402DF1D75B4932AA6E322562C8CDEBB120FC74137ED9D693AE6719C44C5718F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$.......N .'.A.t.A.t.A.t..zt.A.tX).u.A.tX).u.A.to'.u.A.t.(.u.A.t./.u.A.t.9(t.A.t.,.u.A.t.,.u.A.tK&.u.A.tK&.u.A.t.(.u.A.t.(.u.A.to'.u.A.to'.u.A.to'.u.A.t.A.t.@.tX).u.A.t.,.u.A.t.(.u.A.t.(.u.A.t.(.u.A.t.(Bt.A.t.At.A.t.(.u.A.tRich.A.t........................PE..L....@W^...........!................................................................i....@.........................p'......x(..x........................7..........@...p...............................@...............8...x#..`....................text............................... ..`.rdata..tD.......F..................@..@.data...h....@......."..............@....detourcX6...`...8.................@..@.detourd$............b..............@....rsrc................d..............@..@.reloc...............j..............@..B................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\HotfixCommon64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	219200
Entropy (8bit):	6.255426513524174
Encrypted:	false
SSDEEP:	3072:n7pWDP71+xRSkTt9XFD6RAtofSUAfohtDanx51K6flyT9S9:1WDP71+xR7h9XFBtofStomfK69e9S9
MD5:	C64D91E0734622D550F578CAC023FE9B
SHA1:	9B5F47305F02ED862BE6A8E6F6D48647F9311E84
SHA-256:	9AA97B67D074D85CAFB29A0A561DFAA2416A283FC8A228B6904D63D16C8C463B
SHA-512:	FD419DE7FBC7C0B9F33CD340E2DEF67849DF628799FC0507DFEB6F77DD8681232B81216D082155278EC7D158E99FB480EEAC884A8962F410321F91A89D500CBD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........-...L.E.L.E.L.Er.^E.L.E.$.D.L.E.$.D.L.E..D.L.Et%.D.L.Ev".D.L.E.!.D.L.E.!.D.L.E.+.D.L.E.+.D.L.Ev%.D.L.Ev%.D.L.E..D.L.E..D.L.E..D.L.E.L.ERM.E.$.D.L.E&!.D.L.Ew%.D.L.Ew%.D.L.Ew%.D.L.Ew%fE.L.E.L.E.L.Ew%.D.L.ERich.L.E........PE..d....AW^.........." .........$...... .....................................................`.........................................0.......8...x....`............... ...7...p..T...PO..p....................O..(....'............... ......0}..`....................text...0........................... ..`.rdata...q... ...r..................@..@.data................x..............@....pdata..............................@..@.detourc.h.......j..................@..@.detourd@....P......................@....rsrc........`......................@..@.reloc..T....p......................@..B................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\ImAVEng.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175728
Entropy (8bit):	6.544553321577818
Encrypted:	false
SSDEEP:	3072:ix5UgqxBe84iqhlPyKc4pquYWWM1qOrlhPzc8ylmyK5WodzzDi:i4pgbzTYWRZHrc9lNQzq
MD5:	B8FDC03B9B84A62C5C541524DCA2E723
SHA1:	5643ADAE63CA199F9C44A35F3B30947A0F8B6D21
SHA-256:	1F6F3DADCC4C3096EEBFB5CE5DB979755ABA5CEB9DB18E6CA6238F05B45E5F4D
SHA-512:	A31708C251967D484F242BE658E92E94D87671294CD2C959276EC3B739D46F3FC7D1140CC8F78640DBD9970EC2176633E67DD079A3182ACDCE0FA8A7DE366637
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}.G...G...G...N..U...N..=...N..~...`a~.F...`ah.L...G......N..R...N..F...Y...F...N..F...RichG...................PE..L...2..T...........!................q.....................................................@.........................@`..U...pT..x...................................p................................>..@............................................text............................... ..`.rdata...`.......b..................@..@.data...@7...p.......N..............@....rsrc................h..............@..@.reloc...'.......(...n..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\LeakFixHelper.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	313952
Entropy (8bit):	4.32348576044483
Encrypted:	false
SSDEEP:	3072:7cxIVD6kUS+hV/EENZH3JzJPlZ4k5O0f+BC9vCfFL:ooehV/pJzJPHM
MD5:	A88A6FFF171F7FECF8668DA1EFC843DF
SHA1:	E4C8B375BBECF5790B2B0444B049CCE11659D598
SHA-256:	34CCCEC093F5711D1202F54BFE8756E093E4F84099EC7D609AB9658C3C941921
SHA-512:	808F6E217F5E157663E66B46429636C4D811ACA7C5672EDD1B003377BB4A039265B4FB905B4ADE39D81B3E64E7793BE8278454155E8BD2EE92FB5B6F919563EE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................l.......z.....h...............}.......s.......k.......m.......h.....Rich....................PE..L.....4Y...........!................e ..............................................'H....@.........................`...K.......<........................5..............................................@...............\|............................text...M........................... ..`.rdata...N.......P..................@..@.data...........j..................@....rsrc................`..............@..@.reloc...*.......,...f..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\LeakFixHelper64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	362400
Entropy (8bit):	4.208790369342181
Encrypted:	false
SSDEEP:	3072:ZGlYJdSi2t2SwbVGMuyic94uxJmXs/wIb8n9ssWy5cdJEnpOwD7A51B8BLRPrB:0lYXSi2ttqWc/PYOy5cQnpOS51
MD5:	3D01B2B5288974E922B6417FD3B02373
SHA1:	5649D3E7E15D1BF707CD7C28FE9931E5620EE9ED
SHA-256:	B438EF547753F91577730FFE9321563E7DD4ABBCBF056ADEE3C49906FC1EABD4
SHA-512:	F0C0EEBA22F33A4C596FF1272D681E7A349AB60112FD0AF5C75E07F065F35525C332270DE0ECC171D0B4BF53C3BC79C4E40BAD0EF1A0418A2D5DE882765D2FEC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|.\|\../\../\../Uef/(../Uep/V../{./Q../\../.../Uea/i../Ueo/W../Uew/]../BOq/]../Uet/]../Rich\../........PE..d.....4Y.........." .........F......lz...............................................f....@.........................................pm..M....b..<............p..\|....F...A.............................................................. ............................text...L........................... ..`.rdata...].......^..................@..@.data........p.......\..............@....pdata..\|....p.......&..............@..@.rsrc................2..............@..@.reloc...............8..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\LiveUpd360.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	647184
Entropy (8bit):	6.591959886632138
Encrypted:	false
SSDEEP:	12288:I/8iKgqct1l8h5H/30CrYXUjniBZoStkf0EOl/mvxxXiINkYF69+:NbhV0gMYnigStkMEMSxXrmYF69+
MD5:	960B05116F13AE8E8B17A6BA2919BF2D
SHA1:	D1A58D1F65272198D0A6657B06FAE6D27F1E156C
SHA-256:	00354506D4F1DD6A1FDF9450CA4A8E799A5A420A1A47BA3E41D7B30D8D02440A
SHA-512:	7A05E3178ABB8F92AA3A61F8A3156C87BD46F03F12D8EFC6CC1FEEE36B2508816E761BF6A3385BBDA2DD16EA3AB9CB4A5B899C3D844257811F0B3D9C4464713B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............`..`..`....`.i/]..`...^..`...H.%`...B..`....`..`..`...O..`...Y..`..2_..`..`\..`...Z..`.Rich.`.................PE..L.....b...........!.........................................................@............@.................................(...........................xC.......N.. ...............................X...@............................................text.............................. ..`.rdata..C?.......@..................@..@.data...8........2..................@....rsrc..............................@..@.reloc..<d.......f...4..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\MiniUI.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	921160
Entropy (8bit):	6.7626587126151065
Encrypted:	false
SSDEEP:	24576:nJtdTUbI0Ig/fMiK6hRN/IgOoWtT9nQnap:nJjUbIU/fPHhrIgBWtTFQnap
MD5:	5123C3B8ADEB6192D5A6B9DC50C867B1
SHA1:	6D142074A21AA50C240CE57CA19A61E104BBDF41
SHA-256:	273CE954C8D33ABAAC3A0FD8546719F09718C1D91317ECF5B99181DFFA3FE26A
SHA-512:	067305A8F09C480FE4A4C8609638C9A490C4EBE2782BD13C10B380DF14F76D4748EB785F44E7BCB86514718F99D07C3C6A4B43928A294B18020CB0FA589EE2A0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S...2...2...2..f}M..2...JN..2...JR..2.......2.......2...2..3...`_..2...J_.y2...JX.%2...JI..2...`O..2...JJ..2..Rich.2..........PE..L...h..Z...........!......... ......Q........................................ .......G....@..............................................................7...P..$....................................'..@.......................@....................text............................... ..`.rdata...].......^..................@..@.data...X.... ...X..................@....rsrc................j..............@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\NetDefender.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	451480
Entropy (8bit):	6.641728581015286
Encrypted:	false
SSDEEP:	12288:c2qfhIic6ZYk/UxdGhZi1MVv2MIbvweYsoOzpgseJUnv9it:c2qfGhz/qgodsoRenv9it
MD5:	2C63554380D33E2AB153CB285E72C2F8
SHA1:	1EDE14CA4003AE639AA80E2F4E90558DD1A49A7A
SHA-256:	F77F9AFB3459F2D2C8FB0354317A0353ACBBF6D31988597775ADCD9AB0D80BA1
SHA-512:	96F951089D907F635AF5A517AAF53FD13064ECA471DC4440B8C67147A91F11043043F102814C2E6DE8933F81F30D6AFFFCC073BF98670A8D52A5518AD89646B7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........`.q.3.q.3.q.3B>.3.q.3...3.q.3...3kq.3..3.q.3..3.q.3.q~3.q.3...3.q.3...3.q.3...3.q.3.#.3.q.3...3.q.3Rich.q.3................PE..L....tc...........!.................}..............................................D.....@..............................................................I.......7.. ...................................@............................................text.............................. ..`.rdata..o^.......`..................@..@.data....w.......2..................@....rsrc................*..............@..@.reloc...Y.......Z...>..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\NetDiagDll.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	337736
Entropy (8bit):	6.495942481063909
Encrypted:	false
SSDEEP:	6144:g1wCwn8QI2fm53Nx4Lj23TIae3m7jwyhb/7hjW7iBH+ljFx5mcvbKr:gmnckm5dy63TRe3XyhbNjWep+ljFx5R
MD5:	22C3095414CE54C8405225E3BCAAE591
SHA1:	9F0515A564B5077F49AACE011E84AF51F9973F32
SHA-256:	B734DB11E973318D728FE92E112639AE5B8876C855E6507315C707D04D3E0746
SHA-512:	2BE22658A038F8061B398489C357EFBA0F920FA24655A53650593D4924EE565E445D3A7CFD2C9689BC3A79E8355157004640E49B0249FCA63B3EBE11726D42A8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T...T...T....{.V...].x.M...].n.....].i.....T......s;..O...].g.G...]...U...J.y.U...].\|.U...RichT...........................PE..L....fgS...........!.........(......~........................................`...........@.............................U...l....................................,..`................................S..@............................................text............................... ..`.rdata..............................@..@.data...8Z.......0..................@....rsrc...............................@..@.reloc...A.......B..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\NetSpeed.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499432
Entropy (8bit):	6.633998530829339
Encrypted:	false
SSDEEP:	6144:2gz1k3fKRVIpJcADwPkUeKvd8C/RxC4MwYXlHUCMJ/TBJnt8KZ0Se+4xichK4:tMfKRGJc1tnPC4MwYXVl4/Trt8K61s2
MD5:	049791828DE05D24D29EC9C8687F8B1A
SHA1:	2B6D787EB078DFAE0C6718A9D99D06CEB01FB273
SHA-256:	D418DDA34640521B8695642C7A7E719F173F706472617CFF4ED343FB68211862
SHA-512:	7E36019A163F55932F95D33FACB216B69244DC8D5506CFD1D2E707A736AF448D7A4F78ABEAF85CF0F42E4E18B7EB1D330A9788F73773E6BE23A61C6B2981136F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............a...a...a.......a.......a.......a......a.......a.......a...`.D.a.......a.......a.......a.......a.Rich..a.........PE..L......c...........!................................................................\|.....@.............................a............p...............r..P,......@F.................................(q..@...............`............................text...E........................... ..`.rdata...G.......H..................@..@.data...Xp.......,..................@....rsrc........p......................@..@.reloc..\|d.......f..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\Netgm.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	343784
Entropy (8bit):	6.490658338748216
Encrypted:	false
SSDEEP:	6144:rFp+cWO/EibdFr0Zv7U7bAb1qi8JU0Wexe/1Yd02Y+VZRg43r:rFMcWO/Eib3r8jU7Q1qi860WexexEGe
MD5:	6E5F6B4D49768E131EF614DD07E5EFA5
SHA1:	DBA90982727A9373C8D97E72500D89814184C7B6
SHA-256:	EE326C156144EB89DE76C21C66BDA10BD22922B1A9C85615CACEE84DF355604C
SHA-512:	12FF45D6F469B577E74A62B866DAE2A879751654A6627250286E3CC4F319411FE901155347DA762010F373BBEB46F2BD95E0428893242EE4707BEFA7312CF92D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............o..o..o... ..o.....o.....%o..=..o......o....o....o..o.._o.....o.....o..=..o.....o..Rich.o..........PE..L....P.d...........!.........d...............................................p....... ....@..........................Q.."....@...........Y..............P,... ...*..0...............................x...@............................................text............................... ..`.rdata..2...........................@..@.data...._...`...2...@..............@....rsrc....Y.......Z...r..............@..@.reloc...C... ...D..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\NetmLogin.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	533600
Entropy (8bit):	6.567835943059589
Encrypted:	false
SSDEEP:	12288:OgmCH8ZkhmmpKJiv/Dn5EWomaMIhEKf3Io7fknS52:Og58GnOthL/I1nW2
MD5:	5D7B815A95164AFB4A8E35240644793D
SHA1:	3AA5BFB8B2EE68C33BEB3190480CBE0149C29A96
SHA-256:	1158A8B493FC607354DD21E5A601760C082C00EB8B69E839E17E4A198C807418
SHA-512:	95E06406294258A3F81446A17E5CF67A02EFCDB0DA257F32ECD5B48D3F00B9BE628E2F82C04856191CDFDE02474ABC62D64D4A200164D7F6149993E548C8A335
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.o.o...o...o......n...f..w...f......f..!...HTz.~...o......f..$...f..n...q...n...f..n...Richo...........................PE..L......Z...........!.....F..........'........`...............................`......v.....@..........................U..P....G...........................5......LJ..@c..................................@............`...............................text...iD.......F.................. ..`.rdata.......`.......J..............@..@.data....r...`...8...B..............@....rsrc................z..............@..@.reloc...k.......l..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\NetmTray.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247016
Entropy (8bit):	6.914297747665078
Encrypted:	false
SSDEEP:	3072:LQvXrZQoI8GHJg9bb9wv/cZD9Da5TUUQJYlCXbKJOZwFSYG0GTO/X3/mCP0V:kFIZgXwvkZqUpJRGOZwFVG0X/mXV
MD5:	5B4C825671418F34D95EC1F7BB55FFA1
SHA1:	C0AA182B281EDB4F06BDC98D7CF413AF948AB50A
SHA-256:	AA51AE325D53D586532145E0C6E702247654502C0349C5FC570D7155353B045A
SHA-512:	BEC6D76883BF786F93BCA0E32A36CF21002D5E1CDC1C098628D9D50D1E8E40B0E44C6AAA07DD8B503ABA5B638D44CBFAAF6C4BFB0E9F6C8F49470D7664432F73
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..#...p...p...p..ap...p..wpv..p..pp6..p/1.p...p...p...p..~p+..p..fp...p..`p...p..ep...pRich...p........PE..L....B.e...........!.................$....................................................@.............................]....i..........x...............P,..........`...............................HM..@............................................text............................... ..`.rdata...q.......r..................@..@.data....N......."...p..............@....menu_sh............................@....rsrc...x...........................@..@.reloc...2.......4...b..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\NetmTray64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	290024
Entropy (8bit):	6.537709606383622
Encrypted:	false
SSDEEP:	6144:AhEzpelia8VSPgFmHKbDNATfCfzWNunIj1EpJRGOZwFVG0SJK:AhSpelaSPXMmLC7W4iOZYG0n
MD5:	0F15D28EB4CCD9DADFEC0305BF5F8E2A
SHA1:	04DE9FA6736978FDEFA031082C58FFCD0169861D
SHA-256:	F06872A9A6A6AFB4FEA670385694EA364F271705FB89B09E4390E95752A98F25
SHA-512:	955B8C3F383C66B4249510A20890C856994F2F4E9FA40C374B472B9E19AC2441A86BE67249F13E1F624AAF2F03D0F6A73F69A0E3D73178F2FC39843382D1041E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5...q..Hq..Hq..Hx..H...Hx..H{..Hx..HN..HVT.Hl..Hq..Hl..Hx..HR..Hx..Hp..Ho..Hp..Hx..Hp..HRichq..H........PE..d...7B.e.........." .....L...........]...............................................L....@.........................................."..]...0....................#...@..P,......P....h...............................................`..@............................text....J.......L.................. ..`.rdata..M....`.......P..............@..@.data....j...0...,..................@....pdata...#.......$...@..............@..@.menu_sh.............d..............@....rsrc................f..............@..@.reloc..L............2..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\NetmonEP.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	160584
Entropy (8bit):	6.648758970829866
Encrypted:	false
SSDEEP:	3072:ABDE5pe7xyshJiszc1TLQXDNxLYeW54C:Aip4ysYTLcXP
MD5:	EFEBB6F93832D5A7EEF3BD4EB81D4A79
SHA1:	9A75E55A08422E7B6A7D695EBB0F61589B31005C
SHA-256:	542928806DE9A653C52250A0AB3D7847EF9249C195C00B82E5BDEB066AE6D2DF
SHA-512:	D9F276F0556539739289585B55482034BDF99F0C18917720F1AB84B870DDA3E303792CD4DF85183155BFFF8DA174EFBE8A74506197B268D632BA6916AF00E521
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>...m...m...m..,m...m..=m...m..+m..m.Y.m...m...m...m.."m...m..:m...m..<m...m..9m...mRich...m........PE..L......S...........!.................`...............................................................................*..V.... ..d....`...............X.......p......................................p...@............................................text...I........................... ..`.rdata..VJ.......L..................@..@.data.... ...0......................@....rsrc........`.......4..............@..@.reloc.......p.......>..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\NotifyDown.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	549488
Entropy (8bit):	6.736896619735914
Encrypted:	false
SSDEEP:	12288:XLgRCEprkKZlVgTndpHpTVWDQZNrHIGUYmHASzK8BnWToS09:7gAEprcnLVADQbzIGHmxK+WTO
MD5:	14274CF241144895CA05CD456197F573
SHA1:	4D4009B0A2F7BA56C6C98DC823C41085EF4712C7
SHA-256:	113562BF950B39E9466E8F646C84AAA93F6B2C89530F56913B0B36E0096239A0
SHA-512:	5A8009D935EB59B10523494C6C9D0A79FD29B0FA41CBA046E9CCC60A8D2EBA05CCC23D881E121A4526371E21B7C9DB6CC62783E1A5ACAD019705970C9F52091E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............y..y..y.....y.x...y.....y..J...y..J....y..x.P.y.......y.......y.....y.....y.....y.Rich.y.................PE..L....u.T...........!.........@............... ......................................j.....@......................... q.......R..T........Q...........L.......`...M...&..................................@............ ...............................text............................... ..`.rdata...R... ...T..................@..@.data....z....... ...^..............@....rsrc....Q.......R...~..............@..@.reloc...x...`...z..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\Ntvbld64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS-DOS executable PE32+ executable (DLL) (native) x86-64, for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	42976
Entropy (8bit):	6.2171815555231875
Encrypted:	false
SSDEEP:	768:iHfqCaczo/ZinYCOd9L9KyhaM7JubDGpZRKjKj9MPgkU7:8fqT/ZWY/L9l7JheMJ
MD5:	671F95CAB2B5CF121125413F250F5275
SHA1:	73D99D09A3D8978A5C6DB43CEC85FB43B03B7A26
SHA-256:	728A1FCDEDCA6DBD8FDDDE3F33CD64DD99853C26EF5B10D3FEF0D76D0480964B
SHA-512:	4AF690AF838CEB026636931AEDE3852EAE6D83881149EF4C28CC1DD032C3F7F6A64B30171C2524512FACD40496DAB305523D20637B44EFBF0D5805D0FAD1FFCB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ!..... ..........e..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ntvbldDXML..$............!.L.!.........`......................................................................Rich....................PE..d.....a.........." .....H...".................p..........................................@.........................................pV.......S..(.......h....p.......h..H?...........................................................................................text....F.......H.................. ..`.data........`.......N..............@...

C:\Program Files (x86)\BtDDIFUEHLCR\PDown.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	253456
Entropy (8bit):	6.554744612110189
Encrypted:	false
SSDEEP:	6144:OpoEWHpLJeJ8MvIucm/334RStKp7Tu975:vEsLJeJ8MvPcm/30u975
MD5:	637FB39583F9C2EC81E0557970CD71AD
SHA1:	ADA1137BB47DF62F48407ACC2DC713D92D13A0E0
SHA-256:	330B8EC664949CB9DE5BCCE5AC248148B58DCFEED69ACD8D9CB576AAA935045E
SHA-512:	F72C77D29C51CC6AC1151C919C769BF063E5BAE763033B9BF5BC713E01416ECB301A120B22A17037310E47662EA916A06AA09BB441DBDEE4032A6D59A0876ECC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........gOT...T...T...]..B...].....]..Y...sTr.C...T......]......]..U...J...U...T...V...]..U...RichT...........................PE..L......b...........!................W...............................................j.....@.........................@L.......=..........T...............xC..........@................................!..@............................................text...)........................... ..`.rdata.............................@..@.data....H...P...(...:..............@....rsrc...T............b..............@..@.reloc...,...........j..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\PopSoftEng.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	662920
Entropy (8bit):	6.526894314465185
Encrypted:	false
SSDEEP:	12288:+huSCyAZQUpHByI4ur32KWVyTHrpGUCiAqfoHD2AvdLnaSZCzm3slIalDoH7+F+2:+huSCySQUpHBl4uqKW2Hr9otZCCAlUHa
MD5:	C3EA1FBF2B856FC25E5348C35FF51DD9
SHA1:	87D8FDFDD52FA3BD59FDC7BB1E378091D0D91C16
SHA-256:	6F24B8CA595B4B472320C7A104C64AAD6F0928AD4F1318D1DCFBB0C5BD488A64
SHA-512:	298CE88D37E0496CDF6DADCD7D8890128B90113161311D67ED264B003D5840460FE594B8550FA46E45AF88564E4095C21B748CA3D2B497540ABEB0CAF5533820
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.............~.......~.......T.......~..........................J....~.......~.......T...............~......Rich............................PE..L... .._...........!................q........0...............................P......8.....@..........................J..N...D9...........................6......PT...3..................................@............0..(............................text............................... ..`.rdata.......0......................@..@.data....~...P...8...4..............@....rsrc................l..............@..@.reloc..Vn.......p...t..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\QKFJSGCGWGRQ

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	177
Entropy (8bit):	5.199674938155793
Encrypted:	false
SSDEEP:	3:FCxn9go7vcgtHqYcn307C3bKptbwNjGbttcSz3j9BfMkwetdQQqi5xQn:FCgYxtckm3byJwNittR9wgCQPxQn
MD5:	79D59988C12F0214DCA8BE424A94A91A
SHA1:	9C88792C8B94767093346F590CDC9C103AF6B4C2
SHA-256:	D3C151941A923BFBC7E686AECB5648461E8FA1516F93602B7AFF48F2318040D3
SHA-512:	A4D2F2E6407DE534D26911D540CCE8CF198D29A464CA9ABEB6451A9FA745C47307DF71A9C772E2D60663C4D5B0EABB9713DE794BF923B6153A0AAD3F76893FAD
Malicious:	false
Preview:	[XLY]..P2=TLGCBXAGVFLQ.KBI..P5=JHKQFETWJKTIHLLBOKO..P4=TMGJRLDUDWLQ.FCU..P7=PXOEWCVFPIJPLHQSQSX..P3=SUGIPFIMNRQE.TMA..P6=MNHWOTMLOHTPVRFXPCH..P0=DAN127..P1=e8a0d5af432b7e64DBD..

C:\Program Files (x86)\BtDDIFUEHLCR\QseCore.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	849224
Entropy (8bit):	6.7893930691706075
Encrypted:	false
SSDEEP:	12288:V/Fiea85oMvk6SqMNH/U6beovEYNVXWTwROJTQ9wC1N4Lx09GpVuQ:VAF85oAk6lMNfU6beXwROJTQSC4l0KuQ
MD5:	AA4E9E8A1B0B7C4126451814701A449F
SHA1:	7D988C453283C345E17422FC4B2B6CCFD8200245
SHA-256:	6CA0ABCD77232A5CBADE520596CAB305012ED72315C09CB5A30C3C1E96367F98
SHA-512:	0738DFDE9EC2B1E23B88FDA344CFBA443705A3AD87F22629676118DF555BD395D1737066EFCC4257B8138A0D282491CBD30F36D1880CA640E7D463855C0AD63C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........!..O..O..O.{....O.{.....O.{....O.Q;...O...L..O...J..O...K..O..O..O...K..O...J...O......O..N...O.W.F...O.W.O..O.W..O....O.W.M..O.Rich.O.........PE..L.....6]...........!................E...............................................f)....@........................../.......0..d........................6.......W..P...p...............................@............................................text............................... ..`.rdata...........0..................@..@.data....F...@...,...2..............@....rsrc................^..............@..@.reloc...W.......X...d..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\SUGIPFIMNRQE.TMA

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	4838513
Entropy (8bit):	7.999961065475255
Encrypted:	true
SSDEEP:	98304:PgbEEFSvDacXxd7ApaC/FgEQC0kqIZ27XUGCmTdpdHFHr8V:PgXjcXxxApJyEQDbIZ27XUhmBTHQ
MD5:	EEF97F5CF47A715367D8F933BDDCDF61
SHA1:	3F1119620BB8DF7963C59C1ECD7EAA485CFC72FE
SHA-256:	E2F5E8EB95FAC989DAE56CEF4C737F53F5E1747EE372BE9EBDCE544153A4E373
SHA-512:	AD50B7B6C48A2DF4167B6794C569861F0F20FE8BDB00D1B0A19B9DA22C4E9A18CC0B3F7EDE976FA9D06D29E549288A28976C788FBD6798A7B8B65835912BE40B
Malicious:	false
Preview:	7z..'......b..I.....A...............N...r.z......=.AO`/..T..V..o..dfS..,;.][.PW......y....=....kQ.i.4.;.A..i.........v$.u,.(%... .<....D&..[D...\|..........}9.Q.x.S../....(..D.t...).r..8;.i..&.k.C....9.m3i........k.AE}.6.M.^7.0.8...'f........Iz...o(w\V..Z......0.'.Y!yZ...~...'f]M.._.%.yh...+_..,Bp..S.53..`....gKNW...&.ij.g.x.....K..m....A.E.......`O^.....Y...`...\.=gG.V..Z.W.xh....=.v...:.....i...\.....<. ....2....~B..W.?..qX)r-./!.0.......P.....p..s..{..m^..\....g.<-.U...lOA..b}...0.%"..a..9.4...S.".......m%wHT..U......`..1.x$.{...F2.......hk.HEp=..O..pW...9.uA../Jo<.P......../.SXoJ.....7t/b}..V...1..K\...v....k....g.e...3b...o.e.m:.7......Kb...'..9.....lcu8.^.d..T.Y./.6....U..&......9.7...y.j.....].>z{.x..>.)...0#3...4.... ..MT.....3...yq8qrW.m......\..<..l.8.qGw...i...._..5....;."....>...8k}..~r....:...7...6.....Q.......U.....,..aP=4%/..^k......L.-....^.b...`.SU>a.W.2.....X.i.Zm..K.......K.A`...........<.<....t........A

C:\Program Files (x86)\BtDDIFUEHLCR\TLGCBXAGVFLQ.KBI

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	11899681
Entropy (8bit):	7.999984125155647
Encrypted:	true
SSDEEP:	196608:A8PLUvOmYVTAsqbS0A9hZZZoTeKJpKkfBEzkos6+ZgVcB+K6tObk87MDuPAEbqkR:JY2xRAXA9bQnfBEOB+mHkIMzEb9nxrpB
MD5:	E62839794DC4F960FE030473508B9947
SHA1:	08FF9926F663196AA48E3BE3D32E82A69567C76F
SHA-256:	5EF198566190D4E09ECF227E07061937D70C743B8C56BA1A94BCFEBD1CD86908
SHA-512:	29F9C7A5979AEE600573AA2DC1C3E9DB7CCB1A0D73E84ABDDEACCA151A664B1B692A9DF432B3CDF7DB7857BF43F47121769CBB44F7A2D981F86B34A270718E97
Malicious:	false
Preview:	7z..'.....n.........A.......c..T!.'.1..i...........KKO...M.-..al.\i..~]W.....w.....p.oW1...:1..`U..M..B[....3S.....)...A..B..._.vD2..K.....B........Flj.....Gcn...=.I.-.Zp.a...,@0..V2.fyF.\|........_).....u.0.z.R...RB1......4....H..N.7.=).Tid..).<u.#.....Y..~#......g<....6....+j.~NAEU...=j0.<...A.O...(.;F...P.J..8.H.{g.p.....m<1.u.M...E....O...AY.q.tR\G.\..Jn.C..YM...n....+...y..........q.......^..`....%...9.e..<bu5..^..i......]'.S..o.....~1..0.r..,....A...Q.{.!>...t5..c....&.;.?d1J....aG..........y ..#.g..-.....Vst....y..^.jr.....e{.<.=,..7.).2T-4..'..%..&..t.J...T.%f.me.\....R..p......m...m,{Qu...C\|..~~.0.JD7p?...O.4.D...{n.{.C5.d8..;S*e..?..^..\|M.U......sPD....+....g..G.K...........b..,...Wi.G8..7..`.......k..G......../..=.U..I...3R..[t.3..Ji/(...I.B....\wp,..9...f....g..k..:.z5N....@../._.T.B}P...&.....I..g.m}...nj....a.VAl...pN..f.XI...z.i.[#.....).E.....iP.7,.....wE..F.4.pr..DBl..a.k).h..G{.....H.>..........V.j..D...L.7...

C:\Program Files (x86)\BtDDIFUEHLCR\TMGJRLDUDWLQ.FCU

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	204
Entropy (8bit):	6.465184095835458
Encrypted:	false
SSDEEP:	3:HOIqt/N0Xfe3uK+tCSqszI1cqLq7ShUictiYAj7w1H+C/KkCVQw8H32buSljT6Lg:ulIXG3SzI1NlUi2I7wNl/CKw57vOEL
MD5:	67ED0A69C67F49788D8BD2EE4FC4324E
SHA1:	A96C13719FAEA1240F4C3BBA1781885CDC9F3EA9
SHA-256:	193902E9A4501C2D29F21AEA391D438EEA68B628DE4DB05A95D3F8DB318218BC
SHA-512:	CC9D799962F58CEA8F39788F1F82845CA6F96D43DD75C113B9EE77B7852B98F3A68799948E1172074A1CF30F9A45D526C61EA1FFA7B799D82C80C8DE1034E6A0
Malicious:	false
Preview:	7z..'.....)Np.......<........'K(R.:....!.>..8.......927...Aqp.C'b..N1...Q....9c.Q.C........k..}.+....pc$.F....M..eS!.....[n......8.n.A.....p......$.....S...9...t<....".h+#....].......n......v...

C:\Program Files (x86)\BtDDIFUEHLCR\TP453990d4df32.TPL

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.594213020193219
Encrypted:	false
SSDEEP:	12:+fVs8d7Z0cAY4pls/2+o8zE9yQwLhESu+mG/2LtLO9y7X3kiv/KVoA0MM:GsmgY4plE218HLGSiVLcu36ozMM
MD5:	3F18FAA73084F2BFAFBA4ADCC071715A
SHA1:	CB3D7999DC729071FFAFC99D7FE7985973785AFF
SHA-256:	C8367EA78CE0BC182F4B1399EC1A530E7D058951D953D63AB4B649D8EF629654
SHA-512:	B4C69DC843FB8218878C4C6FB3CA4B9C41CD8A6E78EE985094B5ABCDF93B777650056D773531A44F02B4FEF2B621E82C38F5D7B4F9FBA182C6F400DE7D89A83F
Malicious:	false
Preview:	7z..'....I#)p.......?.......R..C.O.......3.:.v..O...d..A..pS....BL.......W........!ET)\|T.....qL.Po}.Sd.=~...HjL..B...Oe6....U.j0h...?]v...B..........+sw....gf...H...]#...z....'_..q.P..V._...S...$....!...s?mm..b.......m..z...I.b!o.y.\|........'?....IH.$+.X.p..lV4.e..k.....P..>.T..1M....`W...5..'B....%T\|.8.a.d<N5mi1......0..0..7.7..&..]M..%O.......]l...N......5...1/..r......6.Z...\.`.<9.F.8..e.L..J...5.^......$cN9.....O.Ju...R..Q.l..8]0.}g.....u..1?01r.a......o.1..6C.-..O4W.....r........WG....po.oH!..9......X}..e&..Z.:.T&Z.A.T.p..0....k..+Kw1...(L.zd7..!v...'.q....VRx.}....a....9..a..z...../.C...o./c..e...U...."j...K.j...............$.....S.\|..D=.).`.....*.#....].............u$...

C:\Program Files (x86)\BtDDIFUEHLCR\TroPox-B_Plus

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	710888
Entropy (8bit):	6.630506217753264
Encrypted:	false
SSDEEP:	12288:5n9CCUQ0bGwLt1n/iswKJLUY2XOrEO/6awL7wU0s6OzeoXHhS6ckqIbpieFGrh1l:7+tLt1aNYrfBB6BAqZkyQgJ0VL
MD5:	C4A08B391245561157AEFD0FE7C40A11
SHA1:	28D15D43A1BDEBC83701AFD89E6EA9C24F90DB33
SHA-256:	53D7C8F2FD109E85FC9302B7424875BAD22A148D6EDC6C7FD8E4589E97259BFA
SHA-512:	24C7608346B76694BF9D8227FF6A794B26D73C0DA93FD231A2331CD371ACC86F293FB9093850F5513DFBE1D269114A56F47DCADBA11BD98C691AB38472A6CCC6
Malicious:	false
Preview:	Ta+....................[...............................................W.osp.....r.xt.~xuu...y\|...u.pu._jn.t..\|............*3}...........l......l..Y...l..... 8..... 8..... 8..............&..........~;.....~;.....~;.....~;.....~;.....ip~s...........................k\..W.....d..................u...C.......Y............[......................................[..........................................+..?...........#7..k....;..+r...W..o............................W..[.............................................\|.....Sw.......u.....................{...x.x..?0.......1..................[..[..x.x...Oi...K......................[......~...?....+.......A..............[..[..\|w.~..+r...;...s...Y..............[..Y........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\TroPox-E_Plus

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	5.9384613835931574
Encrypted:	false
SSDEEP:	768:84fiYqzFjnHIF7NeXNW/bZKn8ei7DAks8EA8sZeuFZjjDQWLFb:1fi9ToRNedW/bj7DiJA8sZeu3EWLFb
MD5:	59B142B38CFB0CE17D78B9D675E39496
SHA1:	0038255330C145BA84B9BEB847B992D885B7360C
SHA-256:	07F115D147FA617BCB46CDE33C50E95B6792B8309E6D9B81F8124979FCEC3E59
SHA-512:	3B65B4292EB7CFB657648A16784B0B01E2771D618C083761340158293AB1D56547A81A4EA0E6163CDF9614C97D80F88993958AB37BEB8C28A6B710A09B70864E
Malicious:	false
Preview:	Ta+....................[...............................................W.osp.....r.xt.~xuu...y\|...u.pu._jn.t..\|............9.........................@.......C...............).......G.....................ip~s............k\..W.....gr....................................+............................................[............................n............................................................................[............+..k.............................\|.....S..............................{...x.x...J...+...K..................[..[..x.x.............................[....\|w.~.............................[..Y................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\TroPox-Z_Plus

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1390312
Entropy (8bit):	6.599443687044707
Encrypted:	false
SSDEEP:	24576:znhMjKSFXpFEzq7zZvjyswjzYnOAjPSy36c9RCvirRMNJbd3g:jhMt/nVo2O56tibxg
MD5:	C77EE913C46510A705A9DDDD91DE8302
SHA1:	CB5E045FA27186B9F23E4919590387478B9343D5
SHA-256:	092689651DB7B81A6816B1F78F8CF81476945D493E9566762F5791ADFC5BDA31
SHA-512:	A6C080D04C92EFBF8A1A4A1D1423837B1282E4CFC0E77D9DA4BC9F78E235AA6CD8AE3468B588FD9D35BA656A7A1B27AAE805662EB6C84B053D0149855F4A6514
Malicious:	false
Preview:	Ta+....................[...............................................W.osp.....r.xt.~xuu...y\|...u.pu._jn.t..\|...............K<+.K<+.K<+..@x.D<+..@~.P<+..@y.<+.y.,.<+.y./.<+.y...<+.@..H<+.@..B<+.K<(..<+.#...O<+.#./.<+.#.,..<+.#.+.H<+.#...H<+.#.).H<+.ip~sK<+.......k\..W......~.............................B.......;..........................................[.........................k...........k...................#...k..........K..............................k..[............;..7.............................\|.....<..............................{...x.x.......;......................[..[..x.x...K...;...O..................[......~..............................[..[..\|w.~.............Y..............[..Y................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	710888
Entropy (8bit):	6.630506217753263
Encrypted:	false
SSDEEP:	12288:6BMGnPEAEuRNz2HuiEJe0z6h5KEuEVv4D1wEM50+OD2evinKqcQUuWnI8:6BMGnPEAEyXiEw0xXD2evincvFnn
MD5:	FAE7D0A530279838C8A5731B086A081B
SHA1:	6EE61EA6E44BC43A9ED78B0D92F0DBE2C91FC48B
SHA-256:	EEA393BC31AE7A7DA3DBA99A60D8C3FFCCBC5B9063CC2A70111DE5A6C7113439
SHA-512:	E75C8592137EDD3B74B6D8388A446D5D2739559B707C9F3DB0C78E5C30312F9FCCD9BBB727B7334114E8EDCBB2418BDC3B4C00A3A634AF339C9D4156C47314B4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........f..............U.......U..B....U....................................................c.......c.......c.......c.......c.......Rich............................PE..L.....]d.................n...8......dB............@.......................................@.....................................d.......................P,.......g..pL..T............................L..@...............(............................text...Hl.......n.................. ..`.rdata...............r..............@..@.data...4R...0......................@....rsrc................:..............@..@.reloc...g.......h...B..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\fhjyy.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175328
Entropy (8bit):	6.879935553739908
Encrypted:	false
SSDEEP:	3072:jnrQnzMYywmn3h1sp7/WvCnIukR4BbxKigu/fgl1glfdjgBftJeCEEzx4N7mcr5:XQnzXtr7tbxKVuE1gQJeCEMx4p
MD5:	BE4ED0D3AA0B2573927A046620106B13
SHA1:	0B81544CD5E66A36D90A033F60A0ECE1CD3506A8
SHA-256:	79BF3258E03FD1ACB395DC184FBE5496DFA4B3D6A3F9F4598C5DF13422CC600D
SHA-512:	BD4E0447C47EEA3D457B4C0E8264C1A315EE796CF29E721E9E6B7AB396802E3CCC633488F8BEEB8D2CF42A300367F76DEDDA74174C0B687FB8A328D197132753
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............d..d..d...g..d...a...d...`..d..g..d..`..d..a..d...e..d..e..d...a..d.....d.....d...f..d.Rich..d.........PE..L....]d............................S#............@.................................>.....@.................................d8..<....p...............d...H...........*..T...........................H+..@...............$............................text............................... ..`.rdata..._.......`..................@..@.data........@.......4..............@....gfids.. ....`.......>..............@..@.rsrc........p.......@..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\filemgr.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	618728
Entropy (8bit):	6.588792056328895
Encrypted:	false
SSDEEP:	12288:B+jJIpPUHR7IS++ZbaL/mH6yf0fvmuZqhI8XlF7YfkLfm7WUjxioncm:U++4LVs0QpFaIm7WKgoB
MD5:	6E8F89DA86BB82538932DB314C2208F8
SHA1:	A86C373D7BC49032F0EB7D0BB01DA74BA67B4F43
SHA-256:	ABA5E0FFC2D21CB5045D13CE66F8D80862600E37431D20E999295CB07DC5EF3D
SHA-512:	7EAA25D7AC722EF7687357356AC9635B80158918BDA03C3A7E49387BEACD8CD2A9A2ACFD8B5D13571453A7279772FA726A75C9DA0FD7EC6D5BAF202FB928F00C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9..9..9.MvF..9..AE..9..AZ..9..AS.e9..AC..9..9..8..AT.v9..AB..9..kD..9..AA..9.Rich.9.........PE..L....t?e...........!.....8..........b........P......................................).....@.........................p...O............0...............D..P,...@...U...T..................................@............P..$............................text....7.......8.................. ..`.rdata..._...P...`...<..............@..@.data...\|s.......(..................@....rsrc........0......................@..@.reloc...m...@...n..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\fixsc.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147176
Entropy (8bit):	6.792908985087195
Encrypted:	false
SSDEEP:	3072:oAhT/95cw+pUD+U7s3H9xMaZ7DdJMq5mZZEGP0V:RBADU7s3H9xnBhJyZZETV
MD5:	2EEFCD3D407E4DA935E5B60EF257E153
SHA1:	34F56846E9F48F9775DD8250897345B7736DE213
SHA-256:	837B3DE5BF545BAB85599F0B6D36D8DFE4B3595AE94254CF7C968D1D7DA86F35
SHA-512:	EA05765A18CDA52A7398E04947C8DD6828BE06B07261C612BB8E550656FF5F9EBBD37F85C07007980044D2036171227EEA978B0D0592D6D584A5DEFE53BF8968
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........J...$...$...$.e.....$......$.....$......$...I...$..._...$...%.{.$......$......$......$......$.Rich..$.........................PE..L...\|Q.d...........!.....Z..........X........p...............................p......}.....@.............................l.......d....@..................P,...P..\....q.............................. ...@............p...............................text....X.......Z.................. ..`.rdata..L_...p...`...^..............@..@.data...\|n.......,..................@....rsrc........@......................@..@.reloc.......P... ..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\fixsc64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	174824
Entropy (8bit):	6.422260069407969
Encrypted:	false
SSDEEP:	3072:vjNq/3Jyz4vHAYH7EKJ3eAlNd09cd7g9EEnQHBdp5FFmvBh7P0I:vjN6yKNBJ3eAdNEEEQHB/F4BhII
MD5:	ED2ACECC811ABF288316C709E2F2D943
SHA1:	0CCE7CC3687CAAF59E6DEA1A90D1214782B5742E
SHA-256:	C3E9F2023A28A2115D15D8DA451B8105771C4D4746F494CCF83FB28623CF724C
SHA-512:	9DD510EABDB4D59B82A7492DFE6A6D11C47721DD0B7F0F22C8060063A94E36FE93A28EC19815AA68F89B1B807AAE584B304AB15D183493295B7E13E65527BEE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......xI~G<(..<(..<(...g..?(..5P..Q(..5P..7(..5P...(....}.>(.....=(....k.+(..<(...(..5P.."(..5P..=(.."z..=(..5P..=(..Rich<(..........PE..d...UQ.d.........." ................................................................G.....@.............................................l.......d...............x....~..P,.............................................................8............................text.............................. ..`.rdata..............................@..@.data........ ...L..................@....pdata..x............Z..............@..@.rsrc................p..............@..@.reloc..\............v..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\heavygate.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	559000
Entropy (8bit):	6.789431209891293
Encrypted:	false
SSDEEP:	12288:OrswC3DEddri7Dj1XHmyZQNCAGTFgRJz/9i:gsP3Dwdri7DjlHECAGC//9i
MD5:	EE6AA967C56CC0D0820C95D4FD89FB30
SHA1:	D1C5161FB8CCA7FEDFFC1056FAB8D79309EEC01D
SHA-256:	C7CC69762AE72840D200C14E652A460807F487059F7D0780E245AB36AF445B9B
SHA-512:	8502D5E4BB48FE3ABCA897F293199815CE7DBB67E4983BF9A9631A4F92602289FBF08D42DC547B96E1C8338C77108019B952DAA5D682465C7C5567CCBAECEEAA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-.$PL.wPL.wPL.wY4?wJL.ww..wSL.wPL.w.L.wY4.wwL.wY4)w$L.wY48wQL.wN.>wQL.wPL=wQL.wY4;wQL.wRichPL.w........PE..L...y.`c...........!.........F......*M...............................................)....@.....................................(....P..L............>...I...`..h...0...............................0...@............................................text...\|........................... ..`.rdata..............................@..@.data....B......."..................@....rsrc...L....P......................@..@.reloc..X9...`...:..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\hipslog.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49480
Entropy (8bit):	6.739956450503979
Encrypted:	false
SSDEEP:	768:C2a0KRlGHkg3oqHo3eaB6e7NXQxZzYf3yvZ6/WitUDvb1PRF8oaH:n/HF3xb8KEvyE/cDj15FI
MD5:	E2D837E2B4DDA87A82553631E7D5627A
SHA1:	9F1A5A95B4F0AEA6F9061140F0E22EDA819A78BF
SHA-256:	A5118527EE28C3C263F3FCC3346F8BCA83284E21C8149082F8D1AAA68B39EBC6
SHA-512:	3FDBB618C9F49FE5C7EA81398401C5AD19EE8A215B9A3D29FC03071935E566B80560A775CEF3F1502F8447B2A2528285C8D4586C576A3E311241A06177E14C52
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........@3..!]..!]..!].Z.\..!].lH\..!].e....!]..IY..!]..I^..!]..GY..!]..GX..!]..MX..!]..Y..!].lHY..!].lHX..!]..IX..!]..G\..!]..!\.=!].cHT..!].cH]..!].cH...!]..!..!].cH_..!].Rich.!].........................PE..L...>.?]...........!.....X...,.......Q.......p............................................@.............................t......P.......X................6...........z..p....................{......pz..@............p..(............................text....V.......X.................. ..`.rdata..~....p.......\..............@..@.data...P............x..............@....rsrc...X............z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\iNetSafe.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	383720
Entropy (8bit):	6.579374990134974
Encrypted:	false
SSDEEP:	6144:oG1pYD09uIwtl0F1LrheKG/HYStQGz1DAOoQGEnb5bj1hFu:X7g09uRlYeKG/DHegbjs
MD5:	3CE009AFF2FE459A8248693AC8DAB788
SHA1:	607444A7B8AB2E17C525BBE0B28878C3BD0F8099
SHA-256:	11856EE1D754D31AF95F1047CE6B68CA2395C703A995525FA5D9E4A2678D0B86
SHA-512:	1AB4ECB89B07F09985B57F0D546FE6063D8ACEDE435F74075EF9A37288F7D9D19DF168AAEDB38093D88BA2E515CBDABB23F87163AC8FCF9A706448B0F4FC2774
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......d_f4 >.g >.g >.g...g->.g...g.>.g...g=>.g)F.g">.g...g%>.g.`.f4>.g.`.f.>.g.`.f.>.g)F.g">.g)F.g3>.g >.g.>.g.`.f.>.g.`.f!>.g.`.g!>.g >.g!>.g.`.f!>.gRich >.g........................PE..L.....8e...........!........."....................pe......................................@.........................0...................8...............P,.......L......p...........................0...@............................................text...}........................... ..`.rdata...O.......P..................@..@.data...p^... ...0..................@....gfids...............:..............@..@.shared.x............<..............@....rsrc...8............T..............@..@.reloc...L.......N...^..............@..B........................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\iNetSafe64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	406248
Entropy (8bit):	6.190903413261375
Encrypted:	false
SSDEEP:	6144:OazgQG4JdLe2p+teZ3q9y/3clyMEcLeowam/xohKKJJT2pgJ1JhfQeUnZdnkewZ:HgVGemGeNlYbR2am/xolx0nZZjm
MD5:	E5E4828980E5C836163382F9642D4D24
SHA1:	E8BFB72EB75D20DEEA9152089B7092E07F2EF2F3
SHA-256:	639EA37856839C2D5446A82441D7AB94204EE1172487EB88E9AC1CEB6261D554
SHA-512:	6F621EC441CA46CC48A48056F8E278FF746ECABDAB1933C0FEE18574EE366BD9721487D6462746B6874A5B2CD4D8FC327B5089F351CE8086E10061791034794B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........o-a..C2..C2..C2.h@3..C2.hF3Y.C2d..2..C2.f@3..C2.fG3..C2.fF3..C2.hG3..C2.hB3..C2..B2#.C2RgJ3..C2RgC3..C2Rg.2..C2...2..C2RgA3..C2Rich..C2........................PE..d...j.He.........." ................l................................................t....`..........................................J.......K.......P.......... 1......P,...`..........p...................p...(...p................................................text.............................. ..`.rdata..............................@..@.data...,F...`..."...H..............@....pdata.. 1.......2...j..............@..@.detourc.F.......H..................@..@.detourd(....@......................@....rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\ieplus.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	887648
Entropy (8bit):	6.72536750906441
Encrypted:	false
SSDEEP:	24576:rMl3YXVguMMrGA+64Z/fOl7FPZ1ZGf4a9nCFECq3N:Q0LMe4ZHOFPXZGfNCFEzd
MD5:	CFB50C3C7D74F518CA9E2828E702145E
SHA1:	E38FD98574C08BCC6415E62EA7C9A380958A3D1C
SHA-256:	1C8FF953478CC71166A36181ED32AE7C48B267B011240DB2C701E35D391A66EE
SHA-512:	BD08332BDB78614F1CDFD2E4939B1B9400476D99B50996C17C0277ED76DB5972FAC5EC77DCD4C56459DAA11C6126DC12D66A4E59122DC9B8D89FF6DF89B83240
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%.U.K.U.K.U.K....T.K.K..R.K.....S.K.....R.K....p.K.U.J...K.\...C.K.\..v.K.\....K.\..L.K.\..T.K.K..T.K.\..T.K.RichU.K.........................PE..L....N.]...........!.....f..........................................................^]....@.................................L...,........j...........V...4...@...s.. ........................6......X6..@...............d...\...@....................text....d.......f.................. ..`.rdata...d.......f...j..............@..@.data...........p..................@....360_iep(............@..............@....tls.................B..............@....rsrc....j.......l...D..............@..@.reloc.......@......................@..B................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\ieplus64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1001320
Entropy (8bit):	6.375963793592453
Encrypted:	false
SSDEEP:	12288:DaG9UYtX8J3EfBCMwM9E4jRcoI237MSW7/HTdPSYPJBhnHRxd/c:Dx9UdYRwM9EWI23wSWHdPTJB5dE
MD5:	074CFA8CC35DC642A2B95CC96CE5357C
SHA1:	CEE218C914D530BE6C9BB9531E78F2137224D5A8
SHA-256:	4DE592C87C443780B5D475414196B3C5406ACEC8809EA65AF45A50E7E43462A5
SHA-512:	EF776EB824F4C3152A380B3EC2858A11A96E48711C213AF905FE2B0A972F9CB4A7D83B4B96848DB0B478AF4D19623CB8AC0E5F8FC47007B39E0F16FC2E5FC851
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........../.p.\|.p.\|.p.\|..@\|.p.\|.?\\|.p.\|.._\|.p.\|."N\|.p.\|V.v\|.p.\|V.t\|.p.\|V.s\|.p.\|.p.\|[q.\|..I\|op.\|..N\|.q.\|..X\|.p.\|."^\|.p.\|..[\|.p.\|Rich.p.\|........................PE..d.....].........." .....V..........\|................................................-....@.........................................0y..g....W....... ...j...P..H........4......8...p{......................8;..(....................p.. ....V..@....................text....T.......V.................. ..`.rdata.......p.......Z..............@..@.data............n...d..............@....pdata..H....P......................@..@.360_iep(............\|..............@....tls.................~..............@....rsrc....j... ...l..................@..@.reloc..d".......$..................@..B........................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\imhelper.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247528
Entropy (8bit):	6.604794755347589
Encrypted:	false
SSDEEP:	3072:2Y77YOcw6BdKQYuVXsZy54tgQCkW30W9ezJQ4mRan5kiINyyT7PK0AMZcan5aj9b:n7YiJEIy54gFogRa0Nl/N1Sjl5yxAl
MD5:	9B05B1F0E62DD100D385807262B84A90
SHA1:	631449787D7532A855CB061E333C0712AC20E753
SHA-256:	6BC0133A16C7F058E5C0B6027929DB1145D37717118DBCF24013FA4F2D79E848
SHA-512:	9F43A542B38D998038D20467BB797CF789A36666F4B8154A548FD6E7BA24A20256C9A0BAB64CD43CB12BEBF704A524FE35F9652FA399237A3F0AFB3BF8670676
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.n..yn..yn..y.Hmyo..yg.ny}..yI..yy..yn..y...yI..yo..yg..y*..yg.xy...yg.qys..yg.iyo..ypUoyo..yg.jyo..yRichn..y........................PE..L...N{.e...........!.................................................................N....@..........................R.......B..........................P,.......&..0...............................p...@............................................text............................... ..`.rdata..............................@..@.data....\...`.......>..............@....rsrc................Z..............@..@.reloc..h7.......8...`..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\ipcservice.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	705768
Entropy (8bit):	6.685295160437571
Encrypted:	false
SSDEEP:	12288:S/20NCvMDhBsqLeIQA2BcMNcYB1mF5Q3LNOsbwbekwCYgLECHqa7XWpbt9o9TehK:e2KC6hBs6f2Bcm65sO8wACHqaTQJe9Tn
MD5:	8B632FD2D4EA70470AF97CD5E88F74D7
SHA1:	9E384D37EB586E9B187F4FFF89C2F104A7921F44
SHA-256:	AFCBB8BCE2E5C8C5E9AA851941E626A62573E6054EC75C14066AD37726BB9DB6
SHA-512:	5F7EA2BF6599AA9E0C44C2820F89DF0827EEBD8A037C9DF2AF516D9865BBEEAF31CAC89AF7214A59BD4B25F2BF7EB94E257AA2766F1D12892E1C34E78776F5E1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,B..h#.h#.h#..,..j#.a[J.p#.a[U.d#.vq[.l#.a[L.K#.h#.#".a[\..#.a[[..#.a[M.i#.vqK.i#.a[N.i#.Richh#.........PE..L...X.Le...........!................L.....................................................@....................................@....p..8...............P,......Pk..`...................................@............................................text............................... ..`.rdata..............................@..@.data............6..................@....rsrc...8....p......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\jpnative32.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	202472
Entropy (8bit):	6.660474984647205
Encrypted:	false
SSDEEP:	3072:jLH6l5IoUzqiNVwzQyaT0NQgepguwz+uQJOAg0FubAIrnXrsFCAsKIP0a:SluoK7QiToQdeAOpLAFCtKha
MD5:	0EA1C58DEDF685A4A1EEB1C7BD1C972D
SHA1:	66CA439A737A35FC936D2C8F990AD3538D9F2CDC
SHA-256:	41780A7339545676A2D587CD5BCEA9181E6FAAF3EC73C5006D7D76B47B98A6F2
SHA-512:	D16B0A12EE38399C4B05F38E0CCCAFA6BD4984C353AF845337F3E5E8D64AAF3D9B1561E423C5CA59D2652EB083E92FB8832168989B34F11465AD581A39739BA7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~...:gx.:gx.:gx.....7gx......gx.....'gx.h.{..gx.h.}..gx.h.\|.%gx.3..=gx.:gy.Zgx...q.8gx...x.;gx.....;gx.:g.;gx...z.;gx.Rich:gx.........................PE..L......d...........!.........*.......\....................................... .......A....@.................................P...P.......................P,..........p...p..............................@...............D............................text.............................. ..`.rdata..............................@..@.data...H...........................@....rsrc...............................@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\jpnative64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	247528
Entropy (8bit):	6.255611405833788
Encrypted:	false
SSDEEP:	6144:MzlHNKfmGZoRwaQDy4ikigoh7Chpq8eFiybV:6tp9QD7ihgohCQFh
MD5:	9380B590C9BE993F3F253469D0933765
SHA1:	0DF57C8EA3D19DCEE142F03D0D6FF4DA7EE5BCCA
SHA-256:	CB8BE7A72561A379B122AB70CAE681840009CE71C9C50B819B2B9E8CCC7A5B73
SHA-512:	2277F388E10D8D579203F7546C30DD314C4BA0AEAC0CFBDBB7F393FBFE54F7ED60FBEDB31E524275112D9E1BDB9F5CB24AC02259ABBC096A81E8CE2D32B87F6A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^.T...:...:...:.u.9...:.u.>...:.u.?...:.H.9...:.H.?.,.:.H.>...:.u.;...:...;.E.:...3...:...:...:......:......:...8...:.Rich..:.........................PE..d...A..d.........." .................c...............................................8....`..........................................\.......\..P.......................P,......\|....&..p...........................P'...............................................text............................... ..`.rdata...U.......V..................@..@.data....'...p.......V..............@....pdata...............f..............@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\leakrepair.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	705504
Entropy (8bit):	6.635093248285898
Encrypted:	false
SSDEEP:	12288:GngcmdomAFsBeQsv5REGqRXkgVP73MfsPF9vyt2nSyv9K:fLAFKsv5ROkgVAfsPTyEnD9K
MD5:	C40E8A502AF91ACA96B85AB36CBE818B
SHA1:	004141E75604502E2EA30C5760008368C36850D8
SHA-256:	A10966CC2785845DC296D90EF9C97ABA865BD06DF1A8A7006A7EE53EBD2152FB
SHA-512:	219630292A8CF70311F06DC1F3A99BA948E7E7BBAB937B0F5B928121838B79FE851B70650BFFD07A4F36A22E2A7B34DE4461D8F4C97FC1322026CA2C5C2E31EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........fP...>..>..>..v?..>..o=..>..o:..>.l;..>.0n?..>.?u;..>.....>..n:..>.j:..>.j;..>.6....>..n;..>.2n:..>..`;..>..`:..>..o;..>.2n;..>.l:..>.l8..>.l?..>..?..>.4i;..>.bj;..>..n;..>..n>..>..n...>.....>..n<..>.Rich..>.........PE..L...].$a...........!.........z............... ....{5................................b.....@.........................@...0...p........p..................H?......XS.....p...................P.......H...@............ ...............................text............................... ..`.rdata....... ......................@..@.data... 7...0......................@....rsrc........p.......&..............@..@.reloc..XS.......T..................@..B........................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\libcurrant.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	966376
Entropy (8bit):	6.564045153487216
Encrypted:	false
SSDEEP:	24576:3lzYxkj819KdVtUSPczJfKbM1aIjvI7BxwwuDFkrwtFkUHUZ0sIPbtYUkXAJfTSH:1zge8XKdVtUSPczJfKbM1aIjvI7BxwwH
MD5:	A9FF3D29AF8CCA5D3C90F17709EB0548
SHA1:	7F4B69366BA3BBB7BF08206FEA672C807CC2B562
SHA-256:	45E8B5F32CDE9201278500DF961133AD26AD60C531FCFD77D3D26FEFF105FFD0
SHA-512:	F043D1599D57B1E86D97CA1E81CF81FF0B3C97B95F1134ABF6DEEAC615F37645A825363315F5FB2139286BB5AEF5FA26C375E829AEC897C27CEA30199310123C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$................e......e..*...e...................g....2Y-....................i.....y......}....................}.........Rich...........PE..L......d...........!.................d..............................................`.....@......................... ...H...h...x....p..@...............P,......@j..@t..p............................t..@...............L............................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...@....p......................@..@.reloc..@j.......l...$..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\libgravity.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	871144
Entropy (8bit):	6.407442398411684
Encrypted:	false
SSDEEP:	24576:hgjR9MABH2uK50bPcjV/3WU020ZQA8NM/rmn:ghB1W3WUVeC
MD5:	9A88DC21D3AC42ECA184F37297387BDF
SHA1:	2F82552EF8F4B6A10356441CD158F1A0C5905913
SHA-256:	466DF96D59B878EC6775ECC4D497B71CCD73CB11FBB2C2B23575EFE055BFFB75
SHA-512:	1136D371771A71D329910ED9BDBF8243F74AD19FCE75F9A8712BC1E1E53EA3EF3722D4E067AB5567366D40D2637AF7E119E7E31734DDB57BCEE126CFE932C37B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......U-.}.L...L...L..3,./.L..3,./.L..3,./.L...L...L.......L..C$./.L..w$./.L..w$./.L..C$./3L..C$./,L..3,./.L...L..]M...%./@L...%./.L...%,..L...LD..L...%./.L..Rich.L..........PE..L......c...........!.................P..............................................._....@..........................{.......\|....... ..8...............P,...0...s..p&..p....................'.......&..@............................................text...U........................... ..`.rdata..............................@..@.data....}.......&...\|..............@....rsrc...8.... ......................@..@.reloc...s...0...t..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\libscent35.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	927976
Entropy (8bit):	5.917840435230856
Encrypted:	false
SSDEEP:	12288:Syp5QtiR2fVE00WKL+YD5ndNpKrtvKXVsFpJppn72z+T73P+2QHkgFrGCZK:1POE00WKd5ndNpKrtClsFXnhT7ZAkgxO
MD5:	158D719030DBD08384235B165FC211CF
SHA1:	A8161B15C0BC6576829DA4BC0732794B0AB2E37C
SHA-256:	BC33C91BE3D31557B16F2B91B90DE96580C3CD2510E3C3D3B77E3D4CC8DBB0B4
SHA-512:	383E551FFC50D17E9A5B466E996614B5AF35BEB48A72A47CB7D5A35B68D68906E5ABADDAEABD439AA214BE28E7A27FBCA3872537D65D33CA64A53B513A924EDB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?.(e...........!..................... ........@.. .......................`.......7....@.................................P...K.... ..................P,...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........o..P............b...............................................0..M........(....~.....X.....r...p~.........(....(G......r-..p~.........(....o....}........0.......... ......{....rU..p~.........(..........(....o...... ...........%......(.....%......(.....o.....o.....o......ry..p .....o.....(~...o.......o.......+.....X.....o....o....&...X......i2..o.....0...............(.....4........(......-.r...p.....(....(....s....zr...p.....(....o....(.........(.....s\|...%o~...%~

C:\Program Files (x86)\BtDDIFUEHLCR\libzdtp.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	575720
Entropy (8bit):	6.4118078561661545
Encrypted:	false
SSDEEP:	12288:FoblSYniV7pA1yJVyfI1+RZSihzvjZh2Tx4UTFAzmp4ZZPy1KlU1E:sfI1+RZSiz2VlTF+XHlU1E
MD5:	82DE25B17C3B9D6BB253B6BE7AD2FEA1
SHA1:	6F6BCF23753F161D4DE444978C3EBC003D361B2D
SHA-256:	165FC9F929853B4AE8603BB0C7807456B99871A7C8E9078F95D954C466A7172D
SHA-512:	71EA0FE18F1EBDA98067460E6661FC108E7116E71651B0D05FB8365BDA92E1DBF02B89D20DF6B47C7557AC52877ED8EE503373164079C0F5C62EBF16439867C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$....................r.i....r.k.I...r.j....c.....c............X,_........................................n....n.....n.g..........n.....Rich...........................PE..L.....(e...........!.....v... ............................................... ............@A........................@...........x.......X...............P,......lJ......p...........................p...@............................................text....t.......v.................. ..`.rdata..\l.......n...z..............@..@.data....c.......(..................@....detourc.5...p...6..................@..@.detourd$............F..............@....rsrc...X............H..............@..@.reloc..lJ.......L...N..............@..B........................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\libzdtp64.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	682216
Entropy (8bit):	6.095070464124169
Encrypted:	false
SSDEEP:	12288:rhqnA1JpofoqtokijtH2OMoVTP94CCIKGJToFTz/goFZKk:VqnALpPqXq92bEx4CCIKGJToFTz/gox
MD5:	3D7564C3B97E0DCC859CE8FAE51BF196
SHA1:	F6588DAA615A45E375AB4CD8153A3D9BBDC476C6
SHA-256:	73D11EF506C2282DBD45C4758F6C6B1352C596B1EC684BEF30778965D0774F1B
SHA-512:	C6021111CA8F0B8BBD111F85397C0F91DD2423B9168711296B484190CF5C43CABE6215AFE4533881F0F285FBB201D4974D7343E92F33681B1983BB1770110246
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........C".."LA."LA."LA...A."LA...A-"LA...A."LA.KH@."LA.KI@."LA#..A."LA.JO@."LA.JI@."LA.JH@."LA.Z.A."LA.Z.A."LA.Z.A."LA."MAd"LA.KE@."LA.KO@."LA.KL@."LA.K.A."LA.".A."LA.KN@."LARich."LA................PE..d......e.........." .........*.......^..............................................9.....`A................................................d...x.......X.......PF...<..P,..............p...........................0................ ..x............................text............................... ..`.rdata....... ......................@..@.data........0...F..................@....pdata..PF.......H...d..............@..@.detourc.h.......j..................@..@.detourd@...........................@....rsrc...X...........................@..@.reloc..............................@..B................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\lockkrnl.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	628184
Entropy (8bit):	6.631864802737484
Encrypted:	false
SSDEEP:	12288:Q9tUcJqS8DI9baOCmIJkPI9VYxPmb3pJ3xW2orMvM79G:GWKqS4OjlPUkmrpzWdSM79G
MD5:	BFF0CE8D5C44994EF19F63D63CC29EEB
SHA1:	B2837190927EE952721DBD5127C426D28FED9230
SHA-256:	08C6DDD72CD481672476625BAB435993F2F0C85F835B0313C593F46C49DE6781
SHA-512:	F527BB56DA57CA6BACDBA7871D65E48CA6ADEFE7F61240D766A6881C301B63C60063A09FA73E8BC64F40A01AD038B446B660A8ABC7719B84F1C6FE3654551420
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........<W..]9X.]9X.]9Xh-:Y.]9Xh-<Y=]9X.5<Y.]9X.5=Y.]9X...X.]9X.5:Y.]9X.5=Y.]9X.5<Y.]9Xh-=Y.]9Xh-8Y.]9X.]8X9]9X)40Y.]9X)49Y.]9X)4.X.]9X.].X.]9X)4;Y.]9XRich.]9X........PE..L....k%b...........!.....^..........=X.......p......................................c.....@.........................`................0...............V..@?...@..8F..pp..p............................p..@............p...............................text....].......^.................. ..`.rdata..jy...p...z...b..............@..@.data....8.......(..................@....rsrc........0......................@..@.reloc..8F...@...H..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\mobileflux.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	117064
Entropy (8bit):	6.436398487030181
Encrypted:	false
SSDEEP:	1536:pxNcrXn306zvccqtaGYvPCa/I7206aawWKxocUoiZw+BpQR9oLMm:pXcD30gccqtanCM0Wwiw+BpQR9oL
MD5:	80907BE35290D47A8C6DF50A0B44DECF
SHA1:	DBDDA59DD78716AD28FD37BF2619FC183D27CAE0
SHA-256:	4C4853E4F3990FFD0B3D6EB1436A885559564C1065C26490B777EC9D3586A5C4
SHA-512:	09D05C3133569548F4F231F0E06F6F29D57195C927B908F973CB05ABDE6214CA1E07399CB32EA5EC02635D81409B2A8F8F6BDA21F6B51B2A02115C2DF95B3B88
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m..)g..)g..)g.. ./.8g.. .9.Mg.. .>..g......:g..)g..g.. .0.!g.. .(.(g..75..(g.. .+.(g..Rich)g..........PE..L...%..S...........!.....,...\|......H........@.......................................O..............................P.......4u......................................0B..............................._..@............@...............................text....*.......,.................. ..`.rdata...A...@...B...0..............@..@.data..../...........r..............@....rsrc...............................@..@.reloc..~...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\netmstart.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	171592
Entropy (8bit):	6.633100643329799
Encrypted:	false
SSDEEP:	3072:2g5d8g4gNv+wAGzpjdNwCR5t9Owr5HQ6UnsaP5YCnF+wFxDA:xDRpSs5t0u5wbfQ6E
MD5:	FF07224F63F62ECC5C6F2DED09DEB0AF
SHA1:	D3ADF969B20A3E42032E60A87DBD69834A748C1A
SHA-256:	A9F37F82413889A66F7063991F5C2E6DBA05A35A245891039204A478DE318357
SHA-512:	92B763A682C9F479F539AA945F245940351983EC04829FB6D614BB7ABCADE60E2205244C583F63547CF83F4819503529FF01411E08C9CBA26972222D2520AA4D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..X.y...y...y...+-..y....<..y......y....-.y..5....y...y...y....#..y....;..y...+=..y....8..y..Rich.y..........................PE..L....].[...........!................F.....................................................@.........................`...........x....p...............f...7..............................................@...............4............................text............................... ..`.rdata...N.......P..................@..@.data....L... ...(..................@....rsrc........p.......8..............@..@.reloc...".......$...@..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\np360SoftMgr.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	243944
Entropy (8bit):	6.56760832272308
Encrypted:	false
SSDEEP:	3072:YdtvVq01U5wXzfoUEwDTw3lCovmHDBYOfdv2xJ82wEdl/NPgqddBumr5365mwkq/:yNI0O4awI3AYqYEv2QIdZTJJYD1Y1a
MD5:	FA85435627D31663BECB82EFFDFBE2BB
SHA1:	C3D9EEA92EF90E652F500A1F900DA4E20A010C2A
SHA-256:	7E0343BC0108526442E8B3FE7E538272FA6240E425BD8F318924573B59BD9DFB
SHA-512:	7DA0E76E88D8E78D23E7E6BE0A184BF52DF5032113DFEBE087C3463AD990BE38CD4FD34586CCD367B381AE749F16E04573CF91E4B3D7A235A865D175FAACBDA8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................f.*......)......?.......8......}........z.....6.............(......-....Rich...........................PE..L....6.e...........!................3.....................................................@......................... G......\:..........h...............P,..........................................@...@...............<............................text...x........................... ..`.rdata...x.......z..................@..@.data....D...P.......<..............@....rsrc...h............T..............@..@.reloc...-...........\..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\npaxlogin.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	404296
Entropy (8bit):	6.509440609680588
Encrypted:	false
SSDEEP:	6144:iwa9e5G4aES0Qux3nNj43ziT7U2mSBzRD44shPBTLaqqDL6UbwHUu:Y9exL3u0U2pBzm4sxBTrqn6Unu
MD5:	630AE5740C702AF919BAED414DE8CFE3
SHA1:	26A50EFF049B2DBC24BE11411032172E82B37B04
SHA-256:	C3F08B4843DAF466148EE99DBD0D300B2A92BB695FCDE001E288189A3582300E
SHA-512:	A714A6F13CE33D8EC31772F180F611C491110D438019D4FCD88F2EB114B41FBD28878B8B9C6BA723D892405DC825917EF1D4868FFB66069ABE49E5AF286F491F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t..,t..,t..,}.\|,y..,}.`,n..,}.f,o..,t..,h..,}.v,...,}.q,...,}.g,u..,}.a,u..,}.d,u..,Richt..,........................PE..L...[AVS...........!.....N...................p...............................p............@..........................x...... f.................................. 5...s..............................8...@............p..d............................text....K.......L.................. ..`.orpc...3....`.......P.............. ..`.rdata.......p.......R..............@..@.data....Y.......:...\..............@....rsrc...............................@..@.reloc..hc.......d..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\ntvbld.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS-DOS executable PE32 executable (DLL) (native) Intel 80386, for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	60896
Entropy (8bit):	6.847633229504993
Encrypted:	false
SSDEEP:	768:NnCuEmXB5UMI3nhKrbZCWg/0/NC8hUDVsa0T1zj9KyhaMQNDG0uKjKj9MPgkz:N7Rx5Ulll8/H+x0T1zj9lHeMy
MD5:	690612154E7E5233AA980016CEAEDEDD
SHA1:	9B16E2F3D799EA506AA6A8F53FA4DEB36D73F5D4
SHA-256:	FFB81D34A14B5837AC713657F7892E790F85564BC2BA792025B0F9E9E0959AD7
SHA-512:	1F93AF0CA40DB562F7ECDBF19A0D899044BCF1F181B03E57E6B6F2C72F532652798023612BE9DEFE6261D631D10898D30ADB28EEFF922B72734B4DB27189C210
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ!..... ..........e..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ntvbldDXML..$............!.L.!........h.T.....................q.......q.......q.......q.......q.......q.......q......Rich............PE..L......a...........!.........\......2=.............p................................s`....@.........................p...........(.......h...............H?..........................................0+..@............................................text...v........................... ..`.data....F..........................@....rsrc...h...............

C:\Program Files (x86)\BtDDIFUEHLCR\pluginmgr.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	171848
Entropy (8bit):	6.451554967739461
Encrypted:	false
SSDEEP:	3072:NQbFXbsJHCPNUzpNd0hq6pPyNVD/fAudYMi429OYHUMu73zE55C8f:atWpnztVLffdYLN8YHa7w
MD5:	9828C8A355EA0F393260D6E3F7D511E5
SHA1:	DC587D4215DC083A35E4BBEE095FB3FB07A73C33
SHA-256:	B0D6D85D02E7650E03AB9AD04E90341EF6F5421DDC2AAA7AE65692944C298671
SHA-512:	178D1AF5ABB116762C37714F2C142DB02BE9AF8B0C9BCD4948DE122583A9C815E1AB1F709E3167A096947CCCCD6ABEDC4BAB7ED405D207F097BD35640926205A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........xL.+L.+L.+..+M.+E..+^.+E..+1.+E..+u.+k..+].+L.+..+E..+].+E..+M.+R..+M.+E..+M.+RichL.+........................PE..L...P.LS...........!................D.....................................................@..........................2..M....'..x...................................P............................... ...@............................................text...'........................... ..`.rdata...S.......T..................@..@.data...HU...@...,...(..............@....rsrc................T..............@..@.reloc...#.......$...^..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\probe.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	304640
Entropy (8bit):	6.443933218835315
Encrypted:	false
SSDEEP:	6144:1AXDdMpEeHyH/D1kApvwp+ZniFARcRdhAGXPR:1Az6WeHyfDOAdwp+doARcRdh5Z
MD5:	BB752561CE0859324FF01369BA8D25CC
SHA1:	8C42AA1FF9060E58CFFD0EE9997DF134FB3E8739
SHA-256:	A243D55655789EF26972546B7DC9723953564F52AE1C46087CCC2DB96F5B8D83
SHA-512:	0C493C6868F4E2D90E3FCD6B71116769F2FA2F61740BCB9671B1DEEFC4628BE05E4441CA2008F6AD3F72BAE7C14028A7565CC2FBE68478E620F3CF9418357182
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&PLYb1".b1".b1".kI..s1".kI..^1".kI...1".E.Y.o1".b1#..1".kI..n1".kI..c1".\|c..c1".kI..c1".Richb1".........PE..L....r.\...........!.....`...........?.......p......................................Cd....@.........................@%..B...X........p...............n..h7......@#...r..............................(...@............p..d............................text....^.......`.................. ..`.rdata.......p.......d..............@..@.data....6...0......................@....rsrc........p.......2..............@..@.reloc...0.......2...:..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\qroscfg.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	138056
Entropy (8bit):	6.637936005523512
Encrypted:	false
SSDEEP:	3072:LKDfRbUTKLoDy1wSSH/2Lq62enAhXx2+EKI:KJITHu1wZf2Lq62UAh6
MD5:	F62317FC61CA698D45A54C0F7A8A78B8
SHA1:	F61D256EA3E3DD85CE7C44DC61AACC93E720F692
SHA-256:	59DC54DD624E26D07EE8A908476EE67DCC3B6BA690F566C30B5522B6DCB8EE85
SHA-512:	C06E046EDB18EE40D63411AA689280A73EBBEF3CE6977C51F629C43E6A6314895BCF2270E43CB1D9DD847B33874BC812778ACCEC07ED0FBFB9791556027FFCAD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./.j&k..uk..uk..u...ui..ub.uz..ub.uR..ub.u...ub.ux..uk..u...ub.u\|..ub.uj..uu.uj..ub.uj..uRichk..u........................PE..L.....,S...........!.....N...................`...............................P.......T....@.............................L...\........ .......................0..T...0b..............................8...@............`...............................text....L.......N.................. ..`.rdata...k...`...l...R..............@..@.data....A..........................@....rsrc........ ......................@..@.reloc.......0... ..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\qutmipc.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	170856
Entropy (8bit):	6.55483314591404
Encrypted:	false
SSDEEP:	3072:4JJiNkByXIzFu3wK672soO82qUyleRR2v6eY8lMnu+wqH6F3:477yIzFfKTsS2qUKeXC5lRR
MD5:	7EE49A57339ABCC35FCDE25D3F5EE8D9
SHA1:	7A7F471DADD973CA57C79C43D93828B4496570E8
SHA-256:	DC477A4B41CA92D94CB7092B458F35DEF2EF6F9A0B23A237A363E341E22AEABB
SHA-512:	F978F6C882D80CFD87B2EF75EBB1C18C9BFB6759D28C0F503395217373AE241E5B08212D4D42373F6B94AFFBF775959E06BD1CAD5D09C488DC139906A0D4AB4B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$...`..R`..R`..Ri.]Rk..R.BRb..Ri.ARr..Ri.WR...RV..Rb..RV..Rc..Ri.GRq..R`..R...Ri.PRZ..Ri.FRa..R~.@Ra..Ri.ERa..RRich`..R........PE..L...f..]...........!................K.....................................................@.............................a............................f...4..............................................................d............................text............................... ..`.rdata...O.......P..................@..@.data....n... ...(..................@....rsrc................8..............@..@.reloc..<#.......$...@..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\qutmload.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	111336
Entropy (8bit):	6.7222941004358425
Encrypted:	false
SSDEEP:	3072:PTxwTSQCdxm/78XLv6JYZeD9GIn+uowP0T:PCzCeeeYAD9E5T
MD5:	8719E73BC84D506FE7F0D367AE46ED20
SHA1:	D60A1FF7B2478ACDA7C5C1730E0B963594311FB9
SHA-256:	C110E1FF4F233669F1E035129E137ACED1A3632D17A8302502D160DC16FA9AF0
SHA-512:	AE00044E9EE7B5AF66105067877AFD68D79ECEB6C945CC07F390D15A2E1C0832C578146E6B0657FD8A29F865EC6DB78DEFEB7C1BA7E3AF0D1427EFD22A67F8B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........z...z...z.f.'...z.....z.......z...{...z.....z.....z.......z.......z.....z.....z.Rich..z.........................PE..L...Z.Xd...........!.....Z...........A.......p...............................`............@..........................X..[...TM.......0..................P,...@..t... ...............................8%..@............................................text....Y.......Z.................. ..`.data........p.......^..............@....rsrc........0.......d..............@..@.reloc..f....@.......j..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	691760
Entropy (8bit):	6.65005121490335
Encrypted:	false
SSDEEP:	12288:z9dSp9WkHCGswmfwHaG3qNeNCGWmQ47/KkRjDMfZVt1UE3HZyr9oUTB2O:Ra7HCXwmfwHRI+HWmQ4HRjDIZVt1UE3a
MD5:	938C33C54819D6CE8D731B68D9C37E38
SHA1:	5DEBC5AECEA887D17E342E3651006E1DB351034F
SHA-256:	E705895392ACD9768F413E35545C6581B3BAC8C05DCE97BC9AF6A37BE7CB7DE3
SHA-512:	16DEAF3B8C9A29B73D6530474F2A0BF5AC756D44A04D2468464FB78C9048CA9F1E1EBBCC91ADFC74963B7083B0381A47F76C70BADDEB44026C969125EA1C929A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......c..........................................@.................................6............@...............................-...p...~...........:..0T.........................................................................................text...P........................... ..`.itext..t........................... ..`.data....5.......6..................@....bss....le...............................idata...-..........................@....tls....8................................rdata..............................@..@.reloc.............................@..B.rsrc....~...p...~..................@..@.....................:..............@..@................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\FLIEAC

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	2713088
Entropy (8bit):	7.9358560764847
Encrypted:	false
SSDEEP:	49152:gCE0mvBnEwvJm7T8UyHNzeBBHKZlYU13/1wUqq7vf2h0Vw:gCZmvBEqUyHcclt/mUCOa
MD5:	C625FE50C8CBC877CBFAF1D5212F02C0
SHA1:	90763CBEB446C7638F80851E55AF9976285DC56C
SHA-256:	F8890DFA4609D9CB2CA685339468C5256356066CF91AB13C9A771A3B8A566D12
SHA-512:	898703B75D27A9EE5055965BE16D7DEFA482A4199D6C008E539A0102230743AD4540945B76E78804F4CFA99D3DE79B9584D91F6C74C3FF2E6B8F4CC09E7F472C
Malicious:	false
Preview:	...SLSSSOSSSPPSS.SSSSSSS.SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS[SSSA..AS.J...R..................................FFE.SSSSSSSB.....t5..t5..t5..x5..t59..5..t5y.~5..t5...5..t59..5..t5..u5..t5...5..t5..t5..t5...5..t5..p5..t5......t5SSSSSSSSSSSSSSSS..SS.RLSd..SSSSSSSSsSA.DRISS.SSCSSS3.S.E.SS#.SSC.SSSSCSCSSSMSSOSSSSSSSOSSSSSSSS..SSOSSSSSSMSSSSSCSSCSSSSCSSCSSSSSSCSSSC..S.SSSSC.SCMSSSSSSSSSSSSSSSSSSSSSSSSSS...SGSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS....SSSSS3.SSCSSSSSSSOSSSSSSSSSSSSSS.SSs....SSSSS.SS#.SS.SSOSSSSSSSSSSSSSS.SSs....SSSSSCSSSC.SSOSSS.SSSSSSSSSSSSS.SS.SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS....S....FJKH

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\HipsdiaMain.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	6.398722888372975
Encrypted:	false
SSDEEP:	1536:qjw1c0DJ1xDL8lCXy60KlCXy60vcbvM1id4xSu:T1HPxD2Cj00Cj0C00WxS
MD5:	56867EECC2042A0FD681F3B90D365A16
SHA1:	021DAC119F8E115E6DF308DB85BC8760078D9719
SHA-256:	48F8313380BC6FA33172888B8FD9874A6ED5465213BACB9F8D5C2BB3AB37BAEE
SHA-512:	EBB40D1E1A7F6B9E9480E544A67C9383D53A708547ACBA787BFD7C5699E491EAD7FAF714C5D84407B3D9A1DD2051205E0A299EAEECEB44422E3874C5E55CC65A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........FJo..Jo..Jo..%.U.Ho..%.W.Oo..%.c.Ao..%.b.Ho..C.Z.Oo..Jo...o..%.f.No..%.R.Ko..%.T.Ko..RichJo..........................PE..L...83^f...........!.....2...........9.......P............................... ............@.........................@...]...L...P.......................................................................@............P..,............................text...40.......2.................. ..`.rdata.......P.......6..............@..@.data...............................@....reloc..<...........................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\PackageMgr.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107120
Entropy (8bit):	6.416041804489009
Encrypted:	false
SSDEEP:	1536:ABHJ2sevEPtUiDHPsG78SkqRsEKk2UaWD+Ug1phiaeBvNdiizK3xg+rd3XjxxyhS:eHAR6tHDp/acgrItvNdiizK3xg+FXOS
MD5:	773D6EC38151B301FB8E45B4043E2E9F
SHA1:	475A42DD7FF0417D6826187F37AA3B5FFA65AE50
SHA-256:	E15E52A68BA167C0E6683EAFA3102079BBD0262EF5BF1005FE5A3B492374F66A
SHA-512:	FFDEEA69581B7C25CF5DC83A9803E94AB83D6C19254F5DE474240DAD3B630386D8D401B7A5EA25F97B1BF068D95266D53AD6324362E7CF94B1F326DAA9B5A1EF
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......L.,7.iBd.iBd.iBd...d.iBd37Ae.iBd37Fe.iBd.0Ge.iBd37Ce.iBd37Ge.iBd..d.iBd..d.iBd..d.iBd.iCd.iBd.7Ge.iBd.7Be.iBd.7.d.iBd.i.d.iBd.7@e.iBdRich.iBd........................PE..L.....3b...........!................(...............................................&.....@..........................=.......>..,....................p..p2......$.......T...................d...........@............................................text............................... ..`.rdata...P.......R..................@..@.data...$....`.......:..............@...minATL.......p.......F..............@..@.gfids...............H..............@..@.tls.................J..............@....rsrc................L..............@..@.reloc..$............^..............@..B........................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\QMAVProxy.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	99952
Entropy (8bit):	6.458473763443854
Encrypted:	false
SSDEEP:	1536:ZAUmWga/j5/IEHE2BzIfjwpDvdxeR1Ay01A4F1519hTnZmjjxy:jm+JrHElE9SRuy0hFX19hTZmM
MD5:	D902AF6BDCB8F3D47CC7A26B7F5AF840
SHA1:	B42E2C429F60551CAFDD92F5024DA7EDEC1270EB
SHA-256:	ADD79DE18ECBDEEC06D9765B2308FDBEAB3F788382A07D6235B614CA58BDA2B8
SHA-512:	1D55DC22AD3317622C3AE502B4B329B25DA6EB03D5FE8D2F4F7319110A196CDF08BD5E5DBB6322D6FC12B3C4472C629F9F64523FB23928E0433F96D0C8098911
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$...J...J...J.......J...N...J...I...J.g.....J...K...J...O...J...N...J...L...J...K...J.ys....J...K...J...C...J...J...J.......J...H...J.Rich..J.........PE..L...!8.d...........!................1...............................................v.....@..........................;..T...T;.......`..`............T..p2...p..t...4...p...............................@...............0............................text...%........................... ..`.rdata...h.......j..................@..@.data........P.......8..............@....rsrc...`....`.......<..............@..@.reloc..t....p.......@..............@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\QMDns.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51312
Entropy (8bit):	6.588801090147588
Encrypted:	false
SSDEEP:	768:gmaAkOI8/UgAXuuMnw415frUK5yPPTnDG3318RU7yw2MvZDGjENAMxaJ:gmPNN7wU5frbcba318aJjjxaJ
MD5:	BF125A12E9CE8568AADD6A9EE11C696D
SHA1:	4B8CF25506F5729D485171DECAA152B32EF2AFBF
SHA-256:	72C9E45E029115541AEBA55243BED56CCB5E594E50CE26DEFDE76D35B5B892C4
SHA-512:	B2FDCE478034312D7C7911F83E5A56DA505F9D5FF351CA74A8718B4256BB91DCBF341A268349DC992C7232A9B012BD986224BD650F7141261F8D38E9DCC43318
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T...T...T...].f.X......._.......W.......B.......P....;.U....>.]...T..........v......U......U......U...RichT...........................PE..L....1.d...........!.....H...R......7L.......`......................................qi....@.........................`...4...............X...............p2......p...p...p...............................@............`..d............................text...3F.......H.................. ..`.rdata...7...`...8...L..............@..@.data...\...........................@....rsrc...X...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\QMEventBus.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92272
Entropy (8bit):	6.543211290485113
Encrypted:	false
SSDEEP:	1536:5MUmmeVWAcHeFzyWQ+lh5W0pkw01pPafkNA0tDq3NnqFBjxxP:5MUsVF6eFvPPWBw01ofkNA0E3NnsBj
MD5:	23E97B1438152A4328FA97552F8B9AA1
SHA1:	F95D191EB1E6DDBCA5B20FAC2D0746FEBB0B2C12
SHA-256:	17CBD8771713566BEB469B300D34782986EF325582DCB575C4FB35C1FB397A9E
SHA-512:	FA497B5F806D851717C920755E245E65CDBF5CEFCE0975DA33A43C88005474F87D006FFEFE111A199ABF4FC68CA640CD18709FEDFC376FC64E6D6CC272D816A7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......X\...=.N.=.N.=.N.E.N.=.N.2.N.=.NNH.O.=.NNH.O.=.NNH.O.=.NNH.O.=.N..ZN.=.N.=.N.=.N.._N.=.N.H.O(=.N.H.O.=.N.HkN.=.N.H.O.=.NRich.=.N................PE..L....2.d...........!.........z......e................................................[....@..........................&......('.......`...............6..p2...p..`.......p...........................8...@............................................text...}........................... ..`.rdata..VS.......T..................@..@.data... ....@......................@....rsrc........`.......$..............@..@.reloc..`....p.......&..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\TDPCONTROL.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1063616
Entropy (8bit):	6.674869382282474
Encrypted:	false
SSDEEP:	24576:2ODivXdRxWmQOhfbV5l7kZLWfGPeu/PUw6WmARlXDMmH6PBzT/Cn+m4q:2OuvbfGZGGKJT/Cn+Fq
MD5:	4FF45827EC92E40935F9939142CD40DC
SHA1:	CAD74928F3387E6BF28C3625803706061E956B34
SHA-256:	012ED8D16E9F7586FE44C0AFFE5BEA6FF68F27231A6526D439643869A103E434
SHA-512:	A3DFE7976E5FFB4BA0C68E218C0924568D343E7937ABB50785107DE5E0ADC11AD58A86E02FABB455845FBE8E545E48B57A67EB647C664390ED521D255FF3BEFE
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...~/._.....................j...................@................................. ...................................{........3.......................@...........................................................................................text...0z.......\|.................. ..`.itext.............................. ..`.data...D...........................@....bss.....e...@.......0...................idata...3.......4...0..............@....edata..{............d..............@..@.reloc...............f..............@..B.rsrc................V..............@..@....................................@..@........................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\TDPINFO.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	7.484270190239562
Encrypted:	false
SSDEEP:	768:tUqX/E3rJA4ZX6xUrLGwk9xAlvcuHnYoq7MNC3Il:tUc/+vKGnax8ESY17WkI
MD5:	63F6D9FECB240388D69CB668CFE50C00
SHA1:	2B67BB8AA45A9D0383E76F15E631C1131B28BB1E
SHA-256:	678D6ED15F6150BFD5BA8E823CF877C32BB492E8557E107FAC77143DAD3724F1
SHA-512:	176B096493206D2DADB17D778E959855DEEF0EC8D5343C09790CA6C067A338ECE44138FA9081888CAA2228A041D2A8C71B085AD8FEFAFE479505F667F6D2B7E6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#;\.gZ2.gZ2.gZ2..F<.rZ2.Q\|8..Z2..Uo.bZ2.gZ3.7Z2.Q\|9.sZ2.gZ2.fZ2..E9.eZ2..E6.fZ2.RichgZ2.................PE..L.....lf...........!.............p..................................................................................0...l...........................................................................................................................UPX0.....p..............................UPX1.............v..................@....rsrc................z..............@......................................................................................................................................................................................................................................................................................................................................................................................................4.21.UPX!....

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\TDPSTAT.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388808
Entropy (8bit):	6.5956896905460125
Encrypted:	false
SSDEEP:	6144:B9su6Bohl2JJmgk1G8M0uQoRkQsKwxBF6CaSIU9ILZxxB5ARUWvAX+E:BSohl2JJmgk1U3QMkQsTx3paSIUixGRI
MD5:	B8253F0DD523BC1E2480F11A9702411D
SHA1:	61A4C65EB5D4176B00A1FF73621521C1E60D28EA
SHA-256:	01CEE5C4A2E80CB3FDAD50E2009F51CA18C787BF486CE31321899CCCEDC72E0C
SHA-512:	4C578003E31F08E403F4290970BC900D9F42CAA57C5B4C0ACA035D92EDC9921BF4034FC216C9860DA69054B05F98DADE5F6E218AC4BEE991BC37A3EF572FE9A0
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...8..^..........................................@..........................P..........................................c....p...........N...............<.......g..................................................Ts..P............................text...T........................... ..`.itext.............................. ..`.data....).......*..................@....bss....<X...............................idata.......p......................@....edata..c...........................@..@.reloc...g.......h..................@..B.rsrc....N.......N...d..............@..@.............P......................@..@........................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Toolbox.ico

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	MS Windows icon resource - 6 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	104864
Entropy (8bit):	3.9053747079480448
Encrypted:	false
SSDEEP:	384:0ePYp7777777777FaTLcbLLLLEW/+Z+Z+I1m5aaaaaaaaaMsJju5wU4XcG8jUEPE:n7sAacGgUEc
MD5:	6CCA9307DEAF7B167C92BBE3D2AC59CA
SHA1:	FE2A51B84BD203BA0AEA43D50D664B1632F3B0B0
SHA-256:	771E0C7FF0514650DF7C62E237A8D8DDFA2D156A8B18473AE647E6684A483178
SHA-512:	C1E4639BCFF0C18713116973524E7527BEE31307C33AF2048F617CE0460580A2FEE88FF6E347F87C799AC990F4BCCB97A2FCEBCB82AD4A926EE95F211A033368
Malicious:	false
Preview:	............ .h...f... .... .........00.... ..%..v...@@.... .(B...;........ .(...F}........ .2...n...(....... ..... .....0....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................v...w..w.........u...w..w..w..w..x.......\|...w..w..w...n...x...x...x...x...x...x...x...x...x...x...x...x...x...x...n...o...w...x...x...x...x...x...x...x...x...x...x...x...x...w...p...p...n..y...z...u...u...u...z...z...u...u...u...z...y...n..p.......p...s..w...w...w...w...w...w...w...w...w...w...s..p...........................m.p.p

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\UPSDK.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1165576
Entropy (8bit):	6.491752155251347
Encrypted:	false
SSDEEP:	24576:ptf4OLWmQQ3b6ZVtecP3Ufy/ilDqzybXIZ0xKHpWq0dGcz7msH0WQWmAdA7yJBzA:tLDlDgRGxKHpSJ28TU
MD5:	D75E14313FC8A0850F3190CE67509475
SHA1:	74474830BC0706E5C0A8B455A4E1B47D9F1DE741
SHA-256:	E5C711BDB99AB55EBD96B3636C7396566C98ACFFD03DF735A15F1E18936A718A
SHA-512:	A4260F1A9A77BC41FC54532BDBF51F831004767E08150BFF95374663930BBE4FCA81790AA4578C062674557A02A698EA798CFC00F2355F6B8FA71BF2915CBAAA
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......`..........................................@..........................0.......4...............................`..e....@..v........^...............A...p...Y...................................................C...............................text...x........................... ..`.itext.............................. ..`.data....".......$..................@....bss.....Y...............................idata..v....@......................@....edata..e....`......................@..@.reloc...Y...p...Z..................@..B.rsrc....^.......^...*..............@..@.............0......................@..@........................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\libcurl.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	333824
Entropy (8bit):	6.389952178495305
Encrypted:	false
SSDEEP:	6144:WyEhWbJNOcWd55OHSCw1ohITXVvrJGqdK2Dug6dGXLSuMAFi2TBfR:Wlu1IjOIohILJrc4Ezui2TdR
MD5:	EC9483F4B8C3910B09CAAB0F6CB7CD1B
SHA1:	9931AAA8E626DF273EE42F98E2FC91C2078FDC07
SHA-256:	4D9CAE6E2E52270150542084AF949D7B68300E378868165FF601378A38F7048F
SHA-512:	84B60FE3CD0EDE19933B37AE0EAEBA1F87174A21BC8086857E57C8729CEC88F9FEF4B50A2B870F55C858DD43B070FD22FFEC5CB6F4FD5B950D6451B05EB65565
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z..S...........#................ .............$k................................. ........ .........................c.... .......`.......................p..\|$...........................P......................."..h............................text...T...........................`.P`.data...t...........................@.`..rdata..L.... ......................@.`@.eh_fram............................@.0@.bss..................................`..edata..c...........................@.0@.idata....... ......................@.0..CRT....,....@......................@.0..tls.... ....P......................@.0..rsrc........`......................@.0..reloc..\|$...p...&..................@.0B........................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp100.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.297676823354886
Encrypted:	false
SSDEEP:	12288:koBFUsQ1H5FH3YUTd/df0RA7XkNvEKZm+aWodEEiblHN/:dFUsQ1H5FHdGKkNvEKZm+aWodEEcHN/
MD5:	D029339C0F59CF662094EDDF8C42B2B5
SHA1:	A0B6DE44255CE7BFADE9A5B559DD04F2972BFDC8
SHA-256:	934D882EFD3C0F3F1EFBC238EF87708F3879F5BB456D30AF62F3368D58B6AA4C
SHA-512:	021D9AF52E68CB7A3B0042D9ED6C9418552EE16DF966F9CCEDD458567C47D70471CB8851A69D3982D64571369664FAEEAE3BE90E2E88A909005B9CDB73679C82
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$..-`..~`..~`..~i.4~b..~{.;~c..~`..~...~..?~a..~{.9~a..~{..~P..~{..~Y..~{..~e..~{.<~a..~{.=~a..~{.:~a..~Rich`..~........................PE..d.....M.........." .........f.......q........cy..........................................@.............................................m......<....P...........=...0..P....`.......................................................................................text............................... ..`.rdata..-...........................@..@.data...0L.......8..................@....pdata...=.......>..................@..@.rsrc........P......................@..@.reloc..R....`......................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp110.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	661456
Entropy (8bit):	6.2479591860670896
Encrypted:	false
SSDEEP:	12288:akhiz9iVQi6mpiyMATITfluR3G1YdpTzYJQIbRdJN2EKZm+DWodEEt2L:WaQeIJN2EKZm+DWodEEt2L
MD5:	7CAA1B97A3311EB5A695E3C9028616E7
SHA1:	2A94C1CECFB957195FCBBF1C59827A12025B5615
SHA-256:	27F394AE01D12F851F1DEE3632DEE3C5AFA1D267F7A96321D35FD43105B035AD
SHA-512:	8818AF4D4B1DE913AAE5CB7168DCEC575EABC863852315E090245E887EF9036C81AABAF9DFF6DEE98D4CE3B6E5E5FC7819ECCF717A1D0A62DC0DF6F85B6FEEB8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.:..si..si..si~`.i..si..ri^.sis.i..si...i..sis.i..sis.i..sis.i..sis.i..sis.i..sis.i..sis.i..siRich..si................PE..d......P.........." ........."......<........................................p......L+....`..........................................3......l...<...............0E.......=... ..,....(..............................`...p............ ...............................text...:........................... ..`.rdata....... ......................@..@.data...p.... ...:..................@....pdata..0E.......F...D..............@..@.rsrc...............................@..@.reloc..FJ... ...L..................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp120.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660128
Entropy (8bit):	6.339650318935599
Encrypted:	false
SSDEEP:	12288:t2TOv4Zur4nRc4RwlG4xH2F+O+/i2UA3YyB2hxKM5Qrt+e2EKZm+GWodEEwIP:qRhxKM5U2EKZm+GWodEEw4
MD5:	0A097D81514751B500690CE3FC3223FA
SHA1:	7983F0E18D2C54416599E6C192D6D2B151A2175C
SHA-256:	E299B35D1E3B87930A4F9A9EF90526534E8796B0DEF177FB2A849C27F42F1DF2
SHA-512:	74639F4C2954B5959EB2254544BF2E06AB097219FC8588A4F154D1A369B0657176128C17911958C84ED55421FE89BF98C8ED36D803A07A28A7D4598DB88027CE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Ca.=...n...n...n..)n...n...n...n.R?n...n..%n...n.R=n...n.R.n4..n.R.nJ..n.R.n...n.R>n...n.R9n...n.R<n...nRich...n........PE..d......V.........." .....@...................................................`.......H....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp140.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	449280
Entropy (8bit):	6.670243582402913
Encrypted:	false
SSDEEP:	12288:UEPa9C9VbL+3Omy5CvyOvzeOKaqhUgiW6QR7t5s03Ooc8dHkC2esGgW8g:UEPa90Vbky5CvyUeOKg03Ooc8dHkC2ed
MD5:	1FB93933FD087215A3C7B0800E6BB703
SHA1:	A78232C352ED06CEDD7CA5CD5CB60E61EF8D86FB
SHA-256:	2DB7FD3C9C3C4B67F2D50A5A50E8C69154DC859780DD487C28A4E6ED1AF90D01
SHA-512:	79CD448E44B5607863B3CD0F9C8E1310F7E340559495589C428A24A4AC49BEB06502D787824097BB959A1C9CB80672630DAC19A405468A0B64DB5EBD6493590E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L....(.[.........."!.....(..........`........@............................................@A.........................g.......r...........................?.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp140_1.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31528
Entropy (8bit):	6.472533190412445
Encrypted:	false
SSDEEP:	384:R77JqjlI8icUYWhN5tWcS5gWZoMUekWi9pBj0HRN7RA5aWixHRN7osDhzlGs6N+E:R5D8icUlX5YYMLAWRAlypmPB
MD5:	7EE2B93A97485E6222C393BFA653926B
SHA1:	F4779CBFF235D21C386DA7276021F136CA233320
SHA-256:	BD57D8EEF0BC3A757C5CE5F486A547C79E12482AC8E694C47A6AB794AA745F1F
SHA-512:	4A4A3F56674B54683C88BD696AB5D02750E9A61F3089274FAA25E16A858805958E8BE1C391A257E73D889B1EEA30C173D0296509221D68A492A488D725C2B101
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..\4~.\4~.\4~...^4~.UL..X4~.Dz.[4~.D}.^4~.\4..v4~.D..Y4~.D{.O4~.D~.]4~.D..]4~.D\|.]4~.Rich\4~.........PE..d...W8.^.........." .........$............................................................`A.........................................>..L....?..x....p.......`..4....:..(A......p...@3..T............................3..0............0..0............................text...(........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..4....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcp140_2.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	193832
Entropy (8bit):	6.592581384064209
Encrypted:	false
SSDEEP:	3072:V7vC/HAiCsJCzwneNPXU7tm1hTt8KBDal8zg/0LwhORfewlMi0JHV:VTGAtweN85m1f8KBI9wfpsJH
MD5:	937D6FF2B308A4594852B1FB3786E37F
SHA1:	5B1236B846E22DA39C7F312499731179D9EE6130
SHA-256:	261FBD00784BB828939B9B09C1931249A5C778FCEAD5B78C4B254D26CF2C201F
SHA-512:	9691509872FDB42A3C02566C10550A856D36EB0569763F309C9C4592CAF573FBB3F0B6DC9F24B32A872E2E4291E06256EAE5F2A0DEB554F9241403FD19246CAC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........94..Wg..Wg..WgVt.g..Wg..g..Wg..Sf..Wg..Tf..Wg..Vg..Wg..Vf..Wg..Rf..Wg..Wf..Wg...g..Wg..Uf..WgRich..Wg........................PE..d...W8.^.........." ................p............................................... .....`A........................................ ..................................(A...........K..T........................... L..0...............P............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcr100.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcr110.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	849360
Entropy (8bit):	6.542151190128927
Encrypted:	false
SSDEEP:	24576:I+9BbHqWVFlB7s2ncm9NBrqWJgS0wzsYmyy6OQ:z9d7M3nS0wV
MD5:	7C3B449F661D99A9B1033A14033D2987
SHA1:	6C8C572E736BC53D1B5A608D3D9F697B1BB261DA
SHA-256:	AE996EDB9B050677C4F82D56092EFDC75F0ADDC97A14E2C46753E2DB3F6BD732
SHA-512:	A58783F50176E97284861860628CC930A613168BE70411FABAFBE6970DCCCB8698A6D033CFC94EDF415093E51F3D6A4B1EE0F38CC81254BDCCB7EDFA2E4DB4F8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........c.O.0.O.0.O.0.O.0}O.028g0.O.0?..02N.0?..0.O.0?..0.O.0?..0wO.0?..0.O.0?..0.O.0?..0.O.0Rich.O.0........................PE..d...n..P.........." ................l3.......................................@............`..........................................E.......1..(............... g.......=......8...`6..............................P...p............0...............................text............................... ..`.rdata.......0......................@..@.data...(q.......@..................@....pdata.. g.......h...(..............@..@.rsrc...............................@..@.reloc...".......$..................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\msvcr120.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963744
Entropy (8bit):	6.63341775080164
Encrypted:	false
SSDEEP:	24576:lQ39+j16xw/86yY4ZOVqSs8cKPkb3vi4vwW1kCySQmWymTXY:S3tPDLfRbiow9Cyo
MD5:	E2CA271748E872D1A4FD5AC5D8C998B1
SHA1:	5020B343F28349DA8C3EA48FB96C0FBAB757BD5C
SHA-256:	0D00BF1756A95679715E93DC82B1B31994773D029FBBD4E0E85136EF082B86A9
SHA-512:	85D6BCAAF86F400000CF991DA1B8E45E79823628DC11B41D7631AA8EE93E500E7DA6E843EA04EDB44D047519DABEF96DCB641ADC2A7B3FAA5CD01E8A20B1F18E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F=&^'Su^'Su^'Su..u]'Su^'Ru.'SuSu.u.%SuSu.uo'SuSu.uh'SuSu.u.'SuSu.u_'SuSu.u_'SuSu.u_'SuRich^'Su........PE..d......V.........." .....j...:.......)..............................................+l....`.....................................................(............@...s...v...>......8...p................................2..p............................................text...eh.......j.................. ..`.rdata...9.......:...n..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................`..............@..@.reloc..8............d..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\oDayProtect.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57456
Entropy (8bit):	6.555119730119836
Encrypted:	false
SSDEEP:	1536:h4WOg3TER/nhU8Vbbb8O0WWVYgaatjJxl:h4WOg3TSr78O0WWVYg5tJ
MD5:	00FCB6C9E8BD767DDE68973B831388E9
SHA1:	2D35E76C390B8E2E5CA8225B3E441F5AC0300A02
SHA-256:	1CC765B67D071060C71B4774C7745575775CE46E675E08620E5BAB3B21B2CE79
SHA-512:	2B48701B5F4B8F1EB7FC3EB9A76370883FE6CAF45D92DA607AB164F93E0EED65D6C1369D4EA974A112C902FD0F5BAF06E7611ECB9B50BE3A599F261624B33BA5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[..]..............3.....M......M......M......M.......{n......{k............................._.......7............Rich............PE..L...m>.d...........!.....`...R......._.......p............................................@...........................................P...............p2..............p........................... ...@............p..\............................text...._.......`.................. ..`.rdata...4...p...6...d..............@..@.data...$...........................@....shared.............................@....rsrc...P...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\vcruntime140.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	101872
Entropy (8bit):	6.5661918084228725
Encrypted:	false
SSDEEP:	1536:RCKWZGuEK0mOLSTxoPl9GIcuZrxi4hXX9oix8H+NCIecbGShwZul:RFWY1WxgGStJ8H2CIecbG36
MD5:	971DBBE854FC6AB78C095607DFAD7B5C
SHA1:	1731FB947CD85F9017A95FDA1DC5E3B0F6B42CA2
SHA-256:	5E197A086B6A7711BAA09AFE4EA7C68F0E777B2FF33F1DF25A21F375B7D9693A
SHA-512:	B966AAB9C0D9459FADA3E5E96998292D6874A7078924EA2C171F0A1A50B0784C24CC408D00852BEC48D6A01E67E41D017684631176D3E90151EC692161F1814D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........w.............t:..............................................................Rich....................PE..d.....t^.........." .........^.......................................................e....`A.........................................0..4....9.......p.......P.......L...A..............8........................... ...0............................................text...2........................... ..`.rdata...?.......@..................@..@.data...0....@.......4..............@....pdata.......P.......8..............@..@_RDATA.......`.......D..............@..@.rsrc........p.......F..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\BtDDIFUEHLCR\yybob\vcruntime140_1.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44312
Entropy (8bit):	6.623047237297825
Encrypted:	false
SSDEEP:	768:vG3xRsJTKdiibUoT2zvivbXXyJWqWZ8DZX:vG7DyM22DiJMCtX
MD5:	9040ED0FDF4CE7558CBFFB73D4C17761
SHA1:	669C8380959984CC62B05535C18836F815308362
SHA-256:	6CC4315DACEB0522816C60678344466CB452426267F70C7FAAE925361674E774
SHA-512:	303143006C781260540E9D0D3739ACC33F2D54F884358C7485599DD22B87CCE9B81F68D6AD80F0F5BB1798CE54A79677152C1D3600E443E192AECD442EA0A2E4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........j&=..Hn..Hn..Hn@..n..Hn!fIo..Hn.s.n..Hn..In..Hn!fKo..Hn!fLo..Hn!fMo..Hn!fHo..Hn!f.n..Hn!fJo..HnRich..Hn........PE..d....h.].........." .....:...4.......A..............................................?.....`A.........................................j......<k..x....................l...A......(....a..8...........................0b...............P..X............................text...t9.......:.................. ..`.rdata..P ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..(............j..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\VGXlong.sys

Download File

Process:	C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe
File Type:	data
Category:	modified
Size (bytes):	28024
Entropy (8bit):	3.654385616324733
Encrypted:	false
SSDEEP:	96:BFvjF9WYdsCXJbXqzqcihX+qrgD+aKOd2VtFGynjIFUYC9x5rxM9PjAl6eIEYj/s:j5W2llQobHoU74xuJBGqc0If+lB
MD5:	56ED532099434370FDB616E2C0E17462
SHA1:	11FDFB4890723035F83809F5EE32AD8105D971DF
SHA-256:	0AA158839F11182C42C79FBD3FA65E0C4C08874A35FF3F9CE1B40AB86D943551
SHA-512:	20A37B68C05804EB1F9B2DD8CC9BE3C681FC89599B65B453804A52AF48D7F4140B5FDBC46AB957FAC606D16ECA274BA6BF28BABA8FAA495F94ABD3358E61464C
Malicious:	true
Preview:	....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.5.-.1.-.6. . .2.0.:.3.:.2.4.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.5.-.1.-.8. . .2.0.:.4.:.2.3.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.5.-.1.-.9. . .2.0.:.4.:.5.3.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.5.-.1.-.1.1. . .2.0.:.5.:.5.3.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.5.-.1.-.1.2. . .2.0.:.6.:.2.3.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.5.-.1.-.1.3. . .2.0.:.6.:.5.3.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.5.-.1.-.1.4. . .2.0.:.7.:.2.3.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.5.-.1.-.1.6. . .2.0.:.8.:.2.3.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.n.a.g.e.r.....[..e..:.].2.0.2.5.-.1.-.1.7. . .2.0.:.8.:.5.3.....[..Q.[:.].....[..h..:.].P.r.o.g.r.a.m. .M.a.

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\DAN_127.msi

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 936, Revision Number: {FF04FCEE-D135-4246-945D-4A9D97099E64}, Number of Words: 0, Subject: Windows, Author: GbLXGXDAPUOD, Name of Creating Application: Windows, Template: ;2052, Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3592192
Entropy (8bit):	6.5363078562423516
Encrypted:	false
SSDEEP:	49152:vfplGFAvHZXm1+akq2+cZfsZlA0OO62wOR4UkrfH1OrEMBZX26PH2ca7G/uaJEi2:pkFALq3pOwkP2uayisdSHis
MD5:	ED11B37D4C599EBFCB24123B6F35648D
SHA1:	01517B47E325ACFFFB38532D7E0CB152D0667952
SHA-256:	F68D10ADAB342777B36CE77B064952C1D0E5309B070D1D51DED7AAE092AA5432
SHA-512:	67280F74E10C05166735EEE0B1CB2A44A3083E7E5E3800B410C43349A22DBBCD99BDBE9E9E477FEA5EBA97E80B4D35DF473E88881728466EC3F79A43C2F83221
Malicious:	false
Preview:	......................>...................7...................................R...S...T...U...V...W...X...Y...Z...[...u.......\|.......................................................................................................................................................(...)...*...........................................................................................................................................................................................................................................m.......................4...7................................................................................... ...!..."...#...$...%...&...'...(...)...5...+...,...-......./...0...1...2...3.......=...6...8...J...9...:...;...<...@...>...?...G...A...B...C...D...E...F...Q...H...I...n...K...L...M...N...O...P...................................................]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\Gme.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	400480
Entropy (8bit):	6.6249170967240625
Encrypted:	false
SSDEEP:	12288:ke/EYk6LSMAROeK3nzAPSayAj7+fyJHbVJMs/ubUQ3Q/p:MQ7DAvhpGs/8UQ3QB
MD5:	CC4F1CDFA6A90B6152B8012E8C035DFD
SHA1:	011098BADE1BD47557147B8CF3BAF4A070CB9D7C
SHA-256:	7B9FF465FA54E5EDF69F0794D7CAF7ADC6D7B20534E6DA0181DC93DC062E7CCA
SHA-512:	0084BADEBBAC672904BD7E19019C2D86B4745DEA26229CE82E48E0A5134DF3FA42B4948C673B17432BFE14F13A82B0BAFF3B5D861AA4AB3A951AF40793780CE1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........_..N>.EN>.EN>.E.qXEM>.EGF[ET>.EGFJE.>.EGFME.>.Ei..E[>.EN>.E.>.EGFDEg>.EGF\EO>.EPlZEO>.EGF_EO>.ERichN>.E................PE..L.....rZ...........!.........*......?#.......................................P......j.....@..........................m.......^..........x................5......H3..0...................................@............................................text............................... ..`.rdata..d...........................@..@.data....q...p...6...Z..............@....rsrc...x...........................@..@.reloc..PM.......N..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\GmeApi.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	427104
Entropy (8bit):	6.602064716561835
Encrypted:	false
SSDEEP:	12288:d54WjgpIW+m/CbqwcAjoZOtjEipBiRuL9JK:avGPJbtjEY2uL7K
MD5:	50B836C0E21FD4EF3F6F6102F9162FEA
SHA1:	704834D4BE32AD186FD761E908CC0518AC2A8117
SHA-256:	8CFC18609E75074EB0FBF3C87C1B41E263DE503083A7EBBB00643E0F05A2920E
SHA-512:	B2C220F954A38B7EBC44FA60454CD8322A21714F1E3D593F32B7C4865113157965E1C8C0821F60F1865270FCB2529EBF8CDD32F1DE44A7626C0D0DB304C72644
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.p...#...#...#..T#...#..W#...#..F#Y..#..A#...#/V.#...#...#...#..H#:..#..P#...#..V#...#..S#...#Rich...#........................PE..L.....rZ...........!.........F.......c....... ............................................@.....................................x....@...............N...5...P..88..."...............................k..@............ ...............................text............................... ..`.rdata..r.... ......................@..@.data...Dm.......6..................@....rsrc........@......................@..@.reloc...Y...P...Z..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\GmeApi64.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	572512
Entropy (8bit):	6.263529853370218
Encrypted:	false
SSDEEP:	12288:Azb0JSwmBU/no1rNW23dImf/D/cnlu41T3ork5d:AH0JSwmko1rNW23df/D/cnlhp3d5d
MD5:	984829AFB3ED76FABCAB8AE4BE1FF15C
SHA1:	2498F20AB62E3061FB144C7CEAE5CF254D6C7095
SHA-256:	F257E86E42D7546C37AEABDC7BF1D00BC09E7B26D9AF4478302FF2B872187C33
SHA-512:	5270AE482E8C462B5360DD60C06D8757BE5F7E513A0A7BF993F3F088A67516AAA0A744CDBD034828D3AAF5E6EADAF630317ACF325B03E028398C7EAC12A97B04
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i...........BG@.....pC.....pR.....pU.L...........f...p\.....pD.....ZB.....pG....Rich...................PE..d.....rZ.........." .....F...:......,T...............................................V....@.....................................................x............p..Tf.......5..........pe...............................................`..X............................text....E.......F.................. ..`.rdata..Tx...`...z...J..............@..@.data............@..................@....pdata..Tf...p...h..................@..@.rsrc................l..............@..@.reloc...............r..............@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HackPatch.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	572312
Entropy (8bit):	6.6114481461607175
Encrypted:	false
SSDEEP:	6144:KmuYzDRB54CwW2U0lY4woeFuA0TpxVQ8Y3Ew+zBsPO3erF7q0zoCiJbDjdxzF5og:Ju+469PqNYsBsPTziDjLbCEGne9Z
MD5:	5CC95EA39AB6D7751A1A85F832CCA011
SHA1:	387B60FE4F257BA8A0F5DA566709640F972EAA3B
SHA-256:	4BF5DD0ED84D6C7B4965628A22668F733C167427B20A4B56AE356205381B527F
SHA-512:	6E28E6D3D1A6BF4FB046A7F03F68FE27F8A7151465412EA4126AD3DD2A9DC9C89238923E858C644892D72D318CF2112C4AE60DAE363CC5EC41DEF1663BFDD101
Malicious:	false
Yara Hits:	Rule: Mimikatz_Gen_Strings, Description: Detects Mimikatz by using some special strings, Source: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HackPatch.dll, Author: Florian Roth Rule: Mimikatz_Strings, Description: Detects Mimikatz strings, Source: C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HackPatch.dll, Author: Florian Roth
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^.^.?g..?g..?g.=Nf..?g..ac..?g..ad..?g..Yb..?g..Vf..?g.=Nb..?g.<Nb..?g..G...?g..Ya..?g......?g.!ab..?g.!ac..?g.>ac..?g.>ab..?g..ab..?g..Yc..?g.....?g.....?g.H0:..?g..Yf..?g..?f.5=g.!an..?g.!ag..?g.!a...?g..?...?g.!ae..?g.Rich.?g.........................PE..L....Enc...........!.....,...\|...............@............................................@.........................`p.......q.......0...r...........r...I......dK......p...............................@............@...............................text....*.......,.................. ..`.rdata...T...@...V...0..............@..@.data...D_.......$..................@....gfids..............................@..@.tls................................@...PlugImm...... ......................@....rsrc....r...0...t..................@..@.reloc..dK.......L...$..............@..B................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\Hamster.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	249768
Entropy (8bit):	6.601810977306283
Encrypted:	false
SSDEEP:	3072:/0jvJ1SDHfvcFHDSU4/eebh4HT4dK62HPWA2F0T7z/LDdUjE2rRNq5N5EuXCRfC:/0jTSrMtceebhz32HPWnoBUw2/G5r
MD5:	2EA3ACA1D36D16F0699261F77EE6ECCE
SHA1:	31C6575F5EC4F48ED3939FD5484F4E3D5869D3DA
SHA-256:	12B2AAA9C7222B13E97A0870006CFC498134F7182009C49FAD0281A85D5CD386
SHA-512:	30057B3491807413603C5A4668D020A384548CE6F41BA9DE6C708C4BF052BE10113AE5AAF41697ACC2AB56E9674EE8DC4669584FA9F838A9359842038F82394E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;...U..U..U.....U....9.U......U.*...U..T.'.U.....U.....U.....U.....U.Rich..U.........................PE..L..._wWX...........!................................................................,.....@..........................M..R....B..d.......l................5......8...`...............................@...@............................................text...o........................... ..`.rdata.."~..........................@..@.data....H...P...,...6..............@....rsrc...l............b..............@..@.reloc...,...........j..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HipsLogCenter.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	555240
Entropy (8bit):	6.523642703236138
Encrypted:	false
SSDEEP:	12288:RzJibra10t6DBAAxFhNngOsLOsZDvnCjN8d6HVilI5hKRPnQ0FbgB4e:CbzipngOsLOsZL38IKb4PQ0Fbje
MD5:	4B481EA28EC7B065AD6C7FE7674AA363
SHA1:	152FC3DA4A1DF717623E4D57476A1D72ADD7F610
SHA-256:	92AA7045E70E2BBB706DCD1A1D9B41026CFA06FEDF0E48EE0CAE63B8B80084F5
SHA-512:	08F8388322D3623F8DBC23DB60E0542B972754FEAB4071C0FC7382F9EBD54313A8A10E5EBAC9D72E5F4909B23A2FCB4114B44BCF47F3090B029DDEA27CFF21B3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\O..=!..=!..=!..E...=!.Kr...=!..E...=!..o...=!..E..b=!..E...=!..= .<!..E..=!..E...=!..o...=!..E...=!.Rich.=!.........PE..L......d...........!.........V...........................................................@.............................w............................L..P,...`..4C..................................8v..@............................................text............................... ..`.rdata..............................@..@.data...\........j..................@....rsrc................@..............@..@.reloc...Z...`...\..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HotfixCommon.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	180800
Entropy (8bit):	6.720835675786583
Encrypted:	false
SSDEEP:	3072:zQPGqss58Kg5dqBLQ8/90/qTQPOfb7+sH1buHv/c6R2Wmjgk4Kq2iSiTHa89B:zQPB4jqBLQ86qsPOf+8RuHXc6tmv4KqZ
MD5:	91D9E316BD0533C92BDE234131EC7AB4
SHA1:	86D1997382E3FE81AC27B88EFE33E1773D095518
SHA-256:	62BAAD0A128B580889091F015384410BD491F21BB101682557B034ACB28E00D9
SHA-512:	BDD41A900EB1299815CA24FD78EE5499F20C78C5E62CAF11934A5348836C557AB402DF1D75B4932AA6E322562C8CDEBB120FC74137ED9D693AE6719C44C5718F
Malicious:	false
Preview:	MZ......................@...................................x...........!..L.!This program cannot be run in DOS mode....$.......N .'.A.t.A.t.A.t..zt.A.tX).u.A.tX).u.A.to'.u.A.t.(.u.A.t./.u.A.t.9(t.A.t.,.u.A.t.,.u.A.tK&.u.A.tK&.u.A.t.(.u.A.t.(.u.A.to'.u.A.to'.u.A.to'.u.A.t.A.t.@.tX).u.A.t.,.u.A.t.(.u.A.t.(.u.A.t.(.u.A.t.(Bt.A.t.At.A.t.(.u.A.tRich.A.t........................PE..L....@W^...........!................................................................i....@.........................p'......x(..x........................7..........@...p...............................@...............8...x#..`....................text............................... ..`.rdata..tD.......F..................@..@.data...h....@......."..............@....detourcX6...`...8.................@..@.detourd$............b..............@....rsrc................d..............@..@.reloc...............j..............@..B................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\HotfixCommon64.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	219200
Entropy (8bit):	6.255426513524174
Encrypted:	false
SSDEEP:	3072:n7pWDP71+xRSkTt9XFD6RAtofSUAfohtDanx51K6flyT9S9:1WDP71+xR7h9XFBtofStomfK69e9S9
MD5:	C64D91E0734622D550F578CAC023FE9B
SHA1:	9B5F47305F02ED862BE6A8E6F6D48647F9311E84
SHA-256:	9AA97B67D074D85CAFB29A0A561DFAA2416A283FC8A228B6904D63D16C8C463B
SHA-512:	FD419DE7FBC7C0B9F33CD340E2DEF67849DF628799FC0507DFEB6F77DD8681232B81216D082155278EC7D158E99FB480EEAC884A8962F410321F91A89D500CBD
Malicious:	false
Preview:	MZ......................@...................................`...........!..L.!This program cannot be run in DOS mode....$........-...L.E.L.E.L.Er.^E.L.E.$.D.L.E.$.D.L.E..D.L.Et%.D.L.Ev".D.L.E.!.D.L.E.!.D.L.E.+.D.L.E.+.D.L.Ev%.D.L.Ev%.D.L.E..D.L.E..D.L.E..D.L.E.L.ERM.E.$.D.L.E&!.D.L.Ew%.D.L.Ew%.D.L.Ew%.D.L.Ew%fE.L.E.L.E.L.Ew%.D.L.ERich.L.E........PE..d....AW^.........." .........$...... .....................................................`.........................................0.......8...x....`............... ...7...p..T...PO..p....................O..(....'............... ......0}..`....................text...0........................... ..`.rdata...q... ...r..................@..@.data................x..............@....pdata..............................@..@.detourc.h.......j..................@..@.detourd@....P......................@....rsrc........`......................@..@.reloc..T....p......................@..B................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ImAVEng.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175728
Entropy (8bit):	6.544553321577818
Encrypted:	false
SSDEEP:	3072:ix5UgqxBe84iqhlPyKc4pquYWWM1qOrlhPzc8ylmyK5WodzzDi:i4pgbzTYWRZHrc9lNQzq
MD5:	B8FDC03B9B84A62C5C541524DCA2E723
SHA1:	5643ADAE63CA199F9C44A35F3B30947A0F8B6D21
SHA-256:	1F6F3DADCC4C3096EEBFB5CE5DB979755ABA5CEB9DB18E6CA6238F05B45E5F4D
SHA-512:	A31708C251967D484F242BE658E92E94D87671294CD2C959276EC3B739D46F3FC7D1140CC8F78640DBD9970EC2176633E67DD079A3182ACDCE0FA8A7DE366637
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........}.G...G...G...N..U...N..=...N..~...`a~.F...`ah.L...G......N..R...N..F...Y...F...N..F...RichG...................PE..L...2..T...........!................q.....................................................@.........................@`..U...pT..x...................................p................................>..@............................................text............................... ..`.rdata...`.......b..................@..@.data...@7...p.......N..............@....rsrc................h..............@..@.reloc...'.......(...n..............@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\LeakFixHelper.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	313952
Entropy (8bit):	4.32348576044483
Encrypted:	false
SSDEEP:	3072:7cxIVD6kUS+hV/EENZH3JzJPlZ4k5O0f+BC9vCfFL:ooehV/pJzJPHM
MD5:	A88A6FFF171F7FECF8668DA1EFC843DF
SHA1:	E4C8B375BBECF5790B2B0444B049CCE11659D598
SHA-256:	34CCCEC093F5711D1202F54BFE8756E093E4F84099EC7D609AB9658C3C941921
SHA-512:	808F6E217F5E157663E66B46429636C4D811ACA7C5672EDD1B003377BB4A039265B4FB905B4ADE39D81B3E64E7793BE8278454155E8BD2EE92FB5B6F919563EE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................l.......z.....h...............}.......s.......k.......m.......h.....Rich....................PE..L.....4Y...........!................e ..............................................'H....@.........................`...K.......<........................5..............................................@...............\|............................text...M........................... ..`.rdata...N.......P..................@..@.data...........j..................@....rsrc................`..............@..@.reloc...*.......,...f..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\LeakFixHelper64.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	362400
Entropy (8bit):	4.208790369342181
Encrypted:	false
SSDEEP:	3072:ZGlYJdSi2t2SwbVGMuyic94uxJmXs/wIb8n9ssWy5cdJEnpOwD7A51B8BLRPrB:0lYXSi2ttqWc/PYOy5cQnpOS51
MD5:	3D01B2B5288974E922B6417FD3B02373
SHA1:	5649D3E7E15D1BF707CD7C28FE9931E5620EE9ED
SHA-256:	B438EF547753F91577730FFE9321563E7DD4ABBCBF056ADEE3C49906FC1EABD4
SHA-512:	F0C0EEBA22F33A4C596FF1272D681E7A349AB60112FD0AF5C75E07F065F35525C332270DE0ECC171D0B4BF53C3BC79C4E40BAD0EF1A0418A2D5DE882765D2FEC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........\|.\|\../\../\../Uef/(../Uep/V../{./Q../\../.../Uea/i../Ueo/W../Uew/]../BOq/]../Uet/]../Rich\../........PE..d.....4Y.........." .........F......lz...............................................f....@.........................................pm..M....b..<............p..\|....F...A.............................................................. ............................text...L........................... ..`.rdata...].......^..................@..@.data........p.......\..............@....pdata..\|....p.......&..............@..@.rsrc................2..............@..@.reloc...............8..............@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\LiveUpd360.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	647184
Entropy (8bit):	6.591959886632138
Encrypted:	false
SSDEEP:	12288:I/8iKgqct1l8h5H/30CrYXUjniBZoStkf0EOl/mvxxXiINkYF69+:NbhV0gMYnigStkMEMSxXrmYF69+
MD5:	960B05116F13AE8E8B17A6BA2919BF2D
SHA1:	D1A58D1F65272198D0A6657B06FAE6D27F1E156C
SHA-256:	00354506D4F1DD6A1FDF9450CA4A8E799A5A420A1A47BA3E41D7B30D8D02440A
SHA-512:	7A05E3178ABB8F92AA3A61F8A3156C87BD46F03F12D8EFC6CC1FEEE36B2508816E761BF6A3385BBDA2DD16EA3AB9CB4A5B899C3D844257811F0B3D9C4464713B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............`..`..`....`.i/]..`...^..`...H.%`...B..`....`..`..`...O..`...Y..`..2_..`..`\..`...Z..`.Rich.`.................PE..L.....b...........!.........................................................@............@.................................(...........................xC.......N.. ...............................X...@............................................text.............................. ..`.rdata..C?.......@..................@..@.data...8........2..................@....rsrc..............................@..@.reloc..<d.......f...4..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\MiniUI.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	921160
Entropy (8bit):	6.7626587126151065
Encrypted:	false
SSDEEP:	24576:nJtdTUbI0Ig/fMiK6hRN/IgOoWtT9nQnap:nJjUbIU/fPHhrIgBWtTFQnap
MD5:	5123C3B8ADEB6192D5A6B9DC50C867B1
SHA1:	6D142074A21AA50C240CE57CA19A61E104BBDF41
SHA-256:	273CE954C8D33ABAAC3A0FD8546719F09718C1D91317ECF5B99181DFFA3FE26A
SHA-512:	067305A8F09C480FE4A4C8609638C9A490C4EBE2782BD13C10B380DF14F76D4748EB785F44E7BCB86514718F99D07C3C6A4B43928A294B18020CB0FA589EE2A0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........S...2...2...2..f}M..2...JN..2...JR..2.......2.......2...2..3...`_..2...J_.y2...JX.%2...JI..2...`O..2...JJ..2..Rich.2..........PE..L...h..Z...........!......... ......Q........................................ .......G....@..............................................................7...P..$....................................'..@.......................@....................text............................... ..`.rdata...].......^..................@..@.data...X.... ...X..................@....rsrc................j..............@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetDefender.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	451480
Entropy (8bit):	6.641728581015286
Encrypted:	false
SSDEEP:	12288:c2qfhIic6ZYk/UxdGhZi1MVv2MIbvweYsoOzpgseJUnv9it:c2qfGhz/qgodsoRenv9it
MD5:	2C63554380D33E2AB153CB285E72C2F8
SHA1:	1EDE14CA4003AE639AA80E2F4E90558DD1A49A7A
SHA-256:	F77F9AFB3459F2D2C8FB0354317A0353ACBBF6D31988597775ADCD9AB0D80BA1
SHA-512:	96F951089D907F635AF5A517AAF53FD13064ECA471DC4440B8C67147A91F11043043F102814C2E6DE8933F81F30D6AFFFCC073BF98670A8D52A5518AD89646B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........`.q.3.q.3.q.3B>.3.q.3...3.q.3...3kq.3..3.q.3..3.q.3.q~3.q.3...3.q.3...3.q.3...3.q.3.#.3.q.3...3.q.3Rich.q.3................PE..L....tc...........!.................}..............................................D.....@..............................................................I.......7.. ...................................@............................................text.............................. ..`.rdata..o^.......`..................@..@.data....w.......2..................@....rsrc................*..............@..@.reloc...Y.......Z...>..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetDiagDll.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	337736
Entropy (8bit):	6.495942481063909
Encrypted:	false
SSDEEP:	6144:g1wCwn8QI2fm53Nx4Lj23TIae3m7jwyhb/7hjW7iBH+ljFx5mcvbKr:gmnckm5dy63TRe3XyhbNjWep+ljFx5R
MD5:	22C3095414CE54C8405225E3BCAAE591
SHA1:	9F0515A564B5077F49AACE011E84AF51F9973F32
SHA-256:	B734DB11E973318D728FE92E112639AE5B8876C855E6507315C707D04D3E0746
SHA-512:	2BE22658A038F8061B398489C357EFBA0F920FA24655A53650593D4924EE565E445D3A7CFD2C9689BC3A79E8355157004640E49B0249FCA63B3EBE11726D42A8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T...T...T....{.V...].x.M...].n.....].i.....T......s;..O...].g.G...]...U...J.y.U...].\|.U...RichT...........................PE..L....fgS...........!.........(......~........................................`...........@.............................U...l....................................,..`................................S..@............................................text............................... ..`.rdata..............................@..@.data...8Z.......0..................@....rsrc...............................@..@.reloc...A.......B..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetSpeed.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499432
Entropy (8bit):	6.633998530829339
Encrypted:	false
SSDEEP:	6144:2gz1k3fKRVIpJcADwPkUeKvd8C/RxC4MwYXlHUCMJ/TBJnt8KZ0Se+4xichK4:tMfKRGJc1tnPC4MwYXVl4/Trt8K61s2
MD5:	049791828DE05D24D29EC9C8687F8B1A
SHA1:	2B6D787EB078DFAE0C6718A9D99D06CEB01FB273
SHA-256:	D418DDA34640521B8695642C7A7E719F173F706472617CFF4ED343FB68211862
SHA-512:	7E36019A163F55932F95D33FACB216B69244DC8D5506CFD1D2E707A736AF448D7A4F78ABEAF85CF0F42E4E18B7EB1D330A9788F73773E6BE23A61C6B2981136F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............a...a...a.......a.......a.......a......a.......a.......a...`.D.a.......a.......a.......a.......a.Rich..a.........PE..L......c...........!................................................................\|.....@.............................a............p...............r..P,......@F.................................(q..@...............`............................text...E........................... ..`.rdata...G.......H..................@..@.data...Xp.......,..................@....rsrc........p......................@..@.reloc..\|d.......f..................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\Netgm.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	343784
Entropy (8bit):	6.490658338748216
Encrypted:	false
SSDEEP:	6144:rFp+cWO/EibdFr0Zv7U7bAb1qi8JU0Wexe/1Yd02Y+VZRg43r:rFMcWO/Eib3r8jU7Q1qi860WexexEGe
MD5:	6E5F6B4D49768E131EF614DD07E5EFA5
SHA1:	DBA90982727A9373C8D97E72500D89814184C7B6
SHA-256:	EE326C156144EB89DE76C21C66BDA10BD22922B1A9C85615CACEE84DF355604C
SHA-512:	12FF45D6F469B577E74A62B866DAE2A879751654A6627250286E3CC4F319411FE901155347DA762010F373BBEB46F2BD95E0428893242EE4707BEFA7312CF92D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............o..o..o... ..o.....o.....%o..=..o......o....o....o..o.._o.....o.....o..=..o.....o..Rich.o..........PE..L....P.d...........!.........d...............................................p....... ....@..........................Q.."....@...........Y..............P,... ...*..0...............................x...@............................................text............................... ..`.rdata..2...........................@..@.data...._...`...2...@..............@....rsrc....Y.......Z...r..............@..@.reloc...C... ...D..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetmLogin.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	533600
Entropy (8bit):	6.567835943059589
Encrypted:	false
SSDEEP:	12288:OgmCH8ZkhmmpKJiv/Dn5EWomaMIhEKf3Io7fknS52:Og58GnOthL/I1nW2
MD5:	5D7B815A95164AFB4A8E35240644793D
SHA1:	3AA5BFB8B2EE68C33BEB3190480CBE0149C29A96
SHA-256:	1158A8B493FC607354DD21E5A601760C082C00EB8B69E839E17E4A198C807418
SHA-512:	95E06406294258A3F81446A17E5CF67A02EFCDB0DA257F32ECD5B48D3F00B9BE628E2F82C04856191CDFDE02474ABC62D64D4A200164D7F6149993E548C8A335
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+.o.o...o...o......n...f..w...f......f..!...HTz.~...o......f..$...f..n...q...n...f..n...Richo...........................PE..L......Z...........!.....F..........'........`...............................`......v.....@..........................U..P....G...........................5......LJ..@c..................................@............`...............................text...iD.......F.................. ..`.rdata.......`.......J..............@..@.data....r...`...8...B..............@....rsrc................z..............@..@.reloc...k.......l..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetmTray.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247016
Entropy (8bit):	6.914297747665078
Encrypted:	false
SSDEEP:	3072:LQvXrZQoI8GHJg9bb9wv/cZD9Da5TUUQJYlCXbKJOZwFSYG0GTO/X3/mCP0V:kFIZgXwvkZqUpJRGOZwFVG0X/mXV
MD5:	5B4C825671418F34D95EC1F7BB55FFA1
SHA1:	C0AA182B281EDB4F06BDC98D7CF413AF948AB50A
SHA-256:	AA51AE325D53D586532145E0C6E702247654502C0349C5FC570D7155353B045A
SHA-512:	BEC6D76883BF786F93BCA0E32A36CF21002D5E1CDC1C098628D9D50D1E8E40B0E44C6AAA07DD8B503ABA5B638D44CBFAAF6C4BFB0E9F6C8F49470D7664432F73
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..#...p...p...p..ap...p..wpv..p..pp6..p/1.p...p...p...p..~p+..p..fp...p..`p...p..ep...pRich...p........PE..L....B.e...........!.................$....................................................@.............................]....i..........x...............P,..........`...............................HM..@............................................text............................... ..`.rdata...q.......r..................@..@.data....N......."...p..............@....menu_sh............................@....rsrc...x...........................@..@.reloc...2.......4...b..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetmTray64.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	290024
Entropy (8bit):	6.537709606383622
Encrypted:	false
SSDEEP:	6144:AhEzpelia8VSPgFmHKbDNATfCfzWNunIj1EpJRGOZwFVG0SJK:AhSpelaSPXMmLC7W4iOZYG0n
MD5:	0F15D28EB4CCD9DADFEC0305BF5F8E2A
SHA1:	04DE9FA6736978FDEFA031082C58FFCD0169861D
SHA-256:	F06872A9A6A6AFB4FEA670385694EA364F271705FB89B09E4390E95752A98F25
SHA-512:	955B8C3F383C66B4249510A20890C856994F2F4E9FA40C374B472B9E19AC2441A86BE67249F13E1F624AAF2F03D0F6A73F69A0E3D73178F2FC39843382D1041E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5...q..Hq..Hq..Hx..H...Hx..H{..Hx..HN..HVT.Hl..Hq..Hl..Hx..HR..Hx..Hp..Ho..Hp..Hx..Hp..HRichq..H........PE..d...7B.e.........." .....L...........]...............................................L....@.........................................."..]...0....................#...@..P,......P....h...............................................`..@............................text....J.......L.................. ..`.rdata..M....`.......P..............@..@.data....j...0...,..................@....pdata...#.......$...@..............@..@.menu_sh.............d..............@....rsrc................f..............@..@.reloc..L............2..............@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NetmonEP.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	160584
Entropy (8bit):	6.648758970829866
Encrypted:	false
SSDEEP:	3072:ABDE5pe7xyshJiszc1TLQXDNxLYeW54C:Aip4ysYTLcXP
MD5:	EFEBB6F93832D5A7EEF3BD4EB81D4A79
SHA1:	9A75E55A08422E7B6A7D695EBB0F61589B31005C
SHA-256:	542928806DE9A653C52250A0AB3D7847EF9249C195C00B82E5BDEB066AE6D2DF
SHA-512:	D9F276F0556539739289585B55482034BDF99F0C18917720F1AB84B870DDA3E303792CD4DF85183155BFFF8DA174EFBE8A74506197B268D632BA6916AF00E521
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>...m...m...m..,m...m..=m...m..+m..m.Y.m...m...m...m.."m...m..:m...m..<m...m..9m...mRich...m........PE..L......S...........!.................`...............................................................................*..V.... ..d....`...............X.......p......................................p...@............................................text...I........................... ..`.rdata..VJ.......L..................@..@.data.... ...0......................@....rsrc........`.......4..............@..@.reloc.......p.......>..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\NotifyDown.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	549488
Entropy (8bit):	6.736896619735914
Encrypted:	false
SSDEEP:	12288:XLgRCEprkKZlVgTndpHpTVWDQZNrHIGUYmHASzK8BnWToS09:7gAEprcnLVADQbzIGHmxK+WTO
MD5:	14274CF241144895CA05CD456197F573
SHA1:	4D4009B0A2F7BA56C6C98DC823C41085EF4712C7
SHA-256:	113562BF950B39E9466E8F646C84AAA93F6B2C89530F56913B0B36E0096239A0
SHA-512:	5A8009D935EB59B10523494C6C9D0A79FD29B0FA41CBA046E9CCC60A8D2EBA05CCC23D881E121A4526371E21B7C9DB6CC62783E1A5ACAD019705970C9F52091E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............y..y..y.....y.x...y.....y..J...y..J....y..x.P.y.......y.......y.....y.....y.....y.Rich.y.................PE..L....u.T...........!.........@............... ......................................j.....@......................... q.......R..T........Q...........L.......`...M...&..................................@............ ...............................text............................... ..`.rdata...R... ...T..................@..@.data....z....... ...^..............@....rsrc....Q.......R...~..............@..@.reloc...x...`...z..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\Ntvbld64.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	MS-DOS executable PE32+ executable (DLL) (native) x86-64, for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	42976
Entropy (8bit):	6.2171815555231875
Encrypted:	false
SSDEEP:	768:iHfqCaczo/ZinYCOd9L9KyhaM7JubDGpZRKjKj9MPgkU7:8fqT/ZWY/L9l7JheMJ
MD5:	671F95CAB2B5CF121125413F250F5275
SHA1:	73D99D09A3D8978A5C6DB43CEC85FB43B03B7A26
SHA-256:	728A1FCDEDCA6DBD8FDDDE3F33CD64DD99853C26EF5B10D3FEF0D76D0480964B
SHA-512:	4AF690AF838CEB026636931AEDE3852EAE6D83881149EF4C28CC1DD032C3F7F6A64B30171C2524512FACD40496DAB305523D20637B44EFBF0D5805D0FAD1FFCB
Malicious:	false
Preview:	MZ!..... ..........e..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ntvbldDXML..$............!.L.!.........`......................................................................Rich....................PE..d.....a.........." .....H...".................p..........................................@.........................................pV.......S..(.......h....p.......h..H?...........................................................................................text....F.......H.................. ..`.data........`.......N..............@...

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\PDown.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	253456
Entropy (8bit):	6.554744612110189
Encrypted:	false
SSDEEP:	6144:OpoEWHpLJeJ8MvIucm/334RStKp7Tu975:vEsLJeJ8MvPcm/30u975
MD5:	637FB39583F9C2EC81E0557970CD71AD
SHA1:	ADA1137BB47DF62F48407ACC2DC713D92D13A0E0
SHA-256:	330B8EC664949CB9DE5BCCE5AC248148B58DCFEED69ACD8D9CB576AAA935045E
SHA-512:	F72C77D29C51CC6AC1151C919C769BF063E5BAE763033B9BF5BC713E01416ECB301A120B22A17037310E47662EA916A06AA09BB441DBDEE4032A6D59A0876ECC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........gOT...T...T...]..B...].....]..Y...sTr.C...T......]......]..U...J...U...T...V...]..U...RichT...........................PE..L......b...........!................W...............................................j.....@.........................@L.......=..........T...............xC..........@................................!..@............................................text...)........................... ..`.rdata.............................@..@.data....H...P...(...:..............@....rsrc...T............b..............@..@.reloc...,...........j..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\PopSoftEng.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	662920
Entropy (8bit):	6.526894314465185
Encrypted:	false
SSDEEP:	12288:+huSCyAZQUpHByI4ur32KWVyTHrpGUCiAqfoHD2AvdLnaSZCzm3slIalDoH7+F+2:+huSCySQUpHBl4uqKW2Hr9otZCCAlUHa
MD5:	C3EA1FBF2B856FC25E5348C35FF51DD9
SHA1:	87D8FDFDD52FA3BD59FDC7BB1E378091D0D91C16
SHA-256:	6F24B8CA595B4B472320C7A104C64AAD6F0928AD4F1318D1DCFBB0C5BD488A64
SHA-512:	298CE88D37E0496CDF6DADCD7D8890128B90113161311D67ED264B003D5840460FE594B8550FA46E45AF88564E4095C21B748CA3D2B497540ABEB0CAF5533820
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........g.............~.......~.......T.......~..........................J....~.......~.......T...............~......Rich............................PE..L... .._...........!................q........0...............................P......8.....@..........................J..N...D9...........................6......PT...3..................................@............0..(............................text............................... ..`.rdata.......0......................@..@.data....~...P...8...4..............@....rsrc................l..............@..@.reloc..Vn.......p...t..............@..B........................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\QKFJSGCGWGRQ

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	177
Entropy (8bit):	5.199674938155793
Encrypted:	false
SSDEEP:	3:FCxn9go7vcgtHqYcn307C3bKptbwNjGbttcSz3j9BfMkwetdQQqi5xQn:FCgYxtckm3byJwNittR9wgCQPxQn
MD5:	79D59988C12F0214DCA8BE424A94A91A
SHA1:	9C88792C8B94767093346F590CDC9C103AF6B4C2
SHA-256:	D3C151941A923BFBC7E686AECB5648461E8FA1516F93602B7AFF48F2318040D3
SHA-512:	A4D2F2E6407DE534D26911D540CCE8CF198D29A464CA9ABEB6451A9FA745C47307DF71A9C772E2D60663C4D5B0EABB9713DE794BF923B6153A0AAD3F76893FAD
Malicious:	false
Preview:	[XLY]..P2=TLGCBXAGVFLQ.KBI..P5=JHKQFETWJKTIHLLBOKO..P4=TMGJRLDUDWLQ.FCU..P7=PXOEWCVFPIJPLHQSQSX..P3=SUGIPFIMNRQE.TMA..P6=MNHWOTMLOHTPVRFXPCH..P0=DAN127..P1=e8a0d5af432b7e64DBD..

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\QseCore.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	849224
Entropy (8bit):	6.7893930691706075
Encrypted:	false
SSDEEP:	12288:V/Fiea85oMvk6SqMNH/U6beovEYNVXWTwROJTQ9wC1N4Lx09GpVuQ:VAF85oAk6lMNfU6beXwROJTQSC4l0KuQ
MD5:	AA4E9E8A1B0B7C4126451814701A449F
SHA1:	7D988C453283C345E17422FC4B2B6CCFD8200245
SHA-256:	6CA0ABCD77232A5CBADE520596CAB305012ED72315C09CB5A30C3C1E96367F98
SHA-512:	0738DFDE9EC2B1E23B88FDA344CFBA443705A3AD87F22629676118DF555BD395D1737066EFCC4257B8138A0D282491CBD30F36D1880CA640E7D463855C0AD63C
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........!..O..O..O.{....O.{.....O.{....O.Q;...O...L..O...J..O...K..O..O..O...K..O...J...O......O..N...O.W.F...O.W.O..O.W..O....O.W.M..O.Rich.O.........PE..L.....6]...........!................E...............................................f)....@........................../.......0..d........................6.......W..P...p...............................@............................................text............................... ..`.rdata...........0..................@..@.data....F...@...,...2..............@....rsrc................^..............@..@.reloc...W.......X...d..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\SUGIPFIMNRQE.TMA

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	4838513
Entropy (8bit):	7.999961065475255
Encrypted:	true
SSDEEP:	98304:PgbEEFSvDacXxd7ApaC/FgEQC0kqIZ27XUGCmTdpdHFHr8V:PgXjcXxxApJyEQDbIZ27XUhmBTHQ
MD5:	EEF97F5CF47A715367D8F933BDDCDF61
SHA1:	3F1119620BB8DF7963C59C1ECD7EAA485CFC72FE
SHA-256:	E2F5E8EB95FAC989DAE56CEF4C737F53F5E1747EE372BE9EBDCE544153A4E373
SHA-512:	AD50B7B6C48A2DF4167B6794C569861F0F20FE8BDB00D1B0A19B9DA22C4E9A18CC0B3F7EDE976FA9D06D29E549288A28976C788FBD6798A7B8B65835912BE40B
Malicious:	false
Preview:	7z..'......b..I.....A...............N...r.z......=.AO`/..T..V..o..dfS..,;.][.PW......y....=....kQ.i.4.;.A..i.........v$.u,.(%... .<....D&..[D...\|..........}9.Q.x.S../....(..D.t...).r..8;.i..&.k.C....9.m3i........k.AE}.6.M.^7.0.8...'f........Iz...o(w\V..Z......0.'.Y!yZ...~...'f]M.._.%.yh...+_..,Bp..S.53..`....gKNW...&.ij.g.x.....K..m....A.E.......`O^.....Y...`...\.=gG.V..Z.W.xh....=.v...:.....i...\.....<. ....2....~B..W.?..qX)r-./!.0.......P.....p..s..{..m^..\....g.<-.U...lOA..b}...0.%"..a..9.4...S.".......m%wHT..U......`..1.x$.{...F2.......hk.HEp=..O..pW...9.uA../Jo<.P......../.SXoJ.....7t/b}..V...1..K\...v....k....g.e...3b...o.e.m:.7......Kb...'..9.....lcu8.^.d..T.Y./.6....U..&......9.7...y.j.....].>z{.x..>.)...0#3...4.... ..MT.....3...yq8qrW.m......\..<..l.8.qGw...i...._..5....;."....>...8k}..~r....:...7...6.....Q.......U.....,..aP=4%/..^k......L.-....^.b...`.SU>a.W.2.....X.i.Zm..K.......K.A`...........<.<....t........A

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\TLGCBXAGVFLQ.KBI

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	11899681
Entropy (8bit):	7.999984125155647
Encrypted:	true
SSDEEP:	196608:A8PLUvOmYVTAsqbS0A9hZZZoTeKJpKkfBEzkos6+ZgVcB+K6tObk87MDuPAEbqkR:JY2xRAXA9bQnfBEOB+mHkIMzEb9nxrpB
MD5:	E62839794DC4F960FE030473508B9947
SHA1:	08FF9926F663196AA48E3BE3D32E82A69567C76F
SHA-256:	5EF198566190D4E09ECF227E07061937D70C743B8C56BA1A94BCFEBD1CD86908
SHA-512:	29F9C7A5979AEE600573AA2DC1C3E9DB7CCB1A0D73E84ABDDEACCA151A664B1B692A9DF432B3CDF7DB7857BF43F47121769CBB44F7A2D981F86B34A270718E97
Malicious:	false
Preview:	7z..'.....n.........A.......c..T!.'.1..i...........KKO...M.-..al.\i..~]W.....w.....p.oW1...:1..`U..M..B[....3S.....)...A..B..._.vD2..K.....B........Flj.....Gcn...=.I.-.Zp.a...,@0..V2.fyF.\|........_).....u.0.z.R...RB1......4....H..N.7.=).Tid..).<u.#.....Y..~#......g<....6....+j.~NAEU...=j0.<...A.O...(.;F...P.J..8.H.{g.p.....m<1.u.M...E....O...AY.q.tR\G.\..Jn.C..YM...n....+...y..........q.......^..`....%...9.e..<bu5..^..i......]'.S..o.....~1..0.r..,....A...Q.{.!>...t5..c....&.;.?d1J....aG..........y ..#.g..-.....Vst....y..^.jr.....e{.<.=,..7.).2T-4..'..%..&..t.J...T.%f.me.\....R..p......m...m,{Qu...C\|..~~.0.JD7p?...O.4.D...{n.{.C5.d8..;S*e..?..^..\|M.U......sPD....+....g..G.K...........b..,...Wi.G8..7..`.......k..G......../..=.U..I...3R..[t.3..Ji/(...I.B....\wp,..9...f....g..k..:.z5N....@../._.T.B}P...&.....I..g.m}...nj....a.VAl...pN..f.XI...z.i.[#.....).E.....iP.7,.....wE..F.4.pr..DBl..a.k).h..G{.....H.>..........V.j..D...L.7...

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\TMGJRLDUDWLQ.FCU

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	204
Entropy (8bit):	6.465184095835458
Encrypted:	false
SSDEEP:	3:HOIqt/N0Xfe3uK+tCSqszI1cqLq7ShUictiYAj7w1H+C/KkCVQw8H32buSljT6Lg:ulIXG3SzI1NlUi2I7wNl/CKw57vOEL
MD5:	67ED0A69C67F49788D8BD2EE4FC4324E
SHA1:	A96C13719FAEA1240F4C3BBA1781885CDC9F3EA9
SHA-256:	193902E9A4501C2D29F21AEA391D438EEA68B628DE4DB05A95D3F8DB318218BC
SHA-512:	CC9D799962F58CEA8F39788F1F82845CA6F96D43DD75C113B9EE77B7852B98F3A68799948E1172074A1CF30F9A45D526C61EA1FFA7B799D82C80C8DE1034E6A0
Malicious:	false
Preview:	7z..'.....)Np.......<........'K(R.:....!.>..8.......927...Aqp.C'b..N1...Q....9c.Q.C........k..}.+....pc$.F....M..eS!.....[n......8.n.A.....p......$.....S...9...t<....".h+#....].......n......v...

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\TP453990d4df32.TPL

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.594213020193219
Encrypted:	false
SSDEEP:	12:+fVs8d7Z0cAY4pls/2+o8zE9yQwLhESu+mG/2LtLO9y7X3kiv/KVoA0MM:GsmgY4plE218HLGSiVLcu36ozMM
MD5:	3F18FAA73084F2BFAFBA4ADCC071715A
SHA1:	CB3D7999DC729071FFAFC99D7FE7985973785AFF
SHA-256:	C8367EA78CE0BC182F4B1399EC1A530E7D058951D953D63AB4B649D8EF629654
SHA-512:	B4C69DC843FB8218878C4C6FB3CA4B9C41CD8A6E78EE985094B5ABCDF93B777650056D773531A44F02B4FEF2B621E82C38F5D7B4F9FBA182C6F400DE7D89A83F
Malicious:	false
Preview:	7z..'....I#)p.......?.......R..C.O.......3.:.v..O...d..A..pS....BL.......W........!ET)\|T.....qL.Po}.Sd.=~...HjL..B...Oe6....U.j0h...?]v...B..........+sw....gf...H...]#...z....'_..q.P..V._...S...$....!...s?mm..b.......m..z...I.b!o.y.\|........'?....IH.$+.X.p..lV4.e..k.....P..>.T..1M....`W...5..'B....%T\|.8.a.d<N5mi1......0..0..7.7..&..]M..%O.......]l...N......5...1/..r......6.Z...\.`.<9.F.8..e.L..J...5.^......$cN9.....O.Ju...R..Q.l..8]0.}g.....u..1?01r.a......o.1..6C.-..O4W.....r........WG....po.oH!..9......X}..e&..Z.:.T&Z.A.T.p..0....k..+Kw1...(L.zd7..!v...'.q....VRx.}....a....9..a..z...../.C...o./c..e...U...."j...K.j...............$.....S.\|..D=.).`.....*.#....].............u$...

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\TroPox-B_Plus

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	data
Category:	dropped
Size (bytes):	710888
Entropy (8bit):	6.630506217753264
Encrypted:	false
SSDEEP:	12288:5n9CCUQ0bGwLt1n/iswKJLUY2XOrEO/6awL7wU0s6OzeoXHhS6ckqIbpieFGrh1l:7+tLt1aNYrfBB6BAqZkyQgJ0VL
MD5:	C4A08B391245561157AEFD0FE7C40A11
SHA1:	28D15D43A1BDEBC83701AFD89E6EA9C24F90DB33
SHA-256:	53D7C8F2FD109E85FC9302B7424875BAD22A148D6EDC6C7FD8E4589E97259BFA
SHA-512:	24C7608346B76694BF9D8227FF6A794B26D73C0DA93FD231A2331CD371ACC86F293FB9093850F5513DFBE1D269114A56F47DCADBA11BD98C691AB38472A6CCC6
Malicious:	false
Preview:	Ta+....................[...............................................W.osp.....r.xt.~xuu...y\|...u.pu._jn.t..\|............*3}...........l......l..Y...l..... 8..... 8..... 8..............&..........~;.....~;.....~;.....~;.....~;.....ip~s...........................k\..W.....d..................u...C.......Y............[......................................[..........................................+..?...........#7..k....;..+r...W..o............................W..[.............................................\|.....Sw.......u.....................{...x.x..?0.......1..................[..[..x.x...Oi...K......................[......~...?....+.......A..............[..[..\|w.~..+r...;...s...Y..............[..Y........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\TroPox-E_Plus

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	data
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	5.9384613835931574
Encrypted:	false
SSDEEP:	768:84fiYqzFjnHIF7NeXNW/bZKn8ei7DAks8EA8sZeuFZjjDQWLFb:1fi9ToRNedW/bj7DiJA8sZeu3EWLFb
MD5:	59B142B38CFB0CE17D78B9D675E39496
SHA1:	0038255330C145BA84B9BEB847B992D885B7360C
SHA-256:	07F115D147FA617BCB46CDE33C50E95B6792B8309E6D9B81F8124979FCEC3E59
SHA-512:	3B65B4292EB7CFB657648A16784B0B01E2771D618C083761340158293AB1D56547A81A4EA0E6163CDF9614C97D80F88993958AB37BEB8C28A6B710A09B70864E
Malicious:	false
Preview:	Ta+....................[...............................................W.osp.....r.xt.~xuu...y\|...u.pu._jn.t..\|............9.........................@.......C...............).......G.....................ip~s............k\..W.....gr....................................+............................................[............................n............................................................................[............+..k.............................\|.....S..............................{...x.x...J...+...K..................[..[..x.x.............................[....\|w.~.............................[..Y................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\TroPox-Z_Plus

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	data
Category:	dropped
Size (bytes):	1390312
Entropy (8bit):	6.599443687044707
Encrypted:	false
SSDEEP:	24576:znhMjKSFXpFEzq7zZvjyswjzYnOAjPSy36c9RCvirRMNJbd3g:jhMt/nVo2O56tibxg
MD5:	C77EE913C46510A705A9DDDD91DE8302
SHA1:	CB5E045FA27186B9F23E4919590387478B9343D5
SHA-256:	092689651DB7B81A6816B1F78F8CF81476945D493E9566762F5791ADFC5BDA31
SHA-512:	A6C080D04C92EFBF8A1A4A1D1423837B1282E4CFC0E77D9DA4BC9F78E235AA6CD8AE3468B588FD9D35BA656A7A1B27AAE805662EB6C84B053D0149855F4A6514
Malicious:	false
Preview:	Ta+....................[...............................................W.osp.....r.xt.~xuu...y\|...u.pu._jn.t..\|...............K<+.K<+.K<+..@x.D<+..@~.P<+..@y.<+.y.,.<+.y./.<+.y...<+.@..H<+.@..B<+.K<(..<+.#...O<+.#./.<+.#.,..<+.#.+.H<+.#...H<+.#.).H<+.ip~sK<+.......k\..W......~.............................B.......;..........................................[.........................k...........k...................#...k..........K..............................k..[............;..7.............................\|.....<..............................{...x.x.......;......................[..[..x.x...K...;...O..................[......~..............................[..[..\|w.~.............Y..............[..Y................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\fhjyy.exe

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175328
Entropy (8bit):	6.879935553739908
Encrypted:	false
SSDEEP:	3072:jnrQnzMYywmn3h1sp7/WvCnIukR4BbxKigu/fgl1glfdjgBftJeCEEzx4N7mcr5:XQnzXtr7tbxKVuE1gQJeCEMx4p
MD5:	BE4ED0D3AA0B2573927A046620106B13
SHA1:	0B81544CD5E66A36D90A033F60A0ECE1CD3506A8
SHA-256:	79BF3258E03FD1ACB395DC184FBE5496DFA4B3D6A3F9F4598C5DF13422CC600D
SHA-512:	BD4E0447C47EEA3D457B4C0E8264C1A315EE796CF29E721E9E6B7AB396802E3CCC633488F8BEEB8D2CF42A300367F76DEDDA74174C0B687FB8A328D197132753
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............d..d..d...g..d...a...d...`..d..g..d..`..d..a..d...e..d..e..d...a..d.....d.....d...f..d.Rich..d.........PE..L....]d............................S#............@.................................>.....@.................................d8..<....p...............d...H...........*..T...........................H+..@...............$............................text............................... ..`.rdata..._.......`..................@..@.data........@.......4..............@....gfids.. ....`.......>..............@..@.rsrc........p.......@..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\filemgr.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	618728
Entropy (8bit):	6.588792056328895
Encrypted:	false
SSDEEP:	12288:B+jJIpPUHR7IS++ZbaL/mH6yf0fvmuZqhI8XlF7YfkLfm7WUjxioncm:U++4LVs0QpFaIm7WKgoB
MD5:	6E8F89DA86BB82538932DB314C2208F8
SHA1:	A86C373D7BC49032F0EB7D0BB01DA74BA67B4F43
SHA-256:	ABA5E0FFC2D21CB5045D13CE66F8D80862600E37431D20E999295CB07DC5EF3D
SHA-512:	7EAA25D7AC722EF7687357356AC9635B80158918BDA03C3A7E49387BEACD8CD2A9A2ACFD8B5D13571453A7279772FA726A75C9DA0FD7EC6D5BAF202FB928F00C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........X...9..9..9.MvF..9..AE..9..AZ..9..AS.e9..AC..9..9..8..AT.v9..AB..9..kD..9..AA..9.Rich.9.........PE..L....t?e...........!.....8..........b........P......................................).....@.........................p...O............0...............D..P,...@...U...T..................................@............P..$............................text....7.......8.................. ..`.rdata..._...P...`...<..............@..@.data...\|s.......(..................@....rsrc........0......................@..@.reloc...m...@...n..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\fixsc.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	147176
Entropy (8bit):	6.792908985087195
Encrypted:	false
SSDEEP:	3072:oAhT/95cw+pUD+U7s3H9xMaZ7DdJMq5mZZEGP0V:RBADU7s3H9xnBhJyZZETV
MD5:	2EEFCD3D407E4DA935E5B60EF257E153
SHA1:	34F56846E9F48F9775DD8250897345B7736DE213
SHA-256:	837B3DE5BF545BAB85599F0B6D36D8DFE4B3595AE94254CF7C968D1D7DA86F35
SHA-512:	EA05765A18CDA52A7398E04947C8DD6828BE06B07261C612BB8E550656FF5F9EBBD37F85C07007980044D2036171227EEA978B0D0592D6D584A5DEFE53BF8968
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........J...$...$...$.e.....$......$.....$......$...I...$..._...$...%.{.$......$......$......$......$.Rich..$.........................PE..L...\|Q.d...........!.....Z..........X........p...............................p......}.....@.............................l.......d....@..................P,...P..\....q.............................. ...@............p...............................text....X.......Z.................. ..`.rdata..L_...p...`...^..............@..@.data...\|n.......,..................@....rsrc........@......................@..@.reloc.......P... ..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\fixsc64.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	174824
Entropy (8bit):	6.422260069407969
Encrypted:	false
SSDEEP:	3072:vjNq/3Jyz4vHAYH7EKJ3eAlNd09cd7g9EEnQHBdp5FFmvBh7P0I:vjN6yKNBJ3eAdNEEEQHB/F4BhII
MD5:	ED2ACECC811ABF288316C709E2F2D943
SHA1:	0CCE7CC3687CAAF59E6DEA1A90D1214782B5742E
SHA-256:	C3E9F2023A28A2115D15D8DA451B8105771C4D4746F494CCF83FB28623CF724C
SHA-512:	9DD510EABDB4D59B82A7492DFE6A6D11C47721DD0B7F0F22C8060063A94E36FE93A28EC19815AA68F89B1B807AAE584B304AB15D183493295B7E13E65527BEE0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......xI~G<(..<(..<(...g..?(..5P..Q(..5P..7(..5P...(....}.>(.....=(....k.+(..<(...(..5P.."(..5P..=(.."z..=(..5P..=(..Rich<(..........PE..d...UQ.d.........." ................................................................G.....@.............................................l.......d...............x....~..P,.............................................................8............................text.............................. ..`.rdata..............................@..@.data........ ...L..................@....pdata..x............Z..............@..@.rsrc................p..............@..@.reloc..\............v..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\heavygate.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	559000
Entropy (8bit):	6.789431209891293
Encrypted:	false
SSDEEP:	12288:OrswC3DEddri7Dj1XHmyZQNCAGTFgRJz/9i:gsP3Dwdri7DjlHECAGC//9i
MD5:	EE6AA967C56CC0D0820C95D4FD89FB30
SHA1:	D1C5161FB8CCA7FEDFFC1056FAB8D79309EEC01D
SHA-256:	C7CC69762AE72840D200C14E652A460807F487059F7D0780E245AB36AF445B9B
SHA-512:	8502D5E4BB48FE3ABCA897F293199815CE7DBB67E4983BF9A9631A4F92602289FBF08D42DC547B96E1C8338C77108019B952DAA5D682465C7C5567CCBAECEEAA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........-.$PL.wPL.wPL.wY4?wJL.ww..wSL.wPL.w.L.wY4.wwL.wY4)w$L.wY48wQL.wN.>wQL.wPL=wQL.wY4;wQL.wRichPL.w........PE..L...y.`c...........!.........F......*M...............................................)....@.....................................(....P..L............>...I...`..h...0...............................0...@............................................text...\|........................... ..`.rdata..............................@..@.data....B......."..................@....rsrc...L....P......................@..@.reloc..X9...`...:..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\hipslog.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49480
Entropy (8bit):	6.739956450503979
Encrypted:	false
SSDEEP:	768:C2a0KRlGHkg3oqHo3eaB6e7NXQxZzYf3yvZ6/WitUDvb1PRF8oaH:n/HF3xb8KEvyE/cDj15FI
MD5:	E2D837E2B4DDA87A82553631E7D5627A
SHA1:	9F1A5A95B4F0AEA6F9061140F0E22EDA819A78BF
SHA-256:	A5118527EE28C3C263F3FCC3346F8BCA83284E21C8149082F8D1AAA68B39EBC6
SHA-512:	3FDBB618C9F49FE5C7EA81398401C5AD19EE8A215B9A3D29FC03071935E566B80560A775CEF3F1502F8447B2A2528285C8D4586C576A3E311241A06177E14C52
Malicious:	false
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........@3..!]..!]..!].Z.\..!].lH\..!].e....!]..IY..!]..I^..!]..GY..!]..GX..!]..MX..!]..Y..!].lHY..!].lHX..!]..IX..!]..G\..!]..!\.=!].cHT..!].cH]..!].cH...!]..!..!].cH_..!].Rich.!].........................PE..L...>.?]...........!.....X...,.......Q.......p............................................@.............................t......P.......X................6...........z..p....................{......pz..@............p..(............................text....V.......X.................. ..`.rdata..~....p.......\..............@..@.data...P............x..............@....rsrc...X............z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\iNetSafe.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	383720
Entropy (8bit):	6.579374990134974
Encrypted:	false
SSDEEP:	6144:oG1pYD09uIwtl0F1LrheKG/HYStQGz1DAOoQGEnb5bj1hFu:X7g09uRlYeKG/DHegbjs
MD5:	3CE009AFF2FE459A8248693AC8DAB788
SHA1:	607444A7B8AB2E17C525BBE0B28878C3BD0F8099
SHA-256:	11856EE1D754D31AF95F1047CE6B68CA2395C703A995525FA5D9E4A2678D0B86
SHA-512:	1AB4ECB89B07F09985B57F0D546FE6063D8ACEDE435F74075EF9A37288F7D9D19DF168AAEDB38093D88BA2E515CBDABB23F87163AC8FCF9A706448B0F4FC2774
Malicious:	false
Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......d_f4 >.g >.g >.g...g->.g...g.>.g...g=>.g)F.g">.g...g%>.g.`.f4>.g.`.f.>.g.`.f.>.g)F.g">.g)F.g3>.g >.g.>.g.`.f.>.g.`.f!>.g.`.g!>.g >.g!>.g.`.f!>.gRich >.g........................PE..L.....8e...........!........."....................pe......................................@.........................0...................8...............P,.......L......p...........................0...@............................................text...}........................... ..`.rdata...O.......P..................@..@.data...p^... ...0..................@....gfids...............:..............@..@.shared.x............<..............@....rsrc...8............T..............@..@.reloc...L.......N...^..............@..B........................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\iNetSafe64.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	406248
Entropy (8bit):	6.190903413261375
Encrypted:	false
SSDEEP:	6144:OazgQG4JdLe2p+teZ3q9y/3clyMEcLeowam/xohKKJJT2pgJ1JhfQeUnZdnkewZ:HgVGemGeNlYbR2am/xolx0nZZjm
MD5:	E5E4828980E5C836163382F9642D4D24
SHA1:	E8BFB72EB75D20DEEA9152089B7092E07F2EF2F3
SHA-256:	639EA37856839C2D5446A82441D7AB94204EE1172487EB88E9AC1CEB6261D554
SHA-512:	6F621EC441CA46CC48A48056F8E278FF746ECABDAB1933C0FEE18574EE366BD9721487D6462746B6874A5B2CD4D8FC327B5089F351CE8086E10061791034794B
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........o-a..C2..C2..C2.h@3..C2.hF3Y.C2d..2..C2.f@3..C2.fG3..C2.fF3..C2.hG3..C2.hB3..C2..B2#.C2RgJ3..C2RgC3..C2Rg.2..C2...2..C2RgA3..C2Rich..C2........................PE..d...j.He.........." ................l................................................t....`..........................................J.......K.......P.......... 1......P,...`..........p...................p...(...p................................................text.............................. ..`.rdata..............................@..@.data...,F...`..."...H..............@....pdata.. 1.......2...j..............@..@.detourc.F.......H..................@..@.detourd(....@......................@....rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ieplus.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	887648
Entropy (8bit):	6.72536750906441
Encrypted:	false
SSDEEP:	24576:rMl3YXVguMMrGA+64Z/fOl7FPZ1ZGf4a9nCFECq3N:Q0LMe4ZHOFPXZGfNCFEzd
MD5:	CFB50C3C7D74F518CA9E2828E702145E
SHA1:	E38FD98574C08BCC6415E62EA7C9A380958A3D1C
SHA-256:	1C8FF953478CC71166A36181ED32AE7C48B267B011240DB2C701E35D391A66EE
SHA-512:	BD08332BDB78614F1CDFD2E4939B1B9400476D99B50996C17C0277ED76DB5972FAC5EC77DCD4C56459DAA11C6126DC12D66A4E59122DC9B8D89FF6DF89B83240
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%.U.K.U.K.U.K....T.K.K..R.K.....S.K.....R.K....p.K.U.J...K.\...C.K.\..v.K.\....K.\..L.K.\..T.K.K..T.K.\..T.K.RichU.K.........................PE..L....N.]...........!.....f..........................................................^]....@.................................L...,........j...........V...4...@...s.. ........................6......X6..@...............d...\...@....................text....d.......f.................. ..`.rdata...d.......f...j..............@..@.data...........p..................@....360_iep(............@..............@....tls.................B..............@....rsrc....j.......l...D..............@..@.reloc.......@......................@..B................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ieplus64.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1001320
Entropy (8bit):	6.375963793592453
Encrypted:	false
SSDEEP:	12288:DaG9UYtX8J3EfBCMwM9E4jRcoI237MSW7/HTdPSYPJBhnHRxd/c:Dx9UdYRwM9EWI23wSWHdPTJB5dE
MD5:	074CFA8CC35DC642A2B95CC96CE5357C
SHA1:	CEE218C914D530BE6C9BB9531E78F2137224D5A8
SHA-256:	4DE592C87C443780B5D475414196B3C5406ACEC8809EA65AF45A50E7E43462A5
SHA-512:	EF776EB824F4C3152A380B3EC2858A11A96E48711C213AF905FE2B0A972F9CB4A7D83B4B96848DB0B478AF4D19623CB8AC0E5F8FC47007B39E0F16FC2E5FC851
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........../.p.\|.p.\|.p.\|..@\|.p.\|.?\\|.p.\|.._\|.p.\|."N\|.p.\|V.v\|.p.\|V.t\|.p.\|V.s\|.p.\|.p.\|[q.\|..I\|op.\|..N\|.q.\|..X\|.p.\|."^\|.p.\|..[\|.p.\|Rich.p.\|........................PE..d.....].........." .....V..........\|................................................-....@.........................................0y..g....W....... ...j...P..H........4......8...p{......................8;..(....................p.. ....V..@....................text....T.......V.................. ..`.rdata.......p.......Z..............@..@.data............n...d..............@....pdata..H....P......................@..@.360_iep(............\|..............@....tls.................~..............@....rsrc....j... ...l..................@..@.reloc..d".......$..................@..B........................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\imhelper.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	247528
Entropy (8bit):	6.604794755347589
Encrypted:	false
SSDEEP:	3072:2Y77YOcw6BdKQYuVXsZy54tgQCkW30W9ezJQ4mRan5kiINyyT7PK0AMZcan5aj9b:n7YiJEIy54gFogRa0Nl/N1Sjl5yxAl
MD5:	9B05B1F0E62DD100D385807262B84A90
SHA1:	631449787D7532A855CB061E333C0712AC20E753
SHA-256:	6BC0133A16C7F058E5C0B6027929DB1145D37717118DBCF24013FA4F2D79E848
SHA-512:	9F43A542B38D998038D20467BB797CF789A36666F4B8154A548FD6E7BA24A20256C9A0BAB64CD43CB12BEBF704A524FE35F9652FA399237A3F0AFB3BF8670676
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......f.n..yn..yn..y.Hmyo..yg.ny}..yI..yy..yn..y...yI..yo..yg..y*..yg.xy...yg.qys..yg.iyo..ypUoyo..yg.jyo..yRichn..y........................PE..L...N{.e...........!.................................................................N....@..........................R.......B..........................P,.......&..0...............................p...@............................................text............................... ..`.rdata..............................@..@.data....\...`.......>..............@....rsrc................Z..............@..@.reloc..h7.......8...`..............@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ipcservice.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	705768
Entropy (8bit):	6.685295160437571
Encrypted:	false
SSDEEP:	12288:S/20NCvMDhBsqLeIQA2BcMNcYB1mF5Q3LNOsbwbekwCYgLECHqa7XWpbt9o9TehK:e2KC6hBs6f2Bcm65sO8wACHqaTQJe9Tn
MD5:	8B632FD2D4EA70470AF97CD5E88F74D7
SHA1:	9E384D37EB586E9B187F4FFF89C2F104A7921F44
SHA-256:	AFCBB8BCE2E5C8C5E9AA851941E626A62573E6054EC75C14066AD37726BB9DB6
SHA-512:	5F7EA2BF6599AA9E0C44C2820F89DF0827EEBD8A037C9DF2AF516D9865BBEEAF31CAC89AF7214A59BD4B25F2BF7EB94E257AA2766F1D12892E1C34E78776F5E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......,B..h#.h#.h#..,..j#.a[J.p#.a[U.d#.vq[.l#.a[L.K#.h#.#".a[\..#.a[[..#.a[M.i#.vqK.i#.a[N.i#.Richh#.........PE..L...X.Le...........!................L.....................................................@....................................@....p..8...............P,......Pk..`...................................@............................................text............................... ..`.rdata..............................@..@.data............6..................@....rsrc...8....p......................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\jpnative32.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	202472
Entropy (8bit):	6.660474984647205
Encrypted:	false
SSDEEP:	3072:jLH6l5IoUzqiNVwzQyaT0NQgepguwz+uQJOAg0FubAIrnXrsFCAsKIP0a:SluoK7QiToQdeAOpLAFCtKha
MD5:	0EA1C58DEDF685A4A1EEB1C7BD1C972D
SHA1:	66CA439A737A35FC936D2C8F990AD3538D9F2CDC
SHA-256:	41780A7339545676A2D587CD5BCEA9181E6FAAF3EC73C5006D7D76B47B98A6F2
SHA-512:	D16B0A12EE38399C4B05F38E0CCCAFA6BD4984C353AF845337F3E5E8D64AAF3D9B1561E423C5CA59D2652EB083E92FB8832168989B34F11465AD581A39739BA7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~...:gx.:gx.:gx.....7gx......gx.....'gx.h.{..gx.h.}..gx.h.\|.%gx.3..=gx.:gy.Zgx...q.8gx...x.;gx.....;gx.:g.;gx...z.;gx.Rich:gx.........................PE..L......d...........!.........*.......\....................................... .......A....@.................................P...P.......................P,..........p...p..............................@...............D............................text.............................. ..`.rdata..............................@..@.data...H...........................@....rsrc...............................@..@.reloc........... ..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\jpnative64.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	247528
Entropy (8bit):	6.255611405833788
Encrypted:	false
SSDEEP:	6144:MzlHNKfmGZoRwaQDy4ikigoh7Chpq8eFiybV:6tp9QD7ihgohCQFh
MD5:	9380B590C9BE993F3F253469D0933765
SHA1:	0DF57C8EA3D19DCEE142F03D0D6FF4DA7EE5BCCA
SHA-256:	CB8BE7A72561A379B122AB70CAE681840009CE71C9C50B819B2B9E8CCC7A5B73
SHA-512:	2277F388E10D8D579203F7546C30DD314C4BA0AEAC0CFBDBB7F393FBFE54F7ED60FBEDB31E524275112D9E1BDB9F5CB24AC02259ABBC096A81E8CE2D32B87F6A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^.T...:...:...:.u.9...:.u.>...:.u.?...:.H.9...:.H.?.,.:.H.>...:.u.;...:...;.E.:...3...:...:...:......:......:...8...:.Rich..:.........................PE..d...A..d.........." .................c...............................................8....`..........................................\.......\..P.......................P,......\|....&..p...........................P'...............................................text............................... ..`.rdata...U.......V..................@..@.data....'...p.......V..............@....pdata...............f..............@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\leakrepair.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	705504
Entropy (8bit):	6.635093248285898
Encrypted:	false
SSDEEP:	12288:GngcmdomAFsBeQsv5REGqRXkgVP73MfsPF9vyt2nSyv9K:fLAFKsv5ROkgVAfsPTyEnD9K
MD5:	C40E8A502AF91ACA96B85AB36CBE818B
SHA1:	004141E75604502E2EA30C5760008368C36850D8
SHA-256:	A10966CC2785845DC296D90EF9C97ABA865BD06DF1A8A7006A7EE53EBD2152FB
SHA-512:	219630292A8CF70311F06DC1F3A99BA948E7E7BBAB937B0F5B928121838B79FE851B70650BFFD07A4F36A22E2A7B34DE4461D8F4C97FC1322026CA2C5C2E31EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........fP...>..>..>..v?..>..o=..>..o:..>.l;..>.0n?..>.?u;..>.....>..n:..>.j:..>.j;..>.6....>..n;..>.2n:..>..`;..>..`:..>..o;..>.2n;..>.l:..>.l8..>.l?..>..?..>.4i;..>.bj;..>..n;..>..n>..>..n...>.....>..n<..>.Rich..>.........PE..L...].$a...........!.........z............... ....{5................................b.....@.........................@...0...p........p..................H?......XS.....p...................P.......H...@............ ...............................text............................... ..`.rdata....... ......................@..@.data... 7...0......................@....rsrc........p.......&..............@..@.reloc..XS.......T..................@..B........................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libcurrant.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	966376
Entropy (8bit):	6.564045153487216
Encrypted:	false
SSDEEP:	24576:3lzYxkj819KdVtUSPczJfKbM1aIjvI7BxwwuDFkrwtFkUHUZ0sIPbtYUkXAJfTSH:1zge8XKdVtUSPczJfKbM1aIjvI7BxwwH
MD5:	A9FF3D29AF8CCA5D3C90F17709EB0548
SHA1:	7F4B69366BA3BBB7BF08206FEA672C807CC2B562
SHA-256:	45E8B5F32CDE9201278500DF961133AD26AD60C531FCFD77D3D26FEFF105FFD0
SHA-512:	F043D1599D57B1E86D97CA1E81CF81FF0B3C97B95F1134ABF6DEEAC615F37645A825363315F5FB2139286BB5AEF5FA26C375E829AEC897C27CEA30199310123C
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$................e......e..*...e...................g....2Y-....................i.....y......}....................}.........Rich...........PE..L......d...........!.................d..............................................`.....@......................... ...H...h...x....p..@...............P,......@j..@t..p............................t..@...............L............................text............................... ..`.rdata..............................@..@.data...............................@....rsrc...@....p......................@..@.reloc..@j.......l...$..............@..B................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libgravity.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	871144
Entropy (8bit):	6.407442398411684
Encrypted:	false
SSDEEP:	24576:hgjR9MABH2uK50bPcjV/3WU020ZQA8NM/rmn:ghB1W3WUVeC
MD5:	9A88DC21D3AC42ECA184F37297387BDF
SHA1:	2F82552EF8F4B6A10356441CD158F1A0C5905913
SHA-256:	466DF96D59B878EC6775ECC4D497B71CCD73CB11FBB2C2B23575EFE055BFFB75
SHA-512:	1136D371771A71D329910ED9BDBF8243F74AD19FCE75F9A8712BC1E1E53EA3EF3722D4E067AB5567366D40D2637AF7E119E7E31734DDB57BCEE126CFE932C37B
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......U-.}.L...L...L..3,./.L..3,./.L..3,./.L...L...L.......L..C$./.L..w$./.L..w$./.L..C$./3L..C$./,L..3,./.L...L..]M...%./@L...%./.L...%,..L...LD..L...%./.L..Rich.L..........PE..L......c...........!.................P..............................................._....@..........................{.......\|....... ..8...............P,...0...s..p&..p....................'.......&..@............................................text...U........................... ..`.rdata..............................@..@.data....}.......&...\|..............@....rsrc...8.... ......................@..@.reloc...s...0...t..................@..B................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libscent35.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	927976
Entropy (8bit):	5.917840435230856
Encrypted:	false
SSDEEP:	12288:Syp5QtiR2fVE00WKL+YD5ndNpKrtvKXVsFpJppn72z+T73P+2QHkgFrGCZK:1POE00WKd5ndNpKrtClsFXnhT7ZAkgxO
MD5:	158D719030DBD08384235B165FC211CF
SHA1:	A8161B15C0BC6576829DA4BC0732794B0AB2E37C
SHA-256:	BC33C91BE3D31557B16F2B91B90DE96580C3CD2510E3C3D3B77E3D4CC8DBB0B4
SHA-512:	383E551FFC50D17E9A5B466E996614B5AF35BEB48A72A47CB7D5A35B68D68906E5ABADDAEABD439AA214BE28E7A27FBCA3872537D65D33CA64A53B513A924EDB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?.(e...........!..................... ........@.. .......................`.......7....@.................................P...K.... ..................P,...@....................................................... ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........o..P............b...............................................0..M........(....~.....X.....r...p~.........(....(G......r-..p~.........(....o....}........0.......... ......{....rU..p~.........(..........(....o...... ...........%......(.....%......(.....o.....o.....o......ry..p .....o.....(~...o.......o.......+.....X.....o....o....&...X......i2..o.....0...............(.....4........(......-.r...p.....(....(....s....zr...p.....(....o....(.........(.....s\|...%o~...%~

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libzdtp.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	575720
Entropy (8bit):	6.4118078561661545
Encrypted:	false
SSDEEP:	12288:FoblSYniV7pA1yJVyfI1+RZSihzvjZh2Tx4UTFAzmp4ZZPy1KlU1E:sfI1+RZSiz2VlTF+XHlU1E
MD5:	82DE25B17C3B9D6BB253B6BE7AD2FEA1
SHA1:	6F6BCF23753F161D4DE444978C3EBC003D361B2D
SHA-256:	165FC9F929853B4AE8603BB0C7807456B99871A7C8E9078F95D954C466A7172D
SHA-512:	71EA0FE18F1EBDA98067460E6661FC108E7116E71651B0D05FB8365BDA92E1DBF02B89D20DF6B47C7557AC52877ED8EE503373164079C0F5C62EBF16439867C4
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$....................r.i....r.k.I...r.j....c.....c............X,_........................................n....n.....n.g..........n.....Rich...........................PE..L.....(e...........!.....v... ............................................... ............@A........................@...........x.......X...............P,......lJ......p...........................p...@............................................text....t.......v.................. ..`.rdata..\l.......n...z..............@..@.data....c.......(..................@....detourc.5...p...6..................@..@.detourd$............F..............@....rsrc...X............H..............@..@.reloc..lJ.......L...N..............@..B........................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\libzdtp64.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	682216
Entropy (8bit):	6.095070464124169
Encrypted:	false
SSDEEP:	12288:rhqnA1JpofoqtokijtH2OMoVTP94CCIKGJToFTz/goFZKk:VqnALpPqXq92bEx4CCIKGJToFTz/gox
MD5:	3D7564C3B97E0DCC859CE8FAE51BF196
SHA1:	F6588DAA615A45E375AB4CD8153A3D9BBDC476C6
SHA-256:	73D11EF506C2282DBD45C4758F6C6B1352C596B1EC684BEF30778965D0774F1B
SHA-512:	C6021111CA8F0B8BBD111F85397C0F91DD2423B9168711296B484190CF5C43CABE6215AFE4533881F0F285FBB201D4974D7343E92F33681B1983BB1770110246
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........C".."LA."LA."LA...A."LA...A-"LA...A."LA.KH@."LA.KI@."LA#..A."LA.JO@."LA.JI@."LA.JH@."LA.Z.A."LA.Z.A."LA.Z.A."LA."MAd"LA.KE@."LA.KO@."LA.KL@."LA.K.A."LA.".A."LA.KN@."LARich."LA................PE..d......e.........." .........*.......^..............................................9.....`A................................................d...x.......X.......PF...<..P,..............p...........................0................ ..x............................text............................... ..`.rdata....... ......................@..@.data........0...F..................@....pdata..PF.......H...d..............@..@.detourc.h.......j..................@..@.detourd@...........................@....rsrc...X...........................@..@.reloc..............................@..B................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\lockkrnl.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	628184
Entropy (8bit):	6.631864802737484
Encrypted:	false
SSDEEP:	12288:Q9tUcJqS8DI9baOCmIJkPI9VYxPmb3pJ3xW2orMvM79G:GWKqS4OjlPUkmrpzWdSM79G
MD5:	BFF0CE8D5C44994EF19F63D63CC29EEB
SHA1:	B2837190927EE952721DBD5127C426D28FED9230
SHA-256:	08C6DDD72CD481672476625BAB435993F2F0C85F835B0313C593F46C49DE6781
SHA-512:	F527BB56DA57CA6BACDBA7871D65E48CA6ADEFE7F61240D766A6881C301B63C60063A09FA73E8BC64F40A01AD038B446B660A8ABC7719B84F1C6FE3654551420
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........<W..]9X.]9X.]9Xh-:Y.]9Xh-<Y=]9X.5<Y.]9X.5=Y.]9X...X.]9X.5:Y.]9X.5=Y.]9X.5<Y.]9Xh-=Y.]9Xh-8Y.]9X.]8X9]9X)40Y.]9X)49Y.]9X)4.X.]9X.].X.]9X)4;Y.]9XRich.]9X........PE..L....k%b...........!.....^..........=X.......p......................................c.....@.........................`................0...............V..@?...@..8F..pp..p............................p..@............p...............................text....].......^.................. ..`.rdata..jy...p...z...b..............@..@.data....8.......(..................@....rsrc........0......................@..@.reloc..8F...@...H..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\mobileflux.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	117064
Entropy (8bit):	6.436398487030181
Encrypted:	false
SSDEEP:	1536:pxNcrXn306zvccqtaGYvPCa/I7206aawWKxocUoiZw+BpQR9oLMm:pXcD30gccqtanCM0Wwiw+BpQR9oL
MD5:	80907BE35290D47A8C6DF50A0B44DECF
SHA1:	DBDDA59DD78716AD28FD37BF2619FC183D27CAE0
SHA-256:	4C4853E4F3990FFD0B3D6EB1436A885559564C1065C26490B777EC9D3586A5C4
SHA-512:	09D05C3133569548F4F231F0E06F6F29D57195C927B908F973CB05ABDE6214CA1E07399CB32EA5EC02635D81409B2A8F8F6BDA21F6B51B2A02115C2DF95B3B88
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m..)g..)g..)g.. ./.8g.. .9.Mg.. .>..g......:g..)g..g.. .0.!g.. .(.(g..75..(g.. .+.(g..Rich)g..........PE..L...%..S...........!.....,...\|......H........@.......................................O..............................P.......4u......................................0B..............................._..@............@...............................text....*.......,.................. ..`.rdata...A...@...B...0..............@..@.data..../...........r..............@....rsrc...............................@..@.reloc..~...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\netmstart.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	171592
Entropy (8bit):	6.633100643329799
Encrypted:	false
SSDEEP:	3072:2g5d8g4gNv+wAGzpjdNwCR5t9Owr5HQ6UnsaP5YCnF+wFxDA:xDRpSs5t0u5wbfQ6E
MD5:	FF07224F63F62ECC5C6F2DED09DEB0AF
SHA1:	D3ADF969B20A3E42032E60A87DBD69834A748C1A
SHA-256:	A9F37F82413889A66F7063991F5C2E6DBA05A35A245891039204A478DE318357
SHA-512:	92B763A682C9F479F539AA945F245940351983EC04829FB6D614BB7ABCADE60E2205244C583F63547CF83F4819503529FF01411E08C9CBA26972222D2520AA4D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..X.y...y...y...+-..y....<..y......y....-.y..5....y...y...y....#..y....;..y...+=..y....8..y..Rich.y..........................PE..L....].[...........!................F.....................................................@.........................`...........x....p...............f...7..............................................@...............4............................text............................... ..`.rdata...N.......P..................@..@.data....L... ...(..................@....rsrc........p.......8..............@..@.reloc...".......$...@..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\np360SoftMgr.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	243944
Entropy (8bit):	6.56760832272308
Encrypted:	false
SSDEEP:	3072:YdtvVq01U5wXzfoUEwDTw3lCovmHDBYOfdv2xJ82wEdl/NPgqddBumr5365mwkq/:yNI0O4awI3AYqYEv2QIdZTJJYD1Y1a
MD5:	FA85435627D31663BECB82EFFDFBE2BB
SHA1:	C3D9EEA92EF90E652F500A1F900DA4E20A010C2A
SHA-256:	7E0343BC0108526442E8B3FE7E538272FA6240E425BD8F318924573B59BD9DFB
SHA-512:	7DA0E76E88D8E78D23E7E6BE0A184BF52DF5032113DFEBE087C3463AD990BE38CD4FD34586CCD367B381AE749F16E04573CF91E4B3D7A235A865D175FAACBDA8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................f.*......)......?.......8......}........z.....6.............(......-....Rich...........................PE..L....6.e...........!................3.....................................................@......................... G......\:..........h...............P,..........................................@...@...............<............................text...x........................... ..`.rdata...x.......z..................@..@.data....D...P.......<..............@....rsrc...h............T..............@..@.reloc...-...........\..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\npaxlogin.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	404296
Entropy (8bit):	6.509440609680588
Encrypted:	false
SSDEEP:	6144:iwa9e5G4aES0Qux3nNj43ziT7U2mSBzRD44shPBTLaqqDL6UbwHUu:Y9exL3u0U2pBzm4sxBTrqn6Unu
MD5:	630AE5740C702AF919BAED414DE8CFE3
SHA1:	26A50EFF049B2DBC24BE11411032172E82B37B04
SHA-256:	C3F08B4843DAF466148EE99DBD0D300B2A92BB695FCDE001E288189A3582300E
SHA-512:	A714A6F13CE33D8EC31772F180F611C491110D438019D4FCD88F2EB114B41FBD28878B8B9C6BA723D892405DC825917EF1D4868FFB66069ABE49E5AF286F491F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...t..,t..,t..,}.\|,y..,}.`,n..,}.f,o..,t..,h..,}.v,...,}.q,...,}.g,u..,}.a,u..,}.d,u..,Richt..,........................PE..L...[AVS...........!.....N...................p...............................p............@..........................x...... f.................................. 5...s..............................8...@............p..d............................text....K.......L.................. ..`.orpc...3....`.......P.............. ..`.rdata.......p.......R..............@..@.data....Y.......:...\..............@....rsrc...............................@..@.reloc..hc.......d..................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\ntvbld.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	MS-DOS executable PE32 executable (DLL) (native) Intel 80386, for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	60896
Entropy (8bit):	6.847633229504993
Encrypted:	false
SSDEEP:	768:NnCuEmXB5UMI3nhKrbZCWg/0/NC8hUDVsa0T1zj9KyhaMQNDG0uKjKj9MPgkz:N7Rx5Ulll8/H+x0T1zj9lHeMy
MD5:	690612154E7E5233AA980016CEAEDEDD
SHA1:	9B16E2F3D799EA506AA6A8F53FA4DEB36D73F5D4
SHA-256:	FFB81D34A14B5837AC713657F7892E790F85564BC2BA792025B0F9E9E0959AD7
SHA-512:	1F93AF0CA40DB562F7ECDBF19A0D899044BCF1F181B03E57E6B6F2C72F532652798023612BE9DEFE6261D631D10898D30ADB28EEFF922B72734B4DB27189C210
Malicious:	false
Preview:	MZ!..... ..........e..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ntvbldDXML..$............!.L.!........h.T.....................q.......q.......q.......q.......q.......q.......q......Rich............PE..L......a...........!.........\......2=.............p................................s`....@.........................p...........(.......h...............H?..........................................0+..@............................................text...v........................... ..`.data....F..........................@....rsrc...h...............

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\pluginmgr.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	171848
Entropy (8bit):	6.451554967739461
Encrypted:	false
SSDEEP:	3072:NQbFXbsJHCPNUzpNd0hq6pPyNVD/fAudYMi429OYHUMu73zE55C8f:atWpnztVLffdYLN8YHa7w
MD5:	9828C8A355EA0F393260D6E3F7D511E5
SHA1:	DC587D4215DC083A35E4BBEE095FB3FB07A73C33
SHA-256:	B0D6D85D02E7650E03AB9AD04E90341EF6F5421DDC2AAA7AE65692944C298671
SHA-512:	178D1AF5ABB116762C37714F2C142DB02BE9AF8B0C9BCD4948DE122583A9C815E1AB1F709E3167A096947CCCCD6ABEDC4BAB7ED405D207F097BD35640926205A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........xL.+L.+L.+..+M.+E..+^.+E..+1.+E..+u.+k..+].+L.+..+E..+].+E..+M.+R..+M.+E..+M.+RichL.+........................PE..L...P.LS...........!................D.....................................................@..........................2..M....'..x...................................P............................... ...@............................................text...'........................... ..`.rdata...S.......T..................@..@.data...HU...@...,...(..............@....rsrc................T..............@..@.reloc...#.......$...^..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\probe.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	304640
Entropy (8bit):	6.443933218835315
Encrypted:	false
SSDEEP:	6144:1AXDdMpEeHyH/D1kApvwp+ZniFARcRdhAGXPR:1Az6WeHyfDOAdwp+doARcRdh5Z
MD5:	BB752561CE0859324FF01369BA8D25CC
SHA1:	8C42AA1FF9060E58CFFD0EE9997DF134FB3E8739
SHA-256:	A243D55655789EF26972546B7DC9723953564F52AE1C46087CCC2DB96F5B8D83
SHA-512:	0C493C6868F4E2D90E3FCD6B71116769F2FA2F61740BCB9671B1DEEFC4628BE05E4441CA2008F6AD3F72BAE7C14028A7565CC2FBE68478E620F3CF9418357182
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......&PLYb1".b1".b1".kI..s1".kI..^1".kI...1".E.Y.o1".b1#..1".kI..n1".kI..c1".\|c..c1".kI..c1".Richb1".........PE..L....r.\...........!.....`...........?.......p......................................Cd....@.........................@%..B...X........p...............n..h7......@#...r..............................(...@............p..d............................text....^.......`.................. ..`.rdata.......p.......d..............@..@.data....6...0......................@....rsrc........p.......2..............@..@.reloc...0.......2...:..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\qroscfg.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	138056
Entropy (8bit):	6.637936005523512
Encrypted:	false
SSDEEP:	3072:LKDfRbUTKLoDy1wSSH/2Lq62enAhXx2+EKI:KJITHu1wZf2Lq62UAh6
MD5:	F62317FC61CA698D45A54C0F7A8A78B8
SHA1:	F61D256EA3E3DD85CE7C44DC61AACC93E720F692
SHA-256:	59DC54DD624E26D07EE8A908476EE67DCC3B6BA690F566C30B5522B6DCB8EE85
SHA-512:	C06E046EDB18EE40D63411AA689280A73EBBEF3CE6977C51F629C43E6A6314895BCF2270E43CB1D9DD847B33874BC812778ACCEC07ED0FBFB9791556027FFCAD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......./.j&k..uk..uk..u...ui..ub.uz..ub.uR..ub.u...ub.ux..uk..u...ub.u\|..ub.uj..uu.uj..ub.uj..uRichk..u........................PE..L.....,S...........!.....N...................`...............................P.......T....@.............................L...\........ .......................0..T...0b..............................8...@............`...............................text....L.......N.................. ..`.rdata...k...`...l...R..............@..@.data....A..........................@....rsrc........ ......................@..@.reloc.......0... ..................@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\qutmipc.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	170856
Entropy (8bit):	6.55483314591404
Encrypted:	false
SSDEEP:	3072:4JJiNkByXIzFu3wK672soO82qUyleRR2v6eY8lMnu+wqH6F3:477yIzFfKTsS2qUKeXC5lRR
MD5:	7EE49A57339ABCC35FCDE25D3F5EE8D9
SHA1:	7A7F471DADD973CA57C79C43D93828B4496570E8
SHA-256:	DC477A4B41CA92D94CB7092B458F35DEF2EF6F9A0B23A237A363E341E22AEABB
SHA-512:	F978F6C882D80CFD87B2EF75EBB1C18C9BFB6759D28C0F503395217373AE241E5B08212D4D42373F6B94AFFBF775959E06BD1CAD5D09C488DC139906A0D4AB4B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$...`..R`..R`..Ri.]Rk..R.BRb..Ri.ARr..Ri.WR...RV..Rb..RV..Rc..Ri.GRq..R`..R...Ri.PRZ..Ri.FRa..R~.@Ra..Ri.ERa..RRich`..R........PE..L...f..]...........!................K.....................................................@.............................a............................f...4..............................................................d............................text............................... ..`.rdata...O.......P..................@..@.data....n... ...(..................@....rsrc................8..............@..@.reloc..<#.......$...@..............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\7AF5081\qutmload.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	111336
Entropy (8bit):	6.7222941004358425
Encrypted:	false
SSDEEP:	3072:PTxwTSQCdxm/78XLv6JYZeD9GIn+uowP0T:PCzCeeeYAD9E5T
MD5:	8719E73BC84D506FE7F0D367AE46ED20
SHA1:	D60A1FF7B2478ACDA7C5C1730E0B963594311FB9
SHA-256:	C110E1FF4F233669F1E035129E137ACED1A3632D17A8302502D160DC16FA9AF0
SHA-512:	AE00044E9EE7B5AF66105067877AFD68D79ECEB6C945CC07F390D15A2E1C0832C578146E6B0657FD8A29F865EC6DB78DEFEB7C1BA7E3AF0D1427EFD22A67F8B8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........z...z...z.f.'...z.....z.......z...{...z.....z.....z.......z.......z.....z.....z.Rich..z.........................PE..L...Z.Xd...........!.....Z...........A.......p...............................`............@..........................X..[...TM.......0..................P,...@..t... ...............................8%..@............................................text....Y.......Z.................. ..`.data........p.......^..............@....rsrc........0.......d..............@..@.reloc..f....@.......j..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\decoder.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	220616
Entropy (8bit):	6.541764938067898
Encrypted:	false
SSDEEP:	3072:Mskjyi8Ot6MXdDJy9YdP5YrRDApRx3DZJdzR5coPlGiSQDg2FCwVY+p5nvRVE9M:WWutRW6dxzRjBPohEC+NvRVl
MD5:	C098B1C216866D9CA0EEAE0A46A46A0A
SHA1:	B68890EBC6AF792CAC62AB0E2ADE6A7B777C58AE
SHA-256:	0960F28F586617647F16CCB2AD9B38FBA521605015A4C51F661D4BCECA251DB0
SHA-512:	FAC75162310F554BACCB49B5B88EBCEAA8B288E7ACA010E0B364077DD2738CD0D484633BEF7270FAD064813A7B01B7D26E000C0561D20925FA5A6EA902D452E6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e..4!.dg!.dg!.dg..gf+.dg..af..dgA.af..dgA.`f1.dgA.gf7.dg..`f4.dg..ef&.dg!.eg..dgE.mf~.dgE.df .dgE.g .dg!..g .dgE.ff .dgRich!.dg........................PE..L...~..b.........."!... .d... ......O................................................C....@.........................@...........<....... ............:...#......t ......p...........................(...@...............\|............................text...lc.......d.................. ..`.rdata..B............h..............@..@.data...DV... ......................@....rsrc... ...........................@..@.reloc..t ......."..................@..B................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\WindowsInstallerFB\holder0.aiph

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	data
Category:	dropped
Size (bytes):	42772742
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	AC8333E626462FA7170FE7C14F946DF1
SHA1:	2E61E7E37526D1AC113323F3250F363909CBD3DD
SHA-256:	2542AD5E787990ED3597A062104628FB43AE3039DC60A3E95184B604849D4ECE
SHA-512:	47014486410805F498FAECABB2825BD9A61153DCEC58756743BAAE75DF0A67D417A13E873828E63D961804B22377C4830F00C95F91202E33A9EE693EB4524EB8
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.1440865988908953
Encrypted:	false
SSDEEP:	6:kKXL9UswDLL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:/iDnLNkPlE99SNxAhUe/3
MD5:	8E032218511C7E017F47429DB15D10C7
SHA1:	E8B201631773DAB33F07A3165FD5F64B5F292FF3
SHA-256:	467D93AC2F01E40BF70BA96DDB5DA8304F11EE945378E3BC9B2BE94615818AA9
SHA-512:	1BAB52E5B5DCA903B7A3FECF3D03C8A86E54A457229C34B8049563446C79C3E72B5C26CE4971B1AFEFB4D7ADFA54FC7EF400DCDCA8A7F6FFBB5D5086BCD945E6
Malicious:	false
Preview:	p...... .........`...Y..(....................................................... ........G..@.......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\AdvinstAnalytics\6627be3e20a59ade4c1add8b\1.1.6\tracking.ini

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	27
Entropy (8bit):	4.088220835496803
Encrypted:	false
SSDEEP:	3:1EyEeBn:1BEYn
MD5:	4AE8A010782B10391BA0AF6F4DC3B667
SHA1:	48999DD7C62D642974049463C4418457572177D5
SHA-256:	C0B2445FCAA83FA4F12DCCEB286EAEB5D278E06DC27E549F49E1547B36A046D5
SHA-512:	96C1551461FDAFFDF8B9F37198FB2BC1CD18B0B27494E94705DD6A2AA1F4EA17C5014E0F2C54E6B436D796BED334FD6AD637D374804ED1815488D4801FC183E6
Malicious:	false
Preview:	[General]..Active = false..

C:\Users\user\AppData\Local\AdvinstAnalytics\6627be3e20a59ade4c1add8b\1.1.6\{F0B4B82B-A7D3-478F-96E2-0DDFB7126821}.session

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13629
Entropy (8bit):	5.405928495232936
Encrypted:	false
SSDEEP:	384:wc+aRPE8ZFt99vdn9SdCyLbOxP75OkV3SDRht4UZpvgttFqJzwY+slMPbRF:x+aRPE8ZFt99vdn98CyLbOxP788SD3tM
MD5:	B3FF5FEAF19888AF43A0F24F8B0E8BB9
SHA1:	B177D04A1F36C5111AFE2EBC60175599251705C2
SHA-256:	B236942EF200CB2FBE74684DAD91C7DAF07C2CE7E9205CA7B74FBB0A42BFB0B6
SHA-512:	753B24C8577ECFD24B9C5B86776EE4D2884DB714A8D67D2BABB3F55FF5E84FFD735BC8885B25570017D275226FA913262886827528C5996D4594727EA76320BF
Malicious:	false
Preview:	[Hit {AB0884C2-7FA4-4AB2-A1FF-96C8D825E787}]..Queue Time = 0..Hit Type = lifecycle..Life control = start..Protocol Version = 3..Application ID = 6627be3e20a59ade4c1add8b..Application Version = 1.1.6..Client ID = C084191C5C3DF65BAF11A4370051FDEB0BDC5010..Session ID = {F0B4B82B-A7D3-478F-96E2-0DDFB7126821}....[Hit {6387921B-5471-4A27-9736-BB36D9A2BFA9}]..Queue Time = 0..Hit Type = property..Label = VersionNT..Value = 1000..Protocol Version = 3..Application ID = 6627be3e20a59ade4c1add8b..Application Version = 1.1.6..Client ID = C084191C5C3DF65BAF11A4370051FDEB0BDC5010..Session ID = {F0B4B82B-A7D3-478F-96E2-0DDFB7126821}....[Hit {4A8A2F0A-A8E2-4BA8-AE8C-15160C67AD11}]..Queue Time = 0..Hit Type = property..Label = VersionNT64..Value = 1000..Protocol Version = 3..Application ID = 6627be3e20a59ade4c1add8b..Application Version = 1.1.6..Client ID = C084191C5C3DF65BAF11A4370051FDEB0BDC5010..Session ID = {F0B4B82B-A7D3-478F-96E2-0DDFB7126821}....[Hit {6C2B1EE9-74BD-488B-B236-8AC7B4B94F30}]..Queue

C:\Users\user\AppData\Local\Temp\11835\....\Microsoft.TransCompositib.msi (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	667648
Entropy (8bit):	6.655676024268379
Encrypted:	false
SSDEEP:	12288:G36HjCm6ltuRXQ/g+hVfW2LDzeLA5rJWutAWQSHOALXB:VCm6ltuRXKg+hVfWkDEA5tDuyX
MD5:	BA4ED2E6B25A8C9EDA3DA4CE85A5054D
SHA1:	C3B2EF12347E0C5206B4C3959FA96CD7F064F10C
SHA-256:	31370AB9ECAFEA8528D0C844C34B7721042C93A8E45278C4452B62ABAADE9182
SHA-512:	87C10EA2B82D79BD96CA453D808D937841A45CEE331E5914E5B9A7D6665BB41864D90E08E47F4000C1EEBC64F1E4035B010F545B2068B3604A7B8C87F1D30DBB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........xt..............a.......a..W....a.......l.......l.......l.......a..............l......l......l......l......Rich............PE..L....+.f...........!.....f................................................................@.....................................(.... .......................0...K...[..............................8[..@............................................text...cd.......f.................. ..`.rdata...Z.......\...j..............@..@.data....2..........................@....rsrc........ ......................@..@.reloc...K...0...L..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1735434054\....\Microsoft.TransCompositio.msi (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	174304
Entropy (8bit):	6.858552596804119
Encrypted:	false
SSDEEP:	3072:Q0HJ5wo1/MJjozYJimE2BamDKigu/fgl1glfdjgBftJeCE5vLEnM7QrRz:/J5wUmhkmDKVuE1gQJeCERLG1F
MD5:	0D318144BD23BA1A72CC06FE19CB3F0C
SHA1:	91A270D8E872EA2A185309CA9CE5D9F08047809E
SHA-256:	60503684F39425C5505805A282EB010ECB8148BBF7EFE9BBA9CF33C507AF7F3A
SHA-512:	A3F3C7D84644B13868AC324947C2D678620E341E368B781D45F244A53F448D6B24BE7B50AC9908728DFBBB74214FCB46902137910E907F14F601518C0EFD215B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k.A...A...A...,...H...,...;...,...Y...z...S...z...S...z...d...,...D...A...........C.......@...A...@.......@...RichA...........PE..L...V.]d.............................#............@.................................Z.....@.................................48..<....p..0............`...H...........*..T............................+..@...............$............................text............................... ..`.rdata...^.......`..................@..@.data........@.......2..............@....gfids.......`.......<..............@..@.rsrc...0....p.......>..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\24601\....\Microsoft.TransCompositia.msi (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	157184
Entropy (8bit):	6.4699325010744015
Encrypted:	false
SSDEEP:	3072:tJpAAXru5+rs45R7H0fABoTRo3hJjfP8mr:tJpAAXru4Fj6soT2LM0
MD5:	C50F56319C92BC129039E3860294AB5D
SHA1:	470ED2516A0FF86F25C7CEBE3084E238CA8879A7
SHA-256:	56E8A343602DDDC6D7B6A787827801A3D2BA69ABAF1C61874EF9286C2D288C6B
SHA-512:	20451481425424167EDF4D8C1562EBD7619D5FA0D4BB46C1C30840C9E63C617F94B281C294E3FBEDD290A76C543E4A1C3518B8E66D919743B9CC1F966D8E0CE0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`. ...s...s...s.w.s...s.w3sr..s.y.s...s...s...s.w2s...s.w.s...s.w.s...sRich...s........................PE..L.....#g...........!......................................................................@..........................=.......6..<...................................................................0...@...............0............................text...C........................... ..`.rdata...^.......`..................@..@.data....:...@.......,..............@....reloc..$........ ...F..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5950109\....\TemporaryFile (copy)

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58368
Entropy (8bit):	6.398722888372975
Encrypted:	false
SSDEEP:	1536:qjw1c0DJ1xDL8lCXy60KlCXy60vcbvM1id4xSu:T1HPxD2Cj00Cj0C00WxS
MD5:	56867EECC2042A0FD681F3B90D365A16
SHA1:	021DAC119F8E115E6DF308DB85BC8760078D9719
SHA-256:	48F8313380BC6FA33172888B8FD9874A6ED5465213BACB9F8D5C2BB3AB37BAEE
SHA-512:	EBB40D1E1A7F6B9E9480E544A67C9383D53A708547ACBA787BFD7C5699E491EAD7FAF714C5D84407B3D9A1DD2051205E0A299EAEECEB44422E3874C5E55CC65A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........FJo..Jo..Jo..%.U.Ho..%.W.Oo..%.c.Ao..%.b.Ho..C.Z.Oo..Jo...o..%.f.No..%.R.Ko..%.T.Ko..RichJo..........................PE..L...83^f...........!.....2...........9.......P............................... ............@.........................@...]...L...P.......................................................................@............P..,............................text...40.......2.................. ..`.rdata.......P.......6..............@..@.data...............................@....reloc..<...........................@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5950140\....\TemporaryFile (copy)

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	7.484270190239562
Encrypted:	false
SSDEEP:	768:tUqX/E3rJA4ZX6xUrLGwk9xAlvcuHnYoq7MNC3Il:tUc/+vKGnax8ESY17WkI
MD5:	63F6D9FECB240388D69CB668CFE50C00
SHA1:	2B67BB8AA45A9D0383E76F15E631C1131B28BB1E
SHA-256:	678D6ED15F6150BFD5BA8E823CF877C32BB492E8557E107FAC77143DAD3724F1
SHA-512:	176B096493206D2DADB17D778E959855DEEF0EC8D5343C09790CA6C067A338ECE44138FA9081888CAA2228A041D2A8C71B085AD8FEFAFE479505F667F6D2B7E6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#;\.gZ2.gZ2.gZ2..F<.rZ2.Q\|8..Z2..Uo.bZ2.gZ3.7Z2.Q\|9.sZ2.gZ2.fZ2..E9.eZ2..E6.fZ2.RichgZ2.................PE..L.....lf...........!.............p..................................................................................0...l...........................................................................................................................UPX0.....p..............................UPX1.............v..................@....rsrc................z..............@......................................................................................................................................................................................................................................................................................................................................................................................................4.21.UPX!....

C:\Users\user\AppData\Local\Temp\5950171\....\TemporaryFile (copy)

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	177
Entropy (8bit):	5.199674938155793
Encrypted:	false
SSDEEP:	3:FCxn9go7vcgtHqYcn307C3bKptbwNjGbttcSz3j9BfMkwetdQQqi5xQn:FCgYxtckm3byJwNittR9wgCQPxQn
MD5:	79D59988C12F0214DCA8BE424A94A91A
SHA1:	9C88792C8B94767093346F590CDC9C103AF6B4C2
SHA-256:	D3C151941A923BFBC7E686AECB5648461E8FA1516F93602B7AFF48F2318040D3
SHA-512:	A4D2F2E6407DE534D26911D540CCE8CF198D29A464CA9ABEB6451A9FA745C47307DF71A9C772E2D60663C4D5B0EABB9713DE794BF923B6153A0AAD3F76893FAD
Malicious:	false
Preview:	[XLY]..P2=TLGCBXAGVFLQ.KBI..P5=JHKQFETWJKTIHLLBOKO..P4=TMGJRLDUDWLQ.FCU..P7=PXOEWCVFPIJPLHQSQSX..P3=SUGIPFIMNRQE.TMA..P6=MNHWOTMLOHTPVRFXPCH..P0=DAN127..P1=e8a0d5af432b7e64DBD..

C:\Users\user\AppData\Local\Temp\5950203\....\TemporaryFile (copy)

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1390312
Entropy (8bit):	6.599443687044708
Encrypted:	false
SSDEEP:	24576:w4wwwwscgymwef8Z8Zzj6z1el68mUi1m/ONxdDDHNCU+3kvaBW7839l5Qafgb6L1:pwwwwscgymwefyEQ/U6/NnDDHNCTeaBf
MD5:	292575B19C7E7DB6F1DBC8E4D6FDFEDB
SHA1:	7DBCD6D0483ADB804ADE8B2D23748A3E69197A5B
SHA-256:	9036B502B65379D0FE2C3204D6954E2BB322427EDEEFAB85ECF8E98019CBC590
SHA-512:	D4AF90688D412BD497B8885E154EE428AF66119D62FAF73D90ADFFC3EEF086CF3A25B0380EC6FDC8A3D2F7C7048050EF57FCEA33229A615C5DCDA8B7022FA237
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0...0...0...9a.=...9c.I...9b.(...b......b.. ...b..&...9...1...9...7...0........4................1....o.1.....1...Rich0...........PE..L....x.c...........!.........~......x7...............................................~....@.........................P...\|......P....p.................P,..........0...............................P...@............................................text............................... ..`.rdata..............................@..@.data...0........4..................@....rsrc.......p......................@..@.reloc...............B..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5951156\....\TemporaryFile (copy)

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe
File Type:	data
Category:	dropped
Size (bytes):	2713088
Entropy (8bit):	7.9358560764847
Encrypted:	false
SSDEEP:	49152:gCE0mvBnEwvJm7T8UyHNzeBBHKZlYU13/1wUqq7vf2h0Vw:gCZmvBEqUyHcclt/mUCOa
MD5:	C625FE50C8CBC877CBFAF1D5212F02C0
SHA1:	90763CBEB446C7638F80851E55AF9976285DC56C
SHA-256:	F8890DFA4609D9CB2CA685339468C5256356066CF91AB13C9A771A3B8A566D12
SHA-512:	898703B75D27A9EE5055965BE16D7DEFA482A4199D6C008E539A0102230743AD4540945B76E78804F4CFA99D3DE79B9584D91F6C74C3FF2E6B8F4CC09E7F472C
Malicious:	false
Preview:	...SLSSSOSSSPPSS.SSSSSSS.SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS[SSSA..AS.J...R..................................FFE.SSSSSSSB.....t5..t5..t5..x5..t59..5..t5y.~5..t5...5..t59..5..t5..u5..t5...5..t5..t5..t5...5..t5..p5..t5......t5SSSSSSSSSSSSSSSS..SS.RLSd..SSSSSSSSsSA.DRISS.SSCSSS3.S.E.SS#.SSC.SSSSCSCSSSMSSOSSSSSSSOSSSSSSSS..SSOSSSSSSMSSSSSCSSCSSSSCSSCSSSSSSCSSSC..S.SSSSC.SCMSSSSSSSSSSSSSSSSSSSSSSSSSS...SGSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS....SSSSS3.SSCSSSSSSSOSSSSSSSSSSSSSS.SSs....SSSSS.SS#.SS.SSOSSSSSSSSSSSSSS.SSs....SSSSSCSSSC.SSOSSS.SSSSSSSSSSSSS.SS.SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS....S....FJKH

C:\Users\user\AppData\Local\Temp\5951187\....\TemporaryFile (copy)

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	333824
Entropy (8bit):	6.389952178495305
Encrypted:	false
SSDEEP:	6144:WyEhWbJNOcWd55OHSCw1ohITXVvrJGqdK2Dug6dGXLSuMAFi2TBfR:Wlu1IjOIohILJrc4Ezui2TdR
MD5:	EC9483F4B8C3910B09CAAB0F6CB7CD1B
SHA1:	9931AAA8E626DF273EE42F98E2FC91C2078FDC07
SHA-256:	4D9CAE6E2E52270150542084AF949D7B68300E378868165FF601378A38F7048F
SHA-512:	84B60FE3CD0EDE19933B37AE0EAEBA1F87174A21BC8086857E57C8729CEC88F9FEF4B50A2B870F55C858DD43B070FD22FFEC5CB6F4FD5B950D6451B05EB65565
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...z..S...........#................ .............$k................................. ........ .........................c.... .......`.......................p..\|$...........................P......................."..h............................text...T...........................`.P`.data...t...........................@.`..rdata..L.... ......................@.`@.eh_fram............................@.0@.bss..................................`..edata..c...........................@.0@.idata....... ......................@.0..CRT....,....@......................@.0..tls.... ....P......................@.0..rsrc........`......................@.0..reloc..\|$...p...&..................@.0B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5951218\....\TemporaryFile (copy)

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1063616
Entropy (8bit):	6.674869382282474
Encrypted:	false
SSDEEP:	24576:2ODivXdRxWmQOhfbV5l7kZLWfGPeu/PUw6WmARlXDMmH6PBzT/Cn+m4q:2OuvbfGZGGKJT/Cn+Fq
MD5:	4FF45827EC92E40935F9939142CD40DC
SHA1:	CAD74928F3387E6BF28C3625803706061E956B34
SHA-256:	012ED8D16E9F7586FE44C0AFFE5BEA6FF68F27231A6526D439643869A103E434
SHA-512:	A3DFE7976E5FFB4BA0C68E218C0924568D343E7937ABB50785107DE5E0ADC11AD58A86E02FABB455845FBE8E545E48B57A67EB647C664390ED521D255FF3BEFE
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...~/._.....................j...................@................................. ...................................{........3.......................@...........................................................................................text...0z.......\|.................. ..`.itext.............................. ..`.data...D...........................@....bss.....e...@.......0...................idata...3.......4...0..............@....edata..{............d..............@..@.reloc...............f..............@..B.rsrc................V..............@..@....................................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\5951250\....\TemporaryFile (copy)

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	388808
Entropy (8bit):	6.5956896905460125
Encrypted:	false
SSDEEP:	6144:B9su6Bohl2JJmgk1G8M0uQoRkQsKwxBF6CaSIU9ILZxxB5ARUWvAX+E:BSohl2JJmgk1U3QMkQsTx3paSIUixGRI
MD5:	B8253F0DD523BC1E2480F11A9702411D
SHA1:	61A4C65EB5D4176B00A1FF73621521C1E60D28EA
SHA-256:	01CEE5C4A2E80CB3FDAD50E2009F51CA18C787BF486CE31321899CCCEDC72E0C
SHA-512:	4C578003E31F08E403F4290970BC900D9F42CAA57C5B4C0ACA035D92EDC9921BF4034FC216C9860DA69054B05F98DADE5F6E218AC4BEE991BC37A3EF572FE9A0
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...8..^..........................................@..........................P..........................................c....p...........N...............<.......g..................................................Ts..P............................text...T........................... ..`.itext.............................. ..`.data....).......*..................@....bss....<X...............................idata.......p......................@....edata..c...........................@..@.reloc...g.......h..................@..B.rsrc....N.......N...d..............@..@.............P......................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\5951281\....\TemporaryFile (copy)

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1165576
Entropy (8bit):	6.491752155251347
Encrypted:	false
SSDEEP:	24576:ptf4OLWmQQ3b6ZVtecP3Ufy/ilDqzybXIZ0xKHpWq0dGcz7msH0WQWmAdA7yJBzA:tLDlDgRGxKHpSJ28TU
MD5:	D75E14313FC8A0850F3190CE67509475
SHA1:	74474830BC0706E5C0A8B455A4E1B47D9F1DE741
SHA-256:	E5C711BDB99AB55EBD96B3636C7396566C98ACFFD03DF735A15F1E18936A718A
SHA-512:	A4260F1A9A77BC41FC54532BDBF51F831004767E08150BFF95374663930BBE4FCA81790AA4578C062674557A02A698EA798CFC00F2355F6B8FA71BF2915CBAAA
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......`..........................................@..........................0.......4...............................`..e....@..v........^...............A...p...Y...................................................C...............................text...x........................... ..`.itext.............................. ..`.data....".......$..................@....bss.....Y...............................idata..v....@......................@....edata..e....`......................@..@.reloc...Y...p...Z..................@..B.rsrc....^.......^...*..............@..@.............0......................@..@........................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\New

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 16 colors
Category:	dropped
Size (bytes):	318
Entropy (8bit):	2.034441580055181
Encrypted:	false
SSDEEP:	3:PFErXllvlNl/AXll/lFl/Ft/HtAiotuZt/nZllBe+llBe+llBe+llBe+llBe+lll:k9ij1BjjjjjTtXGuwtOZBl
MD5:	C23CBF002D82192481B61ED7EC0890F4
SHA1:	DD373901C73760CA36907FF04691F5504FF00ABE
SHA-256:	4F92E804A11453382EBFF7FB0958879BAE88FE3366306911DEC9D811CD306EED
SHA-512:	5CC5AD0AE9F8808DEA013881E1661824BE94FB89736C3CB31221E85BE1F3A408D6E5951ACCD40EE34B3BAF76D8E9DD8820D61A26345C00CDDC0A884375EE1185
Malicious:	false
Preview:	..............(.......(....... ...........................................................................................................................................................................................................................................................................}..................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\Up

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 16 colors
Category:	dropped
Size (bytes):	318
Entropy (8bit):	2.0369361465218003
Encrypted:	false
SSDEEP:	3:PFErXllvlNl/AXll/lFl/Ft/HtAiotuZt/nreBB+eKemhlRhmeemfB+ll5evZ/Xy:k9ij1KBBhK9jwmfBuiKaq5n
MD5:	83730AC00391FB0F02F56FE2E4207A10
SHA1:	139FED8F0216132450E66BDA0FBBDC2A5BD333AF
SHA-256:	573E3260EED63604F24F6F10CE5294E25E22FDA9E5BFD9010134DE6E684BAB98
SHA-512:	E3DBE1956BB743FD68319517D1D993DDA316C12BBBBBBD6F582ECDD60C4FDE24CC4814C7AB36ED571F720349931EAC10B03E9C911BA0F4309B10604B2C56C6A9
Malicious:	false
Preview:	..............(.......(....... ...............................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\WHelp.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	5.750662778266912
Encrypted:	false
SSDEEP:	384:95235sQR6i6oI6rHjdbWqmQB5hw2l5HYsakk7BKfEDHIanumzKO732M/foo9d2:32mQV63qjh/pokkkfEDznzFhfoo72
MD5:	65786F45F119E213FCCF15B070944F96
SHA1:	F3F4CB3286E36E4908211CC940256F962DDD0836
SHA-256:	C3E569DD4A0A7E19BE1A8F523C16790BA87CB68755F5EB6295A834F40010FF3C
SHA-512:	8C52A1FA91D7F7111F94C83AA0719B365F16B9CE0465C038F4891232917D6E4346983898D087EBA0FFF3A7E09C01A4DAE405F0F42D5B2B291FD4FBA509B13431
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.d;&u.h&u.h&u.hI..h3u.hI..h(u.hI..heu.h/..h!u.h&u.hku.hI..h$u.hI..h'u.hI..h'u.hRich&u.h................PE..L.....\g...........!.....N...V...............`............................................@.............................P...<...P................................................................... ...@............`...............................text....L.......N.................. ..`.rdata...*...`...,...R..............@..@.data...@............~..............@....reloc..b...........................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\blue.jpg

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 355x304, components 3
Category:	dropped
Size (bytes):	7379
Entropy (8bit):	7.675014430898698
Encrypted:	false
SSDEEP:	96:Zs7nc2Efd4WLNlTSGJG8J+F1sGaPEl1M5np44DE4wA2A+fHDeGWhzrd7yf8TJWpC:ZsA2DqTRUUQMT4LxjPWhzrNyiFI5Ip
MD5:	6F1B5342D1B781596A4FEC79112DCB0C
SHA1:	08BDEDC9F65FC3A5F6D13D3EF0502769ABE4BD05
SHA-256:	3986699B9B4BE2F8C1747A37E74943F78870623701F08C90CAA007B4DE17924C
SHA-512:	FAE8A651E1DAF872A24FAE87D477F286CAD599DC232A716DBBAD7F091236DA80C71C30B990B6E2F4FF7E06D4414876DB756B452272A9A3E4B3EC1BC32B9E30D5
Malicious:	false
Preview:	......JFIF.....d.d......Ducky.......U......Adobe.d.................................................................................................................................................0.c.......................................................................................!1AQ..aq..r....."2BR.S...b.....#3C.%...c$4TE..&..d.Ue...5F.......................!1Q.."A.R....B.a..............?...}.)I..k....[.W.........z.(..`...[.`..P.kC\|.U...V*.R..X.)5J...).\|.c)..[O.....S.k...wo$.9r......>e.l..8nH.o..}is...{.....8jH....Os..r7$r....F.s..rk]3....;.e...d..8..%...o.W.Y>rk]3......b...?..9..g...\|.........5..x9/w.~....u.....\|#.}..,.o4...&.........Q]....+).....tq..\...w....~0...r......T.......j..\|#..._1...y.}.........>d..<;.y.}..&.?W.......2.....%..E..&.....;...!.....yoW/po..W.hmt......#...v..........o7..R'Uv....O..~a..{..y.......m_....\|...t....}.........>..D......x.\|..6..~..a..>m..~w..oW..Hm'..L.8......vV...nG..w..s.[....3.....<BN..}.If...&..&......\|..s..c}..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\cmdlinkarrow

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	MS Windows icon resource - 3 icons, 16x16, 16 colors, 4 bits/pixel, 16x16, 8 bits/pixel
Category:	dropped
Size (bytes):	2862
Entropy (8bit):	3.160430651939096
Encrypted:	false
SSDEEP:	48:QFFZ+f+zd+kHeNTM9/+Xz++++++++YWWS0i6I:QFFEw4Xc+D++++++++ypi9
MD5:	983358CE03817F1CA404BEFBE1E4D96A
SHA1:	75CE6CE80606BBB052DD35351ED95435892BAF8D
SHA-256:	7F0121322785C107BFDFE343E49F06C604C719BAFF849D07B6E099675D173961
SHA-512:	BDEE6E81A9C15AC23684C9F654D11CC0DB683774367401AA2C240D57751534B1E5A179FE4042286402B6030467DB82EEDBF0586C427FAA9B29BD5EF74B807F3E
Malicious:	false
Preview:	..............(...6...........h...^......... .h.......(....... .........................................................................................................................................................wv....."""""o.."""""o..www""......"/.....""......"/......r.........................?...........................................?......(....... ..................................................."..... .". .6.-.9.;.<.;.D.3.,...4...9...O.,.Q.$.M.2.S.:.\.1.U.$._.1.F.G.I.A.`.@.w.q...\|...q...{.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\complete.ico

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 16 colors, 4 bits/pixel, 48x48, 8 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	5.432735724336821
Encrypted:	false
SSDEEP:	192:lN3tnZnyRZF64hc28fwy+aXE25b6K0FHQHVd42oJ2zwZlaw484:lN37Yai8IaD5T0FHQHg29wZla04
MD5:	3EAFE3AE99BF33E9F59D970F21EBEF39
SHA1:	E9895CB920FDEB8907CE37D9666D4999A1DE5D2F
SHA-256:	5F6C78970EE7E3D668EB8A4ACB5D251C76599424A0B0372E7665527516D4C312
SHA-512:	8983717D464AC046A8A272276E90D3D1FD7900D2D89998FC332E420ECA4F01FCFBABB390667B4324C549D0655E62E181E3E7BEED514C5B9B67D0F8D480A9388D
Malicious:	false
Preview:	......00......h...6...00..............00.... ..%..F...(...0...`..........................................................................................................................................wwww........................p..p........w...........p.w...p....x.....p.....pp........wx.............p....................q..............................................................................................wwww...............................................................................................................................o.....p.................o.....p..............................................................................wwww........................p.......................p......................pp.....p.................p......w.............q........ww`h....................wwp.........p..........wwwwp..................wwwwwwp.....p...wwww....wwwwwwww.gp..............wwwwwwwww...............wwwwwwxwwp..............wwwwwwx.ww..............wwwwwwx.wwp...........

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\custom.ico

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 16 colors, 4 bits/pixel, 48x48, 8 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	5.4001074083138745
Encrypted:	false
SSDEEP:	192:lN3tnFnyRZF64BiTfwy+aXE25b6K0FHQHVd4RhE2zwZlaw484:lN3XYa5TIaD5T0FHQHgRfwZla04
MD5:	1B5701D7F753135C22CC1AE694FFAF4B
SHA1:	966BDEF4159022FCC8740B6EB75B8D7AC4212504
SHA-256:	AEBA695175ED96D3EDE9FE30E486DF59C64A5FD802C15CB67F55E03A0537CD13
SHA-512:	4069B6AC1E51703687E0C17EA83527A258FF0C4BB4DC8051C96E5F98A7902C3301B89A5D2B55872711F85F528B0FB9BAEAF94E93B49B0A48BB8912E06A204EAC
Malicious:	false
Preview:	......00......h...6...00..............00.... ..%..F...(...0...`..........................................................................................................................................wwww........................p..p........w...........p.w...p....x.....p.....pp........wx.............p....................q..............................................................................................wwww...............................................................................................................................o.....p.................o.....p..............................................................................wwww........................p.......................p.......................p.....p.................p......w................p.....ww`h..............p.....wwp.........p.....p....wwwwp..............p...wwwwwwp.....p...wwww....wwwwwwww.gp..............wwwwwwwww...............wwwwwwxwwp..............wwwwwwx.ww..............wwwwwwx.wwp...........

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\exclamation.ico

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	MS Windows icon resource - 2 icons, 48x48, 8 bits/pixel, 48x48, 32 bits/pixel
Category:	dropped
Size (bytes):	13430
Entropy (8bit):	4.339511276304085
Encrypted:	false
SSDEEP:	96:KYvlkFEXFYU2+yCvIFA13cJ/rrrrrpbEn5UnanjPRZfZy1wvI8:bVXuzd6IF0czwNPDZfI8
MD5:	93D722FA20A988A5C257A58BF155DC66
SHA1:	30C0D19F02CB39F8804DAFE6AF483A09C76E2338
SHA-256:	F587867EED0BEC33EF150F3A8525BDE9B6746C705543874E56653AA80EA53225
SHA-512:	BFB91739AE7432DD7D0A919F15B5B721E733675C3C2A4D5238C9955A6517DD4653042FA444F2D2627508908F6DA7DE0FBF22F37CF1A60476F59CBF254F62F736
Malicious:	false
Preview:	......00..........&...00.... ..%......(...0...`....................................-...<...I...L...P...S...S...T...G...@...K...V...W...Z...\...]..._...C..^...`...`...f...a...f..&e.."f..n..)v..3w..5v..2x..7\|..8}..<}..B}..._...e...k...a...m...p...t...r...z......5...M{..............,...0...+... ...,...<...?...<...:.......................................;.......-...!...-...................................................#...#...*...6...5...;...'.../...#...(...,...(...,...:...;...6...1...:...A...@...K...J...L...B...A...S...D...K...V...\...R...M...M...K...M...e...`...`...k...d...m...s...z...Y...e...}.......z...J...G...J...B...E...V..._...]...U...[...Y...Q...L...G...F...B...M...J...P...[...R...\...P...Z...b...i...e...b...l...f...u...~...b...k...g...m...c...s...z...5...<...C...J...N...T...Z...U...X...]...g...c...m...c...h...z...s...z...t...}...i...r...u...t...~.....................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\externalui.ico

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 16 colors, 4 bits/pixel, 48x48, 8 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	5.036354960673055
Encrypted:	false
SSDEEP:	192:q4lYOUfhBJ1gqASunI8FoQaaJ+nkt0p1b+v:q4leXXArnI8FoVa4nP0
MD5:	235E54EB7ACEA02DC322F4065498165D
SHA1:	AD825997EC58A33A164B471FE3BD4B7C74614D9A
SHA-256:	B294EDF73CC936610CC81BCA6B95D1C7D6091595EC074C6B334ECA45D2DC354F
SHA-512:	5AC20371FD09E6A1F8C134FB24C045C36D835544D04E681FB6A51ADFF12A6BF8225C53D865B601EA5452024ABE7C02204A759B317D7410CF59F66ADFBE089D5C
Malicious:	false
Preview:	......00......h...6...00..............00.... ..%..F...(...0...`........................................................................................................................................www................p..........................h.....p.........................................................................................................................p.......................p............................wwwwp..................wwwwwp..................wwwwwp..................wwwwwp..............p....wwww.................................................................wwwwwwwp....p........p.............wp.....................wwwp......p....wwwwwwp..wwwww.w.w...............wwwwww..................wwwwwwwp.....x..........wwwwwxww.....x..........wwwwwx.wp....x..........wwwwww.ww....x..........wwwwww.ww....x..........wwwwwwxwww...x..........wwwwwwwwwp...x..........wwwwwwwwwp...x............wwwwwwpp...x.........wp.......xp...x........x..........p...x...............wq..p...x.

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\fhjyy.exe

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175328
Entropy (8bit):	6.879935553739908
Encrypted:	false
SSDEEP:	3072:jnrQnzMYywmn3h1sp7/WvCnIukR4BbxKigu/fgl1glfdjgBftJeCEEzx4N7mcr5:XQnzXtr7tbxKVuE1gQJeCEMx4p
MD5:	BE4ED0D3AA0B2573927A046620106B13
SHA1:	0B81544CD5E66A36D90A033F60A0ECE1CD3506A8
SHA-256:	79BF3258E03FD1ACB395DC184FBE5496DFA4B3D6A3F9F4598C5DF13422CC600D
SHA-512:	BD4E0447C47EEA3D457B4C0E8264C1A315EE796CF29E721E9E6B7AB396802E3CCC633488F8BEEB8D2CF42A300367F76DEDDA74174C0B687FB8A328D197132753
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............d..d..d...g..d...a...d...`..d..g..d..`..d..a..d...e..d..e..d...a..d.....d.....d...f..d.Rich..d.........PE..L....]d............................S#............@.................................>.....@.................................d8..<....p...............d...H...........*..T...........................H+..@...............$............................text............................... ..`.rdata..._.......`..................@..@.data........@.......4..............@....gfids.. ....`.......>..............@..@.rsrc........p.......@..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\info

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	MS Windows icon resource - 2 icons, 32x32, 16 colors, 16x16, 16 colors
Category:	dropped
Size (bytes):	1078
Entropy (8bit):	2.8642269548572474
Encrypted:	false
SSDEEP:	12:hEipI3VFpSyZ9I7imddddGDxxOxzma3ZmRgRtqVtipMLXwHqfM:hEigFpTz1xA6aJmRgwi6LgHcM
MD5:	554FF4C199562515D758C9ABFF5C2943
SHA1:	9E3BAB3A975E638EAD9E03731AE82FA1DBCD178C
SHA-256:	9AE4A96BF2A349667E844ACC1E2AC4F89361A6182268438F4D063DF3A6FC47BC
SHA-512:	E302EDF3DAB3A0E9EEB5AFA34E4910EE177099C017B42F86847CF972143C87E8C40BC47689A3C8845051EAB98258A392CCAF331F414C271A1B6B751F503CE221
Malicious:	false
Preview:	...... ..........&...........(.......(... ...@.........................................................................................................p..............wp...............p...............p...............p...............p..........ww...ww........wp....www..............wwp..............ww...............wp..............ww...............wp..............wp...............w...............wx..............w...............w...............w...............w...............w...............px..............p............................................................................................p......w.......w........wx....w...........wwwp.....................................?...............................................................................?................(....... .............................................................................................................................p.......w..x.....p.......p.......w.................................................w

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\info.ico

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	MS Windows icon resource - 6 icons, 48x48, 8 bits/pixel, 32x32, 8 bits/pixel
Category:	dropped
Size (bytes):	22486
Entropy (8bit):	5.511908704029649
Encrypted:	false
SSDEEP:	192:0DT6aNn0CgAevbxezcSptuGH0BJ1cBYehJjbQypQ6X8rdb:/aNn0DAoN4c8HH031/QQ6XWZ
MD5:	FD535E63F539EACB3F11D03B52B39A80
SHA1:	A7F8C942E5672F2972C82210A38CC8861435F643
SHA-256:	0086BC01150989F553A0A4AE0E14926C6E247CEDDA312E1F946AE35D575742AB
SHA-512:	716EAB95B5535D54359D12C9786F5A53F9560126D2C48EB1A94DB5BD383363B43EA686AC421080564B54450DA35AF9CE3E11CECD485AAF27C0CEAEE7836F4518
Malicious:	false
Preview:	......00..........f... ......................h.......00.... ..%...... .... ......B........ .h...nS..(...0...`....................................B...C...D...F!..H#..I#..J%..L&..N)..Q+..S-..U/..V5..W1..Y3..Y4..[5..\7..]7..]9.._:.._<..c?..`9..c=..d>..d=..`@..eC..fB..gD..hA..iF..kF..lG..kN..kI..lJ..oK..nL..jC..lE..oG..qO..pH..rN..rM..tO..uO..sK..uM..wO..pT..sP..vW..w]..tQ..wT..yV..xQ..zQ..{U..zT..\|T..{Y..}Z..~Z..~X...\..}U..}d..[..^..^.._..W..Y..Y..[..]..\..]..]..].._..f..l..`..q..w..u..t..x..}..{...b..`..b..b..e..g..`..d..e..k..i..n..i..m..q..u..x.....z........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\lzmaextractor.dll

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16328
Entropy (8bit):	6.530762223829305
Encrypted:	false
SSDEEP:	384:POw0cwpdr9ee/PTG3eK4i/8E9VFL2UtCsDkm:POAwLge/PaeKeEdKTm
MD5:	F1F56D26D0244DC52C1932C72BC27D7C
SHA1:	58D42600E3B54227DF0A2C600D8783C1B7B282B0
SHA-256:	43E55A6CBE1AB609A23BA1A462BC688FB1CD4CDD5E6EDFB79031FA8F502E6DDC
SHA-512:	B94D886136016A832663D7F423D6CA9ABB4C1342930CE46B6B8F319AF7C96350C4DB421C79254EEF4A8431831F5CABE758E7C8B3E5FD36A6CE93405AC8334012
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......>.t9z..jz..jz..j...ku..jz..jJ..j...k...j...k{..j...j{..jz.j{..j...k{..jRichz..j........................PE..L...x..b.........."!... ............@........ ...............................`............@.........................P".......$.......@..h................#...P..\....!..p............................................ ..X............................text...)........................... ..`.rdata..X.... ......................@..@.data........0......................@....rsrc...h....@......................@..@.reloc..\....P......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\minbackground.jpg

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 760x100, components 3
Category:	dropped
Size (bytes):	15366
Entropy (8bit):	7.95557428882131
Encrypted:	false
SSDEEP:	384:ZsgYb2FNX3lLAvWkoFQVHunMJkaCxzpsEo9fDC79Vh4Vcj:ZsgYbuN3Gb/HunMJbWtl8rQ9ffj
MD5:	845B155C2F68096094B443873E5A6142
SHA1:	A1167CADC4ED424BFC9AABF61B3E0EDBE6FFC818
SHA-256:	70FFF5DC4ECCA73EF601BD78A67EAF0141079EBA11FC9659EC4C4A4AA5C78C9E
SHA-512:	60B9165D37600A5EB1563CA8C69579C2DEE8ECFAD8BF60580DEB7307607BDDE33BEBAA07C3E35D94366FDC4D403747049AA758D4096519836E11BF7CE0326040
Malicious:	false
Preview:	......JFIF.....d.d......Ducky.......U......Adobe.d.................................................................................................................................................d............................................................................................!1..AQ.aq."2.......B..Rr#3..b...CS$..s.%..T.....................!.1.Q.Aaq......"2..#...B.............?......=.u..[..7M.+v.p.H...6....:Y.........f.O...RK...)tH9...2D.....ZGI......P.QU..M....;1.W....\|J......\O......g.=W..n'......Y.7U.&..._.w..n..UW..k....Q...U^.6.Sa.w....U^..wSTy..L....W....y..)..z..qaq&.c.).gMR.X.&.c.)..C.......u.!....X....j..A..v...MF.D.h..Q....T.4.n..GC.f7H..S..,{.Lt.-..P.i0e./a..^I.&......~.u%d0...J..9..#....(~I.%d........&s].YB....)..,ah.H..b.sY.-..41.\|.4.o#Hm...L..U...x.h.[....vj.....Q.....]upp..Cn...Y2VA1@j8e..d.......n.N....[@.S..US&...$.{1FI0.x....s%i.!...W..,....cJ.......hI.``..P...n$.c..7....e..Q.]..4..I.%...cI..@..D\..iE...4..C..EV...v..&~OQ.a

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\remove.ico

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 16 colors, 4 bits/pixel, 48x48, 8 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	3.6742809399919576
Encrypted:	false
SSDEEP:	192:4cYE5eZRboMB6f5iR59urg5N+qdrzt2eYi:4cAshf5quryvdPwzi
MD5:	AA0A5F0280C98006741B6CB56C3A360E
SHA1:	AC820BBEC6D08545A4A4818DF9EB09B521BF2E40
SHA-256:	2AC61CEA48CCDB1751CB6B93BA90267508ED6AC900B2E2AC6EAD172C9B8958F2
SHA-512:	7646B3786039711FD60BD9C82A2CBAC51CAA75626CD1695F29EF4939637F60118F6B32B6B781EC57D6F478091C33DC886B2B6C3751B948CD0E916E617C52B254
Malicious:	false
Preview:	......00......h...6...00..............00.... ..%..F...(...0...`...................................................................................................................................................w......................wwp....................w..w....................x..w...................w...wp..................w....p..................x....p..................x....w..................x....w..................x....w..................x.....p..........xp.....x.....p.......................w.......................w.........x........x....wp........xp.............p.......w.p.............w.......x...............w......w................wp.....w.................w....wx.................w....w..................wp..wx...................w..w....................wwwx....................wwx......................w............................................................................................x.....p.................x....wp................w......wp..............wx......ww..........

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\repair.ico

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 16 colors, 4 bits/pixel, 48x48, 8 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	5.656471862600903
Encrypted:	false
SSDEEP:	192:+q2qe82nprAWkcWFW57oVht/k2VxomK0qHTk4TdrofvMxnVRYAn4vf:ej84ArgojFTVxoz0qHNTdr+vKVRYAIf
MD5:	4DBA3637F5FCEAADD2184BD8A0F0FB95
SHA1:	A858418C32F5D45F15AB01CAFC652B507DE2A42B
SHA-256:	C1AD1E78A112974326B44F75FE302723A4FC8AC1CCD96C9887403F6DDF8E607D
SHA-512:	DA105188273312DD1C79D90C2A1AE17ED584A70C14BCD662EAB3B7FC99D7A91B30957D965498E6FB397E01EA72ED3EA0AB8BDBB4313E68E8E45073B87E412E26
Malicious:	false
Preview:	......00......h...6...00..............00.... ..%..F...(...0...`...............................................................................................................................................................wp...w............wx..ppw....ww..p.......w.....qx.......pp......w......q....x....p..................x....p................p.x....p..............p.x....p..............p.x....p..............p.x....p..............x.x....p................x....p...............w..x....p...............q..x....p.............p....w....p..................w....p..................w....p..........p.......w....p.......................p.................p..w..p....................w..p....................w..p................p...w..p................p...w..p...wp...........p.w.w..p...wv...........p.w.w..p..www............wx..p.p.wwwww.x....p........p.p.wwwwww.x..x.....w...p.p.wwwwwwwp.w........pww.p.wwwwwwwwwp..x..w..w...p.wwwwwww.ww...ww.x...p.p..wwwwww.wwp.....w..xp.p..wwwwww.www...........p

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\rtlothree_colors.jpg

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 760x17, components 3
Category:	dropped
Size (bytes):	3420
Entropy (8bit):	7.841479572759416
Encrypted:	false
SSDEEP:	96:Q6PKp1qGfXtGjelIs3Qj/y6+/yzyQguDYfE10JeOWMm+1Q:Q6PKpsetGsZQj/j+4jKE11OW+1Q
MD5:	A45540685353D14EB9B2344F556F672B
SHA1:	C540395FAFD4D23A5614B5A692080D3B07DEBCAB
SHA-256:	CE18FC834CEA0215B8BD6EB1C66586B4904FC7FCE758F6CBB1E9EB6FC004F338
SHA-512:	69DAFCD7BDCDF72E352EDFC67DF2C58FDEA22A6779702FB00670B90619DD0D673B8FB74E7047F7CB807AACEC08533A128DC437AFAB054C9FCB911D7C2779FCF3
Malicious:	false
Preview:	......Exif..II*.................Ducky.......U......Adobe.d...........................................................................................................................................................................................................................................!1.AQ.aq.."2.3.......B.#.R..r4........................!1AQ..a..."2...B............?.....}=...5....6..9....u]A@1....G.x.f.~...]i...VpKw....+[f.....q...i.4.M.;Kz..}=.-.....7B...............?...W..?C.........R........K...5...+JU,............^..Oik......dL..".x.q/ ..m.l.k.Z.e..j.L..=..&...K._Px.@h.w..X..[zV...}mk.ZL.....3-c. ....2...... .^...z............Q..E.A..d..h.......\...}6uV.3.....t...!.~.f......l.....J^z.G~.&...e....A.c.$...]PG.(hjF.S^+.].k~...<.[t..Qt2:.d...-..c\.e..y1M...m.....'.{.ei...`d....k...1....2.O.CA..&.'.>O..[...........i.M...>X..B..F..=.s.-...<.......N...6....[Z.943.f....NMr<E.W%I.ro..#..ro.....nj..6......b.F...k..U.B-bu.=.b..Bi........e<...U

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\three_colors.jpg

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 760x505, components 3
Category:	dropped
Size (bytes):	26619
Entropy (8bit):	7.547741155491426
Encrypted:	false
SSDEEP:	768:Zsra5o/C+tKDDPW4I++xCsuOlApLTEDjeEImcF:jaQD6DVCsBSpL0eEIFF
MD5:	718CAFA7E04A8D4D98116BCB4C377D7F
SHA1:	38A1EAC1E72997FFA9FB01BDE2540B18F046A3F5
SHA-256:	FBE48BA8AF8CC23A66906A1E94AC10D86CE91B86A18531CE1C96D6061387C2B5
SHA-512:	0FECEB6C7AC536B985198C63008668424DA51E628656706DE30E472DAEA49380F5D25187A268E8BF2E3740AAB6A8ED1171EC4E2C6A69699BAB7DB5B619CB36EB
Malicious:	false
Preview:	......JFIF.....d.d......Ducky.......U......Adobe.d.............................................................................................................................................................................................................................................!1..AQ.aq"....2....BR#....3..b...r..$...CS.....c....vX4.f'G8.......................!Q.1.A...aS..q.."2RC..B...3............?....um.\|:....o..H....e..W'...e."......X.o^.9{.<.sY.........nk;7.....K.S.W....;...$..3Sk..6w[._...k..Y....n......t...Gk....^.k..t...Sg..U..,...v.Y..lw7p....M...v{....<O...^.d{[..0.?{5..I......>y...#..]m$.ztz.)6..z.z.'-K.=:.m.O....W...X&.Ez.8.+q....u..b.=...].m..>.5...8?...k.....(...p.r.=.[H6...6...M.aG....h....\|.I^m.ee9.....e../ccf)-*.....}.LjQP.....m..Y.aW.5+...y.[...k.y..-......:.......p....v..{..m.6.:..bt..-..1JR^..7.\6.CmbR..8.es....&.O......"...sle}].{tU../...iVg)]. ..&Gm.,0.GM.....Kp.km.q..M.g....j.....C.[.DK...U..8BQk....Te...v......a.EJ..

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\typical.ico

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	MS Windows icon resource - 3 icons, 48x48, 16 colors, 4 bits/pixel, 48x48, 8 bits/pixel
Category:	dropped
Size (bytes):	15086
Entropy (8bit):	4.926016576393048
Encrypted:	false
SSDEEP:	192:entnoFoTahmFxRYq7mE25b6K0FHQHVd4oXb2zwNf3i4ij:enWuPFxt785T0FHQHgo2wNf3oj
MD5:	EB3F9054BB5F95ED6B10EC4E16A026BE
SHA1:	35760271A03029996BDA26D5D596CFCC465E3EA9
SHA-256:	E330FA8030AA0465B02880133ADDBA0A8C6011B511F6968B413BF45516F7275E
SHA-512:	B0A96DA5514A9B8E9FA182A294694299388A854245AEC01E835B1108D568F9F1158917D9792BC852568EC56C2ED5E54F9E630E02D1EC79A281E2B28A67167A51
Malicious:	false
Preview:	......00......h...6...00..............00.... ..%..F...(...0...`.........................................................................................................................................................................p........w.............w...p....x.....p...............wx....................................................................................................................................................................................................................................................................o.....p.................o.....p................................................................................................................................................................p........................w......................ww`h....................wwp.........p..........wwwwp..................wwwwwwp.....p...........wwwwwwww.gp..............wwwwwwwww...............wwwwwwxwwp..............wwwwwwx.ww..............wwwwwwx.wwp...........

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\white.jpg

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 493x312, components 3
Category:	dropped
Size (bytes):	1232
Entropy (8bit):	1.290282383283862
Encrypted:	false
SSDEEP:	3:nSullBbsRllAqp/y4FKKn5bbeWfa5QpUolHmBkDt0+EtZtE//Wmst18n:3llxqQ8AfQRGSDt0RZty/Wmsw
MD5:	57D130DDF327FCC5DA636A6AB4D7C112
SHA1:	D674F332D4F79C70D4A97BFD9E504A8F3A2C26B6
SHA-256:	990EAB9FAAAE9F78201EF00A72F7B59773EED2B2FC9EC72250C67F376EE0500F
SHA-512:	E2F2141973CD9B7B52347EBCC89E89FDDEAA5B9721011C2CD7B2F2EAE434EF0F10D02537EB0F1AD6276FA182147AE935277EF9BBE31960EE2D82437C0741D39D
Malicious:	false
Preview:	......JFIF.....d.d......Ducky..............Adobe.d.............).)A&&AB///BG?>>?GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG..))4&4?((?G?5?GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG......8...."..........K.....................................................................................?..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AI_EXTUI_BIN_5324\whitesmall.jpg

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 446x92, components 3
Category:	dropped
Size (bytes):	554
Entropy (8bit):	2.356721207995078
Encrypted:	false
SSDEEP:	3:nSullBbsRllAqp/y4FKKn5bbeWfa5QpUolG5PkDt0+EtZtE//WmstN8n:3llxqQ8AfQRG5cDt0RZty/WmsY
MD5:	4429F170056663EFD1486395E8EB0AF6
SHA1:	AE9B01A44C8EE5AE7146F0523E512EE32DC284AD
SHA-256:	FFE2980D90152EF603555A735B7CBA1917C99BB67061B44D6AC6F12E6384BDD9
SHA-512:	719F4E55944502F7D472F362DD0D1D09649FBAEC0515701C9C84BBB3F32B06CC29E4A4C55022BC034CBC68C9C151A90018A926D1A08B4D5048F117950E9135E9
Malicious:	false
Preview:	......JFIF.....d.d......Ducky..............Adobe.d.............).)A&&AB///BG?>>?GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG..))4&4?((?G?5?GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG......\...."..........K.....................................................................................?................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\INA8055.tmp

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	823240
Entropy (8bit):	6.404576447300874
Encrypted:	false
SSDEEP:	24576:rTaRpuaJXUUxsdScfjP3UtMMnNfXnUCCAs0+D:rG/uaJEisdScfbUiANfXnUCCAs0+D
MD5:	2E25B7DC66FC65D92C998D6FB1D09EF6
SHA1:	719CC9C0BBE12F040E169984851E3ABEA03D9CF8
SHA-256:	A01FB6763B11BA0CBF9B26FC8D45E933C2A6AD313BC9B12ED41AC67BAF2AA8C2
SHA-512:	7D4AF029A01CE60FC0787599C031C0DBFF7069311832A5587F003EA68EF739B22C8B01832E00801B0D17C12983C4D0E7877CDE58DE371886CFB6BE5B490F4C33
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$....................4.....4..H..........................4.....4.....4................................F..........Rich...................PE..L...q..b.........."!... .$...X...............@...........................................@.................................`........................l...#......@...h...p...............................@............@...............................text....".......$.................. ..`.rdata......@.......(..............@..@.data...............................@....rsrc................t..............@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI10E8.tmp

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI1118.tmp

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI8103.tmp

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI83C3.tmp

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	949704
Entropy (8bit):	6.466154972117666
Encrypted:	false
SSDEEP:	24576:sIwVz9EMURaglxM62wOR4H0kXiOfWo1OrEMBZX26PH2caU:n0OO62wOR4UkrfH1OrEMBZX26PH2caU
MD5:	8C98FC0407681EAC7FD69EA06DBF29EA
SHA1:	109C8E1BCF375F6FDCFA5B00F02E092E0678595B
SHA-256:	B4C7B684DDCEEC5D4A809D8A7F4B8D2CF87E5B866E0D83F389018F423295EC4E
SHA-512:	0A24D27B7982F314047977D4D219F53D7F4CBEDA9A2E72E4D328604E1FA183BFA670F0391CC70A5888E5C0747177B7AE5A1298E8F884FD8FD8515EA2FF9683D7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^.5.?.f.?.f.?.feM.g.?.feM.g.?.f.E.g.?.f.E.g.?.f.E.g.?.f.G.g.?.feM.g.?.feM.g.?.f.?.f.>.f.E.g.?.f.E.g.?.f.EAf.?.f.?)f.?.f.E.g.?.fRich.?.f................PE..L.....b.........."!... ............~...............................................k2....@......................... ...t............................Z...#......T....L..p...................@M.......L..@............................................text............................... ..`.rdata..D...........................@..@.data...............................@....rsrc................X..............@..@.reloc..T............^..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI8FBB.tmp

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI8FEB.tmp

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI900B.tmp

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI905A.tmp

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI90C8.tmp

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	823240
Entropy (8bit):	6.404576447300874
Encrypted:	false
SSDEEP:	24576:rTaRpuaJXUUxsdScfjP3UtMMnNfXnUCCAs0+D:rG/uaJEisdScfbUiANfXnUCCAs0+D
MD5:	2E25B7DC66FC65D92C998D6FB1D09EF6
SHA1:	719CC9C0BBE12F040E169984851E3ABEA03D9CF8
SHA-256:	A01FB6763B11BA0CBF9B26FC8D45E933C2A6AD313BC9B12ED41AC67BAF2AA8C2
SHA-512:	7D4AF029A01CE60FC0787599C031C0DBFF7069311832A5587F003EA68EF739B22C8B01832E00801B0D17C12983C4D0E7877CDE58DE371886CFB6BE5B490F4C33
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$....................4.....4..H..........................4.....4.....4................................F..........Rich...................PE..L...q..b.........."!... .$...X...............@...........................................@.................................`........................l...#......@...h...p...............................@............@...............................text....".......$.................. ..`.rdata......@.......(..............@..@.data...............................@....rsrc................t..............@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI9108.tmp

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	949704
Entropy (8bit):	6.466154972117666
Encrypted:	false
SSDEEP:	24576:sIwVz9EMURaglxM62wOR4H0kXiOfWo1OrEMBZX26PH2caU:n0OO62wOR4UkrfH1OrEMBZX26PH2caU
MD5:	8C98FC0407681EAC7FD69EA06DBF29EA
SHA1:	109C8E1BCF375F6FDCFA5B00F02E092E0678595B
SHA-256:	B4C7B684DDCEEC5D4A809D8A7F4B8D2CF87E5B866E0D83F389018F423295EC4E
SHA-512:	0A24D27B7982F314047977D4D219F53D7F4CBEDA9A2E72E4D328604E1FA183BFA670F0391CC70A5888E5C0747177B7AE5A1298E8F884FD8FD8515EA2FF9683D7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^.5.?.f.?.f.?.feM.g.?.feM.g.?.f.E.g.?.f.E.g.?.f.E.g.?.f.G.g.?.feM.g.?.feM.g.?.f.?.f.>.f.E.g.?.f.E.g.?.f.EAf.?.f.?)f.?.f.E.g.?.fRich.?.f................PE..L.....b.........."!... ............~...............................................k2....@......................... ...t............................Z...#......T....L..p...................@M.......L..@............................................text............................... ..`.rdata..D...........................@..@.data...............................@....rsrc................X..............@..@.reloc..T............^..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI9AEC.tmp

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	823240
Entropy (8bit):	6.404576447300874
Encrypted:	false
SSDEEP:	24576:rTaRpuaJXUUxsdScfjP3UtMMnNfXnUCCAs0+D:rG/uaJEisdScfbUiANfXnUCCAs0+D
MD5:	2E25B7DC66FC65D92C998D6FB1D09EF6
SHA1:	719CC9C0BBE12F040E169984851E3ABEA03D9CF8
SHA-256:	A01FB6763B11BA0CBF9B26FC8D45E933C2A6AD313BC9B12ED41AC67BAF2AA8C2
SHA-512:	7D4AF029A01CE60FC0787599C031C0DBFF7069311832A5587F003EA68EF739B22C8B01832E00801B0D17C12983C4D0E7877CDE58DE371886CFB6BE5B490F4C33
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$....................4.....4..H..........................4.....4.....4................................F..........Rich...................PE..L...q..b.........."!... .$...X...............@...........................................@.................................`........................l...#......@...h...p...............................@............@...............................text....".......$.................. ..`.rdata......@.......(..............@..@.data...............................@....rsrc................t..............@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi1C6D.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi1CCC.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi2A36.tmp

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shi8085.tmp

Download File

Process:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shiF3C.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4509696
Entropy (8bit):	6.100941182830929
Encrypted:	false
SSDEEP:	49152:jm+XAVAMPLfOyim8iTRxYUOQSfLTZZZ2y38lb7Cjn3mboy4+MT7ujWx/Tl0ng48e:CzVAwiKTOpfLTDQyaNoy787ujWx/TlR
MD5:	F6153E803F1533042AC7E6988237C2C3
SHA1:	DDA81BB8BC8CC14877C9CB9B7C664DEFD81EBB4F
SHA-256:	F42A771D310C762C05A5BE3DE0CFDB9BEC28D3DFCCAEF800C901F551A0DF30ED
SHA-512:	7AE76A4CB58A9929C09B1D6376073268622C74B1E3F0C346AFA7A7829E2EF136CCF091F58CCA28BFE83C665573C23D9DB6AF51A44275DA0CC2CF8C1306ADDBAC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........._.._.._..V.X.=..K..S..K..X..K..W.._.....K..^..K..-..K..D..K.4.^..K..^..Rich_..........................PE..L....+.X...........!.....dA.........P.3.......A....c.........................@E.......E...@A.........................i@.K&..L.A.......B.H.....................D..-......T....................O...... .................A.H....C@......................text.....@.......@................. ..`.wpp_sf.......@.......@............. ..`.data....6....A......hA.............@....idata...1....A..2...nA.............@..@.didat..4.....B.......A.............@....rsrc...H.....B.......A.............@..@.reloc...-....D.......C.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\shiFBA.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83128
Entropy (8bit):	6.654653670108596
Encrypted:	false
SSDEEP:	1536:0jIdYoF2CwmzOVStYMAuNWrmaTk++ouMOczT0ud4x41xmPS:0jRoFZwmr+bDk/MOcv0G4sxm
MD5:	125B0F6BF378358E4F9C837FF6682D94
SHA1:	8715BEB626E0F4BD79A14819CC0F90B81A2E58AD
SHA-256:	E99EAB3C75989B519F7F828373042701329ACBD8CEADF4F3FF390F346AC76193
SHA-512:	B63BB6BFDA70D42472868B5A1D3951CF9B2E00A7FADB08C1F599151A1801A19F5A75CFC3ACE94C952CFD284EB261C7D6F11BE0EBBCAA701B75036D3A6B442DB2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.T...:...:...:.....&.:...9...:...;...:...;...:...:...:...4...:...?...:......:...>...:......:...8...:.Rich..:.................PE..L...Y.............!.........H.......n..............................................;.....@A........................P........B.......`............... ...$...p..........T............................................@...............................text.../........................... ..`.data....!..........................@....idata..H....@......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\7z.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1390312
Entropy (8bit):	6.599443687044708
Encrypted:	false
SSDEEP:	24576:w4wwwwscgymwef8Z8Zzj6z1el68mUi1m/ONxdDDHNCU+3kvaBW7839l5Qafgb6L1:pwwwwscgymwefyEQ/U6/NnDDHNCTeaBf
MD5:	292575B19C7E7DB6F1DBC8E4D6FDFEDB
SHA1:	7DBCD6D0483ADB804ADE8B2D23748A3E69197A5B
SHA-256:	9036B502B65379D0FE2C3204D6954E2BB322427EDEEFAB85ECF8E98019CBC590
SHA-512:	D4AF90688D412BD497B8885E154EE428AF66119D62FAF73D90ADFFC3EEF086CF3A25B0380EC6FDC8A3D2F7C7048050EF57FCEA33229A615C5DCDA8B7022FA237
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0...0...0...9a.=...9c.I...9b.(...b......b.. ...b..&...9...1...9...7...0........4................1....o.1.....1...Rich0...........PE..L....x.c...........!.........~......x7...............................................~....@.........................P...\|......P....p.................P,..........0...............................P...@............................................text............................... ..`.rdata..............................@..@.data...0........4..................@....rsrc.......p......................@..@.reloc...............B..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\APKwait.bat

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.231009444816111
Encrypted:	false
SSDEEP:	3:mKDDGMLCyLuVFOZh9n:hSKfLuVFOZz
MD5:	326F18673467B34662A43E1B7588C82D
SHA1:	A9E584530B851E014BB475FEBE51474D7E41278E
SHA-256:	4693C9628F2CFC8C789225B984CCEA576D665D6792B3CA265EF0B5D27127CAF2
SHA-512:	56B39C93DE447F73BB94F6A0EECA1E20B318CDA3CC5B5ABE14BCB0C8E6F0A066AF98D8C6DDF42A1E4B57E82747142663FAA5554E5F941E2B90C38D4C105ABC9F
Malicious:	false
Preview:	@echo off..ping -n 10 127.1 >nul..

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\APXhttp.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57504
Entropy (8bit):	6.908600489842891
Encrypted:	false
SSDEEP:	1536:5wQ0j2HOip0EdcP2dWDWoviK2SVb41Pxc73LPxA:5VOqd+vi3Sb0xcDTx
MD5:	02948F19A0488CED88F4806C959EF24F
SHA1:	D47C1439309BEF82C1CA0A623D1CBC70C259B935
SHA-256:	712B2845697459CCDF6E71BAE7FF3B423254A91EB5C85B02551B2AD2A4112EE3
SHA-512:	681182CBB8E55C0008F4D2B6141B507F51C98050F014A66D256A5252E24F8DD2AC8559D71F0F01953830DBBF840F07C57A7E520274180B5AE35329D447AA8675
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........L..-.-.-..X.-.U].-..X.-.Ub..-..X...-..X...-..X.-..\.-.-..-..X...-..X.-..X...-..X.-.Rich.-.................PE..L.....tc...........!.....R...:......@........p............................................@A................................l...........H................R..............T...........................p...@............p..h............................text...MQ.......R.................. ..`.rdata...$...p...&...V..............@..@.data................\|..............@....rsrc...H............~..............@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\APXmodule-2.0.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	37024
Entropy (8bit):	7.054557610794306
Encrypted:	false
SSDEEP:	768:dBdwySZ+f1RGV4NhzM8EJPxm5Yi3fPxWEf:dLtf1c4b41Pxo73fPx
MD5:	F6C740A06CF69CB38527B746C1B5C90D
SHA1:	6EE733F791DE76AE9B6EDA05F4514BBAC3D17749
SHA-256:	29B7F57469745537CABAAB229BFB9FC2084CC7BEF14EEFE734C2C3A6EBF02F48
SHA-512:	01FBCAB3ED927082F60F96E0EA6647540F333FD2CB85E6E108D5FD0FAF358C809098B2CC0F8C50CB8BEA37FA81AADF31D21DF3F043B91E71F5D330E1407086A2
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........gZ........................................................t......%..............t.......t.......t...............t.......Rich............................PE..L...K..a...........!......... .......!.......0............................................@A.........................8..L....9.......`..8............>...R...p..l....3..p...........................(4..@............0...............................text...d........................... ..`.rdata.......0....... ..............@..@.data........P.......2..............@....rsrc...8....`.......4..............@..@.reloc..l....p.......:..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\ATellPhon

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	2.091917186688699
Encrypted:	false
SSDEEP:	3:WlWUqn:idqn
MD5:	EAD3D4CBA62CAD943DCA9FA88139D258
SHA1:	244E3C37AB41854F5B221653AC42CF26A4FAA97D
SHA-256:	74228703D2D0DCF060D50F1046EDB9D7273D901E50B728AFD50A4D42BE752674
SHA-512:	7ED4C73369A9E1C7CABABD6BB9E04674FC6E1D0C7FB40F46A129B94BFF895F9C65413A4875BBCEC91F4DDDC9B3CF7FBB344CDC87CC9E636DC6843775204F413B
Malicious:	false
Preview:	MZ..............

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Agent

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.761658988442702
Encrypted:	false
SSDEEP:	384:ovAw66vILDbNRhbHeJh8+oXBjxJd5IyYQGSbdkDjkoebjDISVjNW8SCW0:ovAOQbSEln5IyYpamDjobj8ShSA
MD5:	A5DD94434C702493D4577E966134B303
SHA1:	6BFAEB811189C41521802A11E0836237CD169395
SHA-256:	A26F4219815C297C705060B77595EF76E35E9E2BEDBEB5AFB3357CDC5BA2717F
SHA-512:	C5A44A9D526C2D494FCDCD765BAF7A765E53838F53A65DF1D1CE4114FCB1186296A8FAEBEE4BD0A39A41C9E96AA3B3484E07D86FBD117BE7915610EB4EF5CF77
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.q.u...u...u.......t...u...X.....B.~.....A.t.....@.s.....E.t...Richu...................PE..L....R.H.....................h...............0.......................................b..........................................x....@...d..........................................................8...@...H...\|....................................text...j........................... ..`.data...8....0......................@....rsrc....d...@...f..................@..@l..H8.....HC.....HP......HZ......Hd......Ho...........msvcrt.dll.KERNEL32.dll.NTDLL.DLL.GDI32.dll.USER32.dll.IMAGEHLP.dll.....................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\BBC.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	710888
Entropy (8bit):	6.630506217753263
Encrypted:	false
SSDEEP:	12288:6BMGnPEAEuRNz2HuiEJe0z6h5KEuEVv4D1wEM50+OD2evinKqcQUuWnI8:6BMGnPEAEyXiEw0xXD2evincvFnn
MD5:	FAE7D0A530279838C8A5731B086A081B
SHA1:	6EE61EA6E44BC43A9ED78B0D92F0DBE2C91FC48B
SHA-256:	EEA393BC31AE7A7DA3DBA99A60D8C3FFCCBC5B9063CC2A70111DE5A6C7113439
SHA-512:	E75C8592137EDD3B74B6D8388A446D5D2739559B707C9F3DB0C78E5C30312F9FCCD9BBB727B7334114E8EDCBB2418BDC3B4C00A3A634AF339C9D4156C47314B4
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........f..............U.......U..B....U....................................................c.......c.......c.......c.......c.......Rich............................PE..L.....]d.................n...8......dB............@.......................................@.....................................d.......................P,.......g..pL..T............................L..@...............(............................text...Hl.......n.................. ..`.rdata...............r..............@..@.data...4R...0......................@....rsrc................:..............@..@.reloc...g.......h...B..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Blend.visualelementsmanifest.xml

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	310
Entropy (8bit):	5.218991813797138
Encrypted:	false
SSDEEP:	6:ejHyaVic4subiKFNFWod/OjpFFHDhkQwY7HmXXKmJpkQwYEn0gCYEnP9FN:eF8iK9WW/OjrF4CA/cX0vXDN
MD5:	B3D5B8ADD818034C991FE15C13E0B055
SHA1:	3FBFBECC2C10DE459586B3B39D2F7CB45289C8B1
SHA-256:	79F8A190196CC5B79B99A07991A34B2E5AA25989FC22121B6C17B80F4772801E
SHA-512:	3C3E233072D9F4F94DDF2AF992339F43755DE9BC4F136BC6CC2EB1255B55C97D86495B8AF415C6880D62D8904D9E2EE61B427CA13FAB08492D4341F1D2E86E0D
Malicious:	false
Preview:	<Application xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">.. <VisualElements.. BackgroundColor="#2D2D30".. ShowNameOnSquare150x150Logo="on".. ForegroundText="light".. Square150x150Logo="Assets\Blend.150x150.png".. Square70x70Logo="Assets\Blend.70x70.png" />..</Application>..

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Browser_1

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.827554659468926
Encrypted:	false
SSDEEP:	3:Ol/QfkTsfIedYRXY:OlTT2dYRI
MD5:	F1B791B8D42F4D4B5794E254F7A86BD1
SHA1:	20B839C9257D51F28C7814C99922DBCD1A1EE248
SHA-256:	174423E75513994F0205EB2D874583D791C17A391B1DD97FBCE3CAD7E7FCAE61
SHA-512:	924CA93F18CB19C2F138E9DCFA21C0E90473EC2FFBAA3AC208A26ED9944FB0FCAEDFCCAC7138A5A825EED3B4FB033653BEE4BC2F79CD9D5084156A0D9D685407
Malicious:	false
Preview:	{491EB955-8A31-4381-BA1F-FDA4C60415A4}

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Bseziof

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	COM executable for DOS
Category:	dropped
Size (bytes):	129008
Entropy (8bit):	7.827316426792684
Encrypted:	false
SSDEEP:	3072:vRZzFCwH6WrKxTtcZaUMueR2ZGCApbu7n31bsj9y:pZBC66WrKDcMxR24rpbu71g
MD5:	D76420DC56BE74361FF5053D87A752A7
SHA1:	E4E95C6D322FA5007F045F969A507A79DBA24A18
SHA-256:	CAA76B91F5ED0D10ADD3F757B7412822795013547AB286906D9F3740C0501A32
SHA-512:	C96654CB012F883037DC11478256779A4859C1A8D158D53430CE83040BAA327F0B060D52A6B8C7832F6497D3F7FABEF47EB4E33C841CBB90EA5373D7263398CB
Malicious:	false
Preview:	........@...............................................!..L.!This program cannot be run in DOS mode....$........\..I=.I=.I=.2!.H=..2..K=..!.K=.&".K=..".K=..2..R=.I=..=.....=.I=.H=..".J=.RichI=.........PE..L.....*g............................0.............@.................................................................................................................................................................................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................4.02.UPX!.....D;..t.f8k..$...

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\DataTransform.ini

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	Generic INItialization configuration [Userddress]
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.67841607960707
Encrypted:	false
SSDEEP:	6:OZPixNiKRSVWTQlY2LXmwPxhb4eR8iiLrAmXOtAvHPzT3U6g:OZaRRXQNLXmwPxhb4e7iLkmXOtqL72
MD5:	5DB5802855390316509312EA98913E3F
SHA1:	941E2FB957A5160AAD5BCBB69D4D8EEB1E679679
SHA-256:	16BA11467408450A06C599D7AFC8D3FF383EF6FC06E0FAF028CC71DCF71EB980
SHA-512:	B048090B41CE724D3F09BA82B70606F553658990F007BDB93BE41D0178DA81B210956D815EDE31319C35E86EF74CC5B0DCA69F113D066B16745DE6B7583C3E98
Malicious:	false
Preview:	[Data]..Type=UMnwio9zv2FqxxUVMR0jWJnXhzGyjuwdGhyjE7NmuwPzPTn2oWYbUgHhroi6QH..[Userddress]..Data=ya4feBPz9quDWubPmy1BrWBrJ2epxBFxdZ2u51ne4Q6dcjTemYgPRQMGN5akXwRqkmPKRMc5ptX1Mccd9HRaBLKEd0AntxumwTZx..[DataTransform_CreateZlibCompressor]..Dictionary_Rekey=A.exe..[ctrl]..ctr=SearchRun.exe..[Desktop]..Desktop=rar.exe

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\EduWebContainer.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	12840
Entropy (8bit):	7.986702439437666
Encrypted:	false
SSDEEP:	192:/ZrfidU1vKpUcMlqiP66dS2qu9wl2apxWama5IWmciIplqLngTmfqDnoKax5eq3m:Jfim1C4lqiP1dxWZZGciI62oROzl
MD5:	11F506F266C236A58D62D0F466A537AD
SHA1:	F948F8013782A3AA3F5D7BCAD62E8CC63146007C
SHA-256:	958BF016A726EDF619062E3C56CE54E6E46C9982912EB92081A2B91B2B5E50B0
SHA-512:	5E5C636D05B8D4B3F880243B001FF8CB32EC1883D86F55F78CA65CD92BA3B9BF52A84BB75CA9F98FFA423ECF683EFA22F2B584FE0B9B6C104A7EE1C145B81634
Malicious:	false
Preview:	...Y{.B....&...oy.}..F{...z..H'..."..x...... .(_.L./.5.....W.\.....;...T.J.G.MH.][a...c....2nfF.E.r<..N.F.E....n....&>..../.f.]..u...(]...M..$.#tl{.L.R...Nx.....J..2...h.e!Z=.r.Y.._.U..s..v.T.4.JQx2.._F3.+........j...V..-c\|vO.%r......d../.g.}b..!..<K.1#...OeU. ;!N..n..G..k..N...).y`~!.....Z'.d..$...-.r..z...v......>>m.... >28..{..-.l......Nv..x..#m........l.1.8..$_.......\..m........x.]f..C..Y/.(qGC.3..N.`.!(..m.C...=.<.../.P:.Zf^.dm...+.3..V.....^.D.......[K.$...E.....E.b.~.:....=Xz\..J.....uG.LWA.`p...N.ze.P.R.......U.>...{p^...;A.Rj......L.......Dcx/@}-....... .~....2'...m..>....@.`..8Km.X.N..rs....r.Z..g..h......P.~.."v.7...\...v.....rDs.Buo.......1.].c...X..:.....9 K...W5..F#^.;AoH...!.%...F.T>.g.F[.H...M.B.f....."...s..T....e.F'..HY..&6.3.k.<L.kU.......[HZh.J8l..5....C..A...=.}.?........+./.peQ#.x`.W...h..!..,.q .Q.w./k.#...Y...k.Y.\..........0v........:G.`h......f...Eq.y..........G.2......J.)..\..C."..A8.....A$..tIu.....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	174304
Entropy (8bit):	6.858552596804119
Encrypted:	false
SSDEEP:	3072:Q0HJ5wo1/MJjozYJimE2BamDKigu/fgl1glfdjgBftJeCE5vLEnM7QrRz:/J5wUmhkmDKVuE1gQJeCERLG1F
MD5:	0D318144BD23BA1A72CC06FE19CB3F0C
SHA1:	91A270D8E872EA2A185309CA9CE5D9F08047809E
SHA-256:	60503684F39425C5505805A282EB010ECB8148BBF7EFE9BBA9CF33C507AF7F3A
SHA-512:	A3F3C7D84644B13868AC324947C2D678620E341E368B781D45F244A53F448D6B24BE7B50AC9908728DFBBB74214FCB46902137910E907F14F601518C0EFD215B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........k.A...A...A...,...H...,...;...,...Y...z...S...z...S...z...d...,...D...A...........C.......@...A...@.......@...RichA...........PE..L...V.]d.............................#............@.................................Z.....@.................................48..<....p..0............`...H...........*..T............................+..@...............$............................text............................... ..`.rdata...^.......`..................@..@.data........@.......2..............@....gfids.......`.......<..............@..@.rsrc...0....p.......>..............@..@.reloc...............P..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\CIM_ResourceAllocationSettingData.xsd

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (342), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	8108
Entropy (8bit):	4.965236708426262
Encrypted:	false
SSDEEP:	192:MuZUkwsSwZhuV3wM3DwuMu93wv3Dwui4Cya:MuZUkwsSwZhuV3wM3DwuMu93wv3Dwui/
MD5:	A77B71F6E5FE1F50065AC8A15796AFEB
SHA1:	80A83A247FFD47529419873B32E02852B75D47AF
SHA-256:	D02D5181E13AA96B67AB75F51C03AB1F1286F7A28FD92ACA3021E4E694A4E2E8
SHA-512:	E5502B347C545C4460ABDA78242B238D83AB4645F0495D933B4C419CB4872520915E13C8A6F5137B260B000C690145A8139A7FF47286BC9875531F74167B50A8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>... Generated by WBEM Solutions, Inc. SDKPro 3.0.0-->...<xs:schema xmlns:cim="http://schemas.dmtf.org/wbem/wscim/1/common" xmlns:class="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_ResourceAllocationSettingData" xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" targetNamespace="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_ResourceAllocationSettingData">...<xs:import namespace="http://schemas.dmtf.org/wbem/wscim/1/common" schemaLocation="common.xsd"/>...<xs:element name="ResourceType" nillable="true">...<xs:complexType>...<xs:simpleContent>...<xs:restriction base="cim:cimAnySimpleType">...<xs:simpleType>...<xs:union>...<xs:simpleType>...<xs:restriction base="xs:unsignedShort">...<xs:enumeration value="1"/>...<xs:enumeration value="2"/>...<xs:enumeration value="3"/>...<xs:enumeration value="4"/>...<xs:enumeration value="5"/>...<xs:enumeration value="6"/>...<xs:enumeration value="7"/>...<xs:enumeration val

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\CIM_VirtualSystemSettingData.xsd

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, ASCII text, with very long lines (332), with CRLF, CR line terminators
Category:	dropped
Size (bytes):	5951
Entropy (8bit):	4.95379352101584
Encrypted:	false
SSDEEP:	96:IHpusmyEYtpusmyEcpusmyEf6dEvrgeUKMvLm0n/:4usm0zusm+usmLtVUKmLma
MD5:	8737313A1CD47D1BD415F4CD7C8D5A35
SHA1:	C3FE8ED373DD8807DC56B8ACD807A01163BA1945
SHA-256:	190C096159A5286655707E1141EEFFCE86484AC48DE4F54CBA4CD44C59868CDB
SHA-512:	C3090FC492DC1C875715B1A82906F7466CA63AE5BDFAB0A7730DBEDAAF622ED7FC5471D9F036813D423C33CDB4CC80BA9A8AFCC8387E365FDB7148B84BF2BB8B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>... Generated by WBEM Solutions, Inc. SDKPro 3.0.0-->...<xs:schema xmlns:cim="http://schemas.dmtf.org/wbem/wscim/1/common" xmlns:class="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_VirtualSystemSettingData" xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified" targetNamespace="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_VirtualSystemSettingData">...<xs:import namespace="http://schemas.dmtf.org/wbem/wscim/1/common" schemaLocation="common.xsd"/>...<xs:element name="VirtualSystemIdentifier" nillable="true" type="cim:cimString"/>...<xs:element name="VirtualSystemType" nillable="true" type="cim:cimString"/>...<xs:element name="Notes" nillable="true" type="cim:cimString"/>...<xs:element name="CreationTime" nillable="true" type="cim:cimDateTime"/>...<xs:element name="ConfigurationID" nillable="true" type="cim:cimString"/>...<xs:element name="ConfigurationDataRoot" nillable="true" type="cim:cimString"/>...<xs:elem

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\DrawContent\DrawContentNoname.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144872
Entropy (8bit):	6.1033991888043255
Encrypted:	false
SSDEEP:	3072:Poib/ncfh8z2geq5CpLFuAzpXDGX12HBt:zb/6RpugpY2HBt
MD5:	D0C679D73048A8AF8C5F483BDBCAF0A2
SHA1:	6AFEBA5B8C5A390B2A487590A5EE7E10ABFEFE6F
SHA-256:	952451312864D1CF98C137EF6B5048F325325CC1237B1D1DB26819839ED7FC27
SHA-512:	BCFF13C8FD3B01AA5F8BA54D91ACE7E74EF5A370808B517471271FE39318938DECAFE5A40D26A94D46D3DBB2E5EB152209828269EC86B210B04C3C13B13DA23F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........'.I.Fz..Fz..Fz.+...Fz.+...Fz.+...Fz...~..Fz...y..Fz......Fz..>...Fz..F{..Fz../s..Fz../...Fz..F...Fz../x..Fz.Rich.Fz.........................PE..L...N.;^.....................<....................@.......................... ............@.................................T...P....@..................PC..............p...........................0...@............................................text............................... ..`.rdata...\.......^..................@..@.data...L.... ......................@....rsrc........@......................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\LICENSE.3rd

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	6264
Entropy (8bit):	4.246298126375936
Encrypted:	false
SSDEEP:	3:Pf3v3vP3X3P3PPnHnPXvHf/H3PnXnPfnPHnvfP//PHffH3H/v3PnfHXP3vP/P3Pr:b
MD5:	DDDAB64301999870824A2CC0E358689B
SHA1:	664263BF0641B55AF72EFBB6A9AB91AC77673D54
SHA-256:	DAAA8FC859B10444E218800FC15E2E7560EBF59E269BB58DD8D82C9305F73C6E
SHA-512:	DABA1DC82031056430E0150DAD18B43BB3D4A6AFD67E802BC7F867D274E1221F5BB9C12EA3213148FB6114FB79559C86E141C75D828ADC11F7C4372E70072827
Malicious:	false
Preview:	"z.rz.....r.b...z..bz..bJ.rjRjR*..B.2zbbz.Jr:..z2.....j.....Jr.b."".Jr..BJ....z"....."J....JjR...z2..r..z2..BJ...z2.....J..:z..r".....B...j..z2..B.bJ.r...bz..jRjR"J....J.j..J.bJ.....jRjR..J..r.....R..Z..JZ.z.B.R..Z..JZ.zr"ZJjR.z..J:B..B.J.....j......R..Z..JZ.zrjRjR.BJ...z".j.......".Jr..zj.Jb".2z.j.Jr..r.......z..".J.r..B.jR.z....2Jb..j......"J...J...".....r..j.r....z.J"Jr:.J..J.jRrz...zb".2z....z2J...J.Bz....B....Bz.....J..r..zr.r.b..r"jR..z.J"Jr:..B....BJ..rz.J...r"..B....Bz...r.j.J..Jr.b.""rjRjR.BJ..2Jb.J....z.J"".....J....J.B.rz.....".z..Jj.bJ"......r..rjR.B....Bz.........rz.bJ..JbJ...J2.J.........r..".j.:..z..z..z...z..jR.zj......B...z..r.J.:..2.*b..z."zr:..B...b.j...z...J.rjR.....z2...:.rjRjRjR..B.2zbbz.Jr:..z2.....j.....Jr.b."".Jr..BJ....z".....".JbJ.jR...z2..r..z2..BJ...z2.....J..:z..r".....B...j..z2..B.bJ.r...bz..jRjR.z..J:B..B.J.....j....b.".JbJ..".bz....jB..r:.B...:j.Jbr.zjb....*bJ..r.:j

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\LICENSE.libcodecs

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.363090655038483
Encrypted:	false
SSDEEP:	3:EGLzVYRFoUgLhHx0iFolaXM+MA3GtfX2SMOFrNNRJhl//bB9bPL9RbtBnbPZrVTF:EGLzWF65x0mq3kJO9NX
MD5:	433000AA79D90F93C87E11F86A786F67
SHA1:	A1B8B8F69884A4CE9BB433D96ACBED3337C5AE5E
SHA-256:	08E569EEABC5D4082F4A59142F22534FF57F12F991CD4E1A36811511799EF109
SHA-512:	DB752A2D65D8F276D6225A7C478EB1674EE3B0829CA57272A54D55C1C9E25A9E9DDD93699E41D6CF53E36313C8DDF4C0C034EDAC765139124620F0E5FFA99E8D
Malicious:	false
Preview:	libcodecs is part of the "Huorong eXtendible Stream Scan Engine" project copyright by Beijing Huorong Network Technology Co., ..6...&,:8 648..,...4&4<.46.."64....4..4.$.. 2...4.pbT.f4..4..p4"4.<&.^.:&,8.f,84".4..fp^f......V.4.2.&&.. ..84.8 64. 2.&,:8 648..,.." .. ".p,.n.:..........0,...:.8 $..<.6...&,:8 648...

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\LICENSE.libdt

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.406360206907183
Encrypted:	false
SSDEEP:	3:EBjMWEXRFoUgLhHx0iFolaXM+MA3GtfX2SMOFrFjJ//bB9bPL9RbtXhbZrVTl/9z:EJuF65x0mq3kJO9/
MD5:	5E48AE384DD6874C64E8129FAA0F4D1F
SHA1:	9A7A273EC1E97FA80304A51A5874E2C40E68D993
SHA-256:	4CA63968FCBE57FE9A9079DBEA85375B6129ABFF45CFB42E24A7F1DDF044943A
SHA-512:	20552DEBAAACF783BB128EB2A619125507921E9E3971EE43EA9613F681FBFD3BA711CD774E1DB9EDD7B56C36D1181DD42D8BB73C0AAE0CA3BEFA20E0B482BC17
Malicious:	false
Preview:	libdt is part of the "Huorong eXtendible Stream Scan Engine" project copyright by Beijing Huorong Network Technology Co., Ltd.....:6..,...4&4<.46.."64....4..4.$.. 2...4.pbT.p4"4.<&.^.:&,8.f,84".4...4.., ".......V.4.2.&&.. ..84.8 64. 2.&,:6..,.." .. ".p,.n.:..........0,...:.8 $..<.6....",8 ."..

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\Microsoft.VC80.ATL.manifest

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	5.187860451409661
Encrypted:	false
SSDEEP:	6:TMVBd6OjzIIBeBXVL9obRu9Td8gH9aO/5TMiX1+jSQdS1vwIgVf+ZaYf7:TMHdt4IBeBFLOwHR5TNl+rmxgVKaq7
MD5:	0BC6649277383985213AE31DBF1F031C
SHA1:	7095F33DD568291D75284F1F8E48C45C14974588
SHA-256:	C06FA0F404DF8B4BB365D864E613A151D0F86DEEF03E86019A068ED89FD05158
SHA-512:	6CB2008B46EFEF5AF8DD2B2EFCF203917A6738354A9A925B9593406192E635C84C6D0BEA5D68BDE324C421D2EBA79B891538F6F2F2514846B9DB70C312421D06
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>. Copyright . 1981-2001 Microsoft Corporation -->.<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">. <noInheritable/>. <assemblyIdentity. .type="win32"..name="Microsoft.VC80.ATL"..version="8.0.50727.4053"..processorArchitecture="x86". />. <file name="ipaip1.exe"/>.</assembly>.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\Microsoft.VC80.CRT.manifest

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	314
Entropy (8bit):	5.140999301390513
Encrypted:	false
SSDEEP:	6:JiMVBd6OjzPbRu9Td8gH9bZELrbvm/53SMiX6+hPABdS1FggVfgk5Z:MMHdtlwHHJ53SNK+hPIRgVR5Z
MD5:	710C54C37D7EC902A5D3CDD5A4CF6AB5
SHA1:	9E291D80A8707C81E644354A1E378AECA295D4C7
SHA-256:	EF893CB48C0EBE25465FBC05C055A42554452139B4EC78E25EC43237D0B53F80
SHA-512:	4D2EC03FF54A3BF129FB762FC64A910D0E104CD826ACD4AB84ED191E6CC6A0FEC3627E494C44D91B09FEBA5539AD7725F18158755D6B0016A50DE9D29891C7E5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">. <noInheritable></noInheritable>. <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.4053" processorArchitecture="x86"></assemblyIdentity>.</assembly>

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\common.xsd

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6812
Entropy (8bit):	4.737569607251046
Encrypted:	false
SSDEEP:	192:z6H9K9r24/jtVOuVG/PCGHhWrrIafb7fL5qlz+DLSQ7LXOgF:VNtLz/Y3xB6rPPlyz+Dt
MD5:	D7216C4C115C30D3DC996F339C2197E2
SHA1:	9C90B140316FFB6AF090BD80DF40EA744D555B11
SHA-256:	946C1E2C50EA753E2CF3F40CB4A83C319E0D5693C3B017AD3F9811792319D2EE
SHA-512:	9A0F133B8517B86A29AAA0F541573842A4B76D6DE30C1167D4EEB2F08D0568CE94ABC81341049BFA328D85DFDC8D8B74177B9A896107C2438168EA4EA5B47FC6
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" ?>.... DMTF Document number: DSP8004 -->.. Status: Final -->.. Copyright . 2007 Distributed Management Task Force, Inc. (DMTF). All rights reserved. -->....<xs:schema targetNamespace="http://schemas.dmtf.org/wbem/wscim/1/common".. xmlns:cim="http://schemas.dmtf.org/wbem/wscim/1/common".. xmlns:xs="http://www.w3.org/2001/XMLSchema".. elementFormDefault="qualified">.... The following are runtime attribute definitions -->.. <xs:attribute name="Key" type="xs:boolean"/> .... <xs:attribute name="Version" type="xs:string"/> ...... The following section defines the extended WS-CIM datatypes -->.. <xs:complexType name="cimDateTime">.. <xs:choice>.. <xs:element name="CIM_DateTime" type="xs:string" nillable="true"/>.. <xs:element name="Interval" type="xs:duration"/>.. <xs:element name="Date" type="xs:date" />.. <xs:element name="Time" type="xs:time" />.. <xs:el

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\hi.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	8544
Entropy (8bit):	4.277108053686666
Encrypted:	false
SSDEEP:	192:WvI+bMk4g+7rdT2sc4EtGXQgcWh8bvPgLIjJQ9tkTjIkja4tEDIzqIrpKaF13aSy:Wv9oq6rdT2T4EtGXdF8jPgLIjJut2Ik0
MD5:	E34E94531BAF8957EBDFB5ECCDC52635
SHA1:	D7139BDF34F6F167456014D4D5E16CFDFCC18214
SHA-256:	5AF2CC87FE9FA69DA65C990070EE17AF3F612E3883621BD2474161BB508E454F
SHA-512:	CF3F4BCF0F5DC35BFC77594FD8AD4E9C6BF32291DAE2298C84B3A465EDB4B75851C0A58F39BB6828EA69E31293E5A4DA5DAA29F4B3F31306F37941491992FC58
Malicious:	false
Preview:	..........N.....N.....N.....Nr....N.....N.....N.....N.....N.....N.....N.....N.....N"....ND....N{....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N1....Nb....N.....N.....N.....N4....N`....N.....N.....N.....N.....N.....N.....N.....N=....NI....NU....Nd....Nv....N.....N.....N.....N.....N.....N.....N/....N>....Nw....N.....N.....N.....N.....N.....N.....N'....NX....Na....Nm....N.....N.....N.....N.....N.....O.....O&....OI....O~....O.....O.....O.....O.....O^....O.....O.....O.....OI....O~....O.....O.....O.....O4....Ov....O.....O.....O.....O+....Og....O.....O.....O.....Oy....O.....O.....OV....O.... O....!O...."O....#O)...$O2...%OA...&OS...'O_...(Ox...)O....*O....+O5...,O....-O.....O..../O....0O....1O"...2O....3O....4O]...5O....6O....7O....8O....9O&...:O....;O....<OB...=O....>O....?O....@Oc...AO....BOo...COY...DO6...EO....FO%...GOD...HOk...IO....JO....KO. ..LO' ..MO6 ..NOO ..OOq ..PO. ..QO. ..RO.!..SO.!....`!............... .......

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\hr.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	4256
Entropy (8bit):	5.476332948782519
Encrypted:	false
SSDEEP:	48:nizQz4KzjHCKvMzSBvdI0s4TkqZfDhPhbdAQv7Dg3M3Y2UUzgJJC+Mo1tMoIJcAO:i8z4KPnM+JdLsY5xDhYrhRjaBVI7vr
MD5:	7CD82242FDDA155F0DC4C830A73225C4
SHA1:	436A156C8016B96B83B11931FF9562F29D805977
SHA-256:	0096FD57392462D010E9B4DDDA4D021A8B5E5BA78FF097958C1E7A00EC175A2B
SHA-512:	2C5133E3673D8470AF6067AF2E5B7D2150B71D3D87379CD94574F72E3CA2B251C08C7F7F530F705CB2EDD8D96263BA9A205346B5704238FC748180235C6809EE
Malicious:	false
Preview:	..........N.....N.....N.....N.....N.....N.....N.....N ....N&....N.....N6....NE....NU....Nd....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N&....NF....Ng....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N3....NA....NG....NR....NV....Nc....Ng....Ny....N\|....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....O$....O,....O9....OZ....Oj....O{....O.....O.....O.....O.....O.....O.....O!....O.....OO....OS....O]....O{....O.....O.....O.....O.....O.....O.....O3....OO....Og....O.....O.....O.....O.....O.... O)...!O5..."O@...#OF...$OL...%OS...&OY...'O_...(Ou...)O....*O....+O....,O....-OZ....O..../O....0O....1OV...2O....3O....4O....5O....6O....7Oj...8Ow...9O....:O....;O....<O....=O....>O....?O....@O8...AO....BO....CO....DOe...EO....FO....GO....HO....IO....JO....KO....LO....MO(...NO0...OO7...POR...QOj...ROr...SO}.........DetaljiSpremiOvaj je indeks mogu.e pretra.ivati. Unesite kl

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\hu.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	4734
Entropy (8bit):	5.650888808404625
Encrypted:	false
SSDEEP:	96:+AA8bFIK4pwdJj/JqLn5yEnxSabw7rMVrCtZcqRcU+EFUkozbFFJOHVOrS:FAmkp4JjJqLnoxscZcqRcnEmko/FPO13
MD5:	8C5F95F081F6A23A2D058562A24224FC
SHA1:	0D8E3138654B66998341B1B4D07CB6E0CCF56DA3
SHA-256:	2288098F91E90D5F5583A42ACDB4D278A8438656A190EBC57FCC034FA0110054
SHA-512:	4D4A183A07B4014848DD5B50F520BA43ACDB37C8A2E280E32CC080A6FCDE8EE5D758CD0ED71A104E6FFDF3566BAE08A1141D666E0951344D98F802C9381875B0
Malicious:	false
Preview:	..........N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N"....N2....NF....N\....Nt....N\|....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N"....NL....Np....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N+....N/....N5....N=....NS....Nc....Nj....Nz....N~....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N$....N9....OD....OS....O]....O{....O.....O.....O.....O.....O.....O.....O.....O,....OI....Ob....O.....O.....O.....O.....O.....O.....O.....O.....O.....OL....Oh....O.....O.....O.....O.....O.....O....OH... Oe...!O\|..."O....#O....$O....%O....&O....'O....(O....)O....O....+O+...,Oy...-O.....O..../O3...0Op...1O....2O....3OP...4O....5O....6O....7OH...8Oh...9O....:O....;O....<O....=OE...>Ok...?O....@O....AO....BO[...CO....DO....EOt...FO}...GO....HO....IO....JO....KO....LO....MO....NO....OO....PO....QO=...ROF...SOQ.....~...R.szletekMent.sEz egy kereshet. index. .rjon be keres.si

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\lco.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	7.307434278749024
Encrypted:	false
SSDEEP:	384:azbge2/99IpWUFyCKaMgXGT/bl55oqyfvN:azb619IpWUFyQiB55aH
MD5:	E057AA4A56A9A2A628A8053F25A27D7D
SHA1:	D839E5258BBDB871C746C2CEF52E336487535C47
SHA-256:	2519081ECA56FADCF3B62E7CB22E55A1F839B9055E9F1E404FC28145D149E913
SHA-512:	D968AA76B1483A14B7D829C755A99C7AD09163D18DA6806F23B3A33664292F16A4695B596B0D2BE619A3B6DC909CFCB8CB7FF236641D1CC012E4F438364945E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y.P_=.>.=.>.=.>.R.5.<.>...0.0.>.R.4.'.>...c.>.>.=.?...>.i...<.>.Rich=.>.........PE..L......@.................0.......p................@.............................................................................t...................................................................................................................UPX0.....p..............................UPX1.....0.......,..................@...UPX2.................0..............@..............................................................................................................................................................................................................................................................................................................................................................................................................................1.20.UPX!....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\li.dat

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.3431390622295662
Encrypted:	false
SSDEEP:	3:dU6mWhRE4Qm5In:vmWhlQ6In
MD5:	233B4AAF620B36D5569FFB334806A663
SHA1:	99E4C2ED4447B3CA2772F11374E7EC22DF06A04B
SHA-256:	C0F5633F8058E6CF0FEF5CE6AB91438663A1AE2670CB49350E095D8F667C9870
SHA-512:	24F4006DA19AE7B10408250AB326DB4EABE6E782BECCE130C0F25D2D0E43E738624CFD490BFAC0A8A6BD6E164C01FB76CD69BC050AD0BBF3052A854A516B0170
Malicious:	false
Preview:	47AE4CA89C38F4D75F115CF41887F878

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\livehis.dat

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\package.json

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	Non-ISO extended-ASCII text, with very long lines (766), with no line terminators
Category:	dropped
Size (bytes):	766
Entropy (8bit):	4.058458203323675
Encrypted:	false
SSDEEP:	3:Hf3xVxLvT5X9dz7bvfdz7JvV7zVBtD33pRXhXDhRZDR7z9fjdzp93xh/Td7f11tx:v
MD5:	5E41AD36487EAB944983A14C9C124D93
SHA1:	B8B098B88CBFF2F64589ABDBE7FBEFCA7C99FE3C
SHA-256:	26C6BCF0EFF67807AEB9F2F407D06DF653B99724AFAD9C9A9B8129DB7D8C3FAE
SHA-512:	F876BD1E49BB0C0B0660E14DD2D95C75F2124AFDE00D095674E53D0440B7BA7B89BC1A2576A9FE755B5C727E5808DB1C8A127CE4E4B2C124257412B76A200FD2
Malicious:	false
Preview:	....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\rpi.dat

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	5.7488500702321135
Encrypted:	false
SSDEEP:	3:Fjjlnn5tllNTFllxXxjX/DNZH1/HnDD/trvDlL5TrjJrdbXZVtX5L3dlj1b1hX7x:r
MD5:	6513F31AB6F308B0B8802FA04C450122
SHA1:	AD3D14C5F78B5C2F2C4DAE06A486156A7B4126E9
SHA-256:	1445C8422A8FF14D8414300B819CBF2340A03A64158FCF7A3CCF76FDDB10DCA2
SHA-512:	CFB2754253E71B48EB6D69BA93641D06C0608C38FFFDCE2F5E54CED002997C9821299BADF26D95B2D84A41F13CA96A4F9D1C5E38D52DB2934AEF64C988844D98
Malicious:	false
Preview:	....0...............b.\.`.\.`.\.b.`.`.b..............................................8.......................................................................\.........................................................................................................................X.4(.~x.x.b...P.....Jt....f......VD....H.V.Z..~v.8.&h.x.x...F`....J.P\|.2.P....h....F..j...h\|......~r.0..:...DD....>.B`2..x.FP......H.4.P.............x.....P....... .........6j4......X4H.z..D.x.b.....Nt...l\pn44.@.n.........&......t2. VP.tx6.4..F..h.^..v.^..6.L.....n..\|0@.R..P..x.J...(..lj.....&n..~.dV....td.B.....F..2:~...l..X\..0.`.....<.&.....@.N... t.z...Pr..Z..t..L.h...L..t..:.$..<.vx~..$>....L.xb.xJ......L&v..v4x.p.."B.@n.6....,.(V.x.R>64.....v...~...J.d..&......\JH.t..V...".0..n.TPd..,0......0.2.r.\|.....:....2n...v..6...P..D....$.....8.&r.Fh(.d6.....J.n....$"...Xz<.2B~.z..H.....BV.X..\,.2.j...`..h@...j......8X((.b..6(B.@D..b...6j..l&0T.<.(.T..

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\slist.dat

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	2356
Entropy (8bit):	3.7394907365919403
Encrypted:	false
SSDEEP:	3:nFrrxzj79bNZbHNbZdT9LbdHr/bfblpbdXzbrbrVd9P7XF5V3Rbb/NjbdbF9X1TH:R
MD5:	3CEEBAAA7FC6344B0274AB9274DEEED7
SHA1:	38832454403400441F9824C2265256A650C947ED
SHA-256:	F526024533673E6F167903F21978017EC712566E9EA1DD249671F119719F8DE9
SHA-512:	3E63A0F5764A59E77E5B0C4680DCCB33D1D52B4E622F84762D9949B736A6BDAB416BC72F3D2501BA90D46414186EC2C42677D1528E7186128D96082C32CB00D2
Malicious:	false
Preview:	..$.......................r.r.\|...........z...r.x.......x.....\|.....\|...x...F.^... .0...<.$...r.,.&.4...............F.......F.......X.<.2.4.F.....6.<...4.F...V.\|...........8.<.:.............................x...F.^... .0...<.$...r.,.&.4...............F.......F.......X.<.2.4.F...<.2.4.$. .".F.......V...<.....4...4..........H.\(X(N......$.........x...\|.z...r...x.r.........v.......x.z.....t.x...z...........x...F.^... .0...<.$...r.,.&.4...............F.......F.......X.<.2.4.F.....6.<...4.F...V.\|.\|.....v...8.<.:.............................x...F.^... .0...<.$...r.,.&.4...............F.......F.......X.<.2.4.F...<.2.4.$. .".F.......V...<.....4...4..........H.\(X(N......$.........v.......\|.\|...............z...\|.....t.......................x...F.^... .0...<.$...r.,.&.4...............F.......F.......X.<.2.4.F.....6.<...4.F...V.\|.t.r.......8.<.:.............................x...F.^... .0...<.$...r.,.&.4...............F.......F.......X.<.2.4.F...<.2.4.$. .".F.......V...<.....4...4..........H.\(X(N..

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\version

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	F1D3FF8443297732862DF21DC4E57262
SHA1:	9069CA78E7450A285173431B3E52C5C25299E473
SHA-256:	DF3F619804A92FDB4057192DC43DD748EA778ADC52BC498CE80524C014B81119
SHA-512:	EC2D57691D9B2D40182AC565032054B7D784BA96B18BCB5BE0BB4E70E3FB041EFF582C8AF66EE50256539F2181D7F9E53627C0189DA7E75A4D5EF10EA93B20B3
Malicious:	false
Preview:	....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\HoursBroker\xml.xsd

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	9123
Entropy (8bit):	4.770624688403829
Encrypted:	false
SSDEEP:	192:FavQwyIregmSPwTy2k/3EeEQ6xGbd81PyCmD0DE:UvQwytg1425vE5bPEADE
MD5:	9FE2776E8A9D4BCFEE812A69F37DDABD
SHA1:	6264C527A996806B0C439F17C56B2E96DBF0FA82
SHA-256:	0BCA167A1B2FAABF9F2BB59A7C55C09B25C71974DB4D6125F91A14B7071F5E9C
SHA-512:	89D00A7602FC47858A0B0ADC81CDF4F63CBA0728EDA0B9824EA9DCC09B39A596A61034DA5001377444D6B6E07B454028DF528E722F5D2D268A50B296E2990259
Malicious:	false
Preview:	<?xml version='1.0'?>..<?xml-stylesheet href="../2008/09/xsd.xsl" type="text/xsl"?>..<xs:schema targetNamespace="http://www.w3.org/XML/1998/namespace" .. xmlns:xs="http://www.w3.org/2001/XMLSchema" .. xmlns ="http://www.w3.org/1999/xhtml".. xml:lang="en">.... <xs:annotation>.. <xs:documentation>.. <div>.. <h1>About the XML namespace</h1>.... <div class="bodytext">.. <p>.. This schema document describes the XML namespace, in a form.. suitable for import by other schema documents... </p>.. <p>.. See <a href="http://www.w3.org/XML/1998/namespace.html">.. http://www.w3.org/XML/1998/namespace.html</a> and.. <a href="http://www.w3.org/TR/REC-xml">.. http://www.w3.org/TR/REC-xml</a> for information .. about this namespace... </p>.. <p>.. Note that local names in this namespace are intended to be.. defined only by the World Wide Web Consortium or its subgroups... The names currently defined in this namespace ar

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\KwCommonUI.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1020288
Entropy (8bit):	6.392670889032173
Encrypted:	false
SSDEEP:	24576:m25q2rSATcolN/NKEM7GYNzOgcW6tAhc7rgnFEwXXfe5V2:m25q2rPlN/NKEhYNzOgcW6tAhy6EwXXb
MD5:	C87054BA4A83C6CA19977C446A722A7C
SHA1:	5743B16BC6D600E27B66D13CC04208BAE2A9A880
SHA-256:	6CB166C1895FC7DF5235658E3963C82200BBE5E71005FDB4F8744657A7F49B09
SHA-512:	87449A5FEF2B2B77198E0D946452F8E05B8F2B7ABAE239EDB2B848BD5E3F7A332A208DE71CAC7912D788CD1C47F80FA2BE9ED61DE2F8EA378E610A1DC0C46A9A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c..('.`{'.`{'.`{s.Q{%.`{.V.{!.`{...{&.`{...{".`{...{+.`{'.a{.`{.V.{2.`{.V.{&.`{...{4.`{...{f.`{...{&.`{9..{&.`{...{&.`{Rich'.`{................PE..L....,WT...........!.....<...8......c........P......................................`...............................p...30...t..T....................x..............._...............................................P..P............................text...-;.......<.................. ..`.rdata.......P.......@..............@..@.data...@...........................@....rsrc...............................@..@.reloc..r...........................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\KwLayoutMgr.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	287616
Entropy (8bit):	6.429805120462574
Encrypted:	false
SSDEEP:	6144:54s5ND8mRd6PUep7GdwmT+8b/IgcyIFoWIBOtBp2HsoM:5D5ND8mRd6PUep7GwmT+c/hOIg2Mp
MD5:	F260AF60120ECE46C499BADA5B4277AD
SHA1:	F1790AAC72B10A4BD4D88E9A143B96BE996197AC
SHA-256:	D52D01E382EA39D005F7AD2F3C13DA45B4DE4779608E08A9FB1AD5630D122043
SHA-512:	19FA19716965E0034AD57B0CE15BFF54DEC67D3C7E73408ACEC2E642E82DE4AC1E0C42E19CA58C494A1F95014980FDBDC9D904701F2CB421C993B9660F3C5C89
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............@...@...@...@...@{.C@...@.@@...@.V@...@.Q@...@.F@...@...@...@._@...@.G@...@.A@...@.D@...@Rich...@................PE..L....,WT...........!.....B...................`......................................X.....@.........................@................0...............J.......@...2...d..................................@............`...............................text...T@.......B.................. ..`.rdata..#....`.......F..............@..@.data...\...........................@....rsrc........0......................@..@.reloc..tD...@...F..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\KwLib.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	306048
Entropy (8bit):	6.678408876122077
Encrypted:	false
SSDEEP:	6144:YxgkPaSM1AoCbO0PSyTws4H9pAKz6QRWO2TBdHRrtYOttYO7l:YDPaUBKODmH9pdXRWO2TR/
MD5:	2E63EA70505847A7DB340F5004FDDE71
SHA1:	A4DA7AFF18A9A747490633F5490959BAF75658B7
SHA-256:	87AAB5BBBD2360C819B4E58BB0667693147764BA39FCDCBD3549ECA1D57355E3
SHA-512:	7DF80C017E2F5D1E40CB41795F40E82025B5ED188BD5AF4C812D24F9E8C77438C259417E8592C4D528D37DA495815A057623CCFA67DF35B27980847DBA91AEF5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........L.}...}...}.../D..}....S..}..M2V..}....U..}....C..}....D..}......}......}...}...\|....J..}....R..}....Q..}..Rich.}..................PE..L.....4T...........!......................... ......................................&.....@.............................Fk..p...................................L....%..................................@............ ..\|............................text............................... ..`.rdata..F@... ...B..................@..@.data...(....p.......N..............@....rsrc................T..............@..@.reloc..f8.......:...X..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\KwLogSvr.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73088
Entropy (8bit):	6.419370395015747
Encrypted:	false
SSDEEP:	1536:OD24dyONDcOUOM498ldXs2xnQ+xcLP0OK2LBaNwF:X4kOO498laIQ+xcoOK2LBaNwF
MD5:	15F1FEC47E3AC4A2AE67BDE110CA698C
SHA1:	84EA58DEA72D9FE5B36ED64BEF2C19A43DF90EC1
SHA-256:	003D0E9F37639687CD72F8499743F88B54388A81E4322260280A70C0E601AE21
SHA-512:	C42E8F04FBFCE139D8365CC69CC161469FBB5443A2ACD9CCBBC584F85B04ABE2DFDDCAD1D53ECFB2AB54EBF004F5F10B730A2E677BBABFAD56400BEA7371AEEC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........P.r.1.!.1.!.1.!%~@!.1.!.IC!.1.!.IU!.1.!...!.1.!.IE!.1.!.1.!>1.!.IR!.1.!.ID!.1.!.IG!.1.!Rich.1.!........................PE..L....,WT...........!.........V..............................................@..........................................B............ .......................0..........................................@............................................text............................... ..`.rdata...<.......>..................@..@.data...4...........................@...ConfigVe............................@....rsrc........ ......................@..@.reloc..:....0......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Lastnama

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:I:I
MD5:	C2AEE86157B4A40B78132F1E71A9E6F1
SHA1:	162CDC2A8B567050EAE25592EEEDAF33464A7A76
SHA-256:	46DB1CA7F3598C26C3E6C8D99E3ED95D2B1C76DB040B8F8CD29AF723EE086077
SHA-512:	784CC010C961A58B42984A4EC538D299AB92C01CB95171C220FD26C473491F839FD032960DC148C866DA45411D4ACB93188F0F7857F6F2C09DDF3E9FF50248DB
Malicious:	false
Preview:	892

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Lastname

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:U:U
MD5:	43FA7F58B7EAC7AC872209342E62E8F1
SHA1:	F022DA4E40566305C0C8F39FD8F4B83DD5368834
SHA-256:	96BB293AAA330EF307EE004448B92B75FFDC25ADE2831ED23FC60FFA97FFFB7F
SHA-512:	64B5514668BDBE6ABE7F86ABD790005F46D593D8E3EFB785C87DD8BA9035B8BC5FC72001DA81883391B690A5191057062EE711401C3E95C1935A3D3FFED138FE
Malicious:	false
Preview:	816

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Lastnymc

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	1.584962500721156
Encrypted:	false
SSDEEP:	3:kQn:kQn
MD5:	82F2B308C3B01637C607CE05F52A2FED
SHA1:	75D2A5A3C528920D00425F29099EED114B9134E0
SHA-256:	5C3E9040008C91509E2D28E5308034B677D4E2CC0B386863D4883BDB747EBA1C
SHA-512:	91CCE11EEDA35FD527AC3DDBB930281FCB14AF0EE46412D7A389B59AEA3F8D56F3D46E2EC3BE167406AC4D8FBBD4F7C1246C8F1E30384FDC913703A48D36E4BD
Malicious:	false
Preview:	725

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Lost

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	14
Entropy (8bit):	2.7534343861887853
Encrypted:	false
SSDEEP:	3:ldNojgn:3NoEn
MD5:	5224444F84FC62353F98AD824C1B4F7F
SHA1:	9BC379C9B01210F9AC136B87039584FEBFD8465A
SHA-256:	F47FFEC6EA87BE558D26F9585C02E06A1B657959E4FA1A0EBEB883504BE2EFD4
SHA-512:	387BDACC1827D046D28AE73352E6D85DB018B06F70146952AB92EA004CD46F8154F5BB9153F17DADB5F6CB20CF6352AB6D1D4B1866076F97427D26F11C9D1FA0
Malicious:	false
Preview:	+/.4"(4++)4+)#

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\LostHe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	2.197159723424149
Encrypted:	false
SSDEEP:	3:1Z:1Z
MD5:	0D7C1D8AE080978B8436817C87C11684
SHA1:	C83087520942084476EF74151BF451A0557993DE
SHA-256:	53D24F3BC80C44785C7645F347A17942B607CAA451FC2337F458EA0A73F920AD
SHA-512:	8605C26C90441DFC7DEE0C5816DF5DDCEF42D4A02DE7D819936A60C10A57191AD67F0B95F23FE8CE085EF5F156FBBC57303B44A995AB13B2B8CC941AAB73FEFE
Malicious:	false
Preview:	.cf......

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\LostP

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:K:K
MD5:	49394C8AF72820A1AEB5C9924E2D9281
SHA1:	9F09DA9131EE0047BC4E368ECFF439F0F5E250BF
SHA-256:	631102D19F7CFA51907975CF02066DE70C2F4B5B6A4E3A7F9C4871719DC2A97E
SHA-512:	A3D662166699AC8784C01E0B7EF5D8F7716136B87EE0CB9FFBF5F45F730B8470E7ED57A90956E1F0FA4F4DE5C5C60960AF8622493EBCC88B2A0929FE798BAD60
Malicious:	false
Preview:	,)-*+

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\LostPHe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	0.9182958340544896
Encrypted:	false
SSDEEP:	3:tH:1
MD5:	E62595EE98B585153DAC87CE1AB69C3C
SHA1:	40B904FD8852297DAEAEB426B1BCA46FD2454AA3
SHA-256:	38760EABB666E8E61EE628A17C4090CC50728E095FF24218119D51BD22475363
SHA-512:	84387A560C74CD17A3E1D618181BD7734CACDB1D7B5A52EDF20FBB27C4FEFE25BD4F839C12E842C61CCD57308FD6A6B3987DC237ACCD213B9818D751C3990C10
Malicious:	false
Preview:	aab

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\LostPShe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	0.9182958340544896
Encrypted:	false
SSDEEP:	3:tH:1
MD5:	E62595EE98B585153DAC87CE1AB69C3C
SHA1:	40B904FD8852297DAEAEB426B1BCA46FD2454AA3
SHA-256:	38760EABB666E8E61EE628A17C4090CC50728E095FF24218119D51BD22475363
SHA-512:	84387A560C74CD17A3E1D618181BD7734CACDB1D7B5A52EDF20FBB27C4FEFE25BD4F839C12E842C61CCD57308FD6A6B3987DC237ACCD213B9818D751C3990C10
Malicious:	false
Preview:	aab

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\LostShe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	3.0269868333592873
Encrypted:	false
SSDEEP:	3:q1vC:q1vC
MD5:	213802ED7972AEAFE6237FA1453F1FD0
SHA1:	794A4B01CD429D110180DAA19204A098C42F11E6
SHA-256:	398380CF3867FE7C45A44E02C5542299346B631E627DB931B1FB4C8BE82C58E7
SHA-512:	FE6CFC85A06969389B3AE345C566AFEE7F55F011425070B9AD6342F474266A440EFBA98EA8181DF1AE24A3C617E6CF2A3C916740198F3FEB1B70B5B403A537CA
Malicious:	false
Preview:	af.cbe.a`..`g

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\MemDefrag.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67184
Entropy (8bit):	6.560571950422605
Encrypted:	false
SSDEEP:	768:mE8Ush0dMK0vVZdisbH8iBRq8aZ+LhN3r22t19zS4Kye8pOxbGew2MSPDGjENAMb:mE8tSiKlqcHFChNbj19znKy92bGjwx9
MD5:	D9E742CB7C33C378602A144904756845
SHA1:	6E9C521A8E657FC8B46312AD79C1C7CE08C10766
SHA-256:	29626F619DB47C528EB910C15CDF2D139B512024331DAC91E7C562DF4FF297D8
SHA-512:	4474909CEE6BEA404918A0D9650D72F766A0FB27A5BB7A0BAD04BBD6F6F05EBEC11BEAE9080B4BD9E7A55A8614517B7A7F1DCF49F68308E51AEDACB2FDAC164F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.x.)...)...)... ..%....K.+...{..."...{...-...{...1...{...-....[..(....[.."...)..................(.......(.......(...Rich)...........................PE..L....3.d...........!.........T......g{....................................................@.........................@...X...............................p2..........D...p...............................@............................................text............................... ..`.rdata...<.......>..................@..@.data...<...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.Bcl.AsyncInterfaces.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	64960
Entropy (8bit):	6.573463392054397
Encrypted:	false
SSDEEP:	1536:mbT78So0kats7efpLfvQcl/h5GDwVwZtyA+7XXxDp:mT8Syaq7SBQ35+b/
MD5:	644F4DF789E7B1CC9DE8FCAE8A9B7035
SHA1:	DA389C035C18342DAC47D82333E6F6A9D54E067E
SHA-256:	D2A5F4C9A8DE1FFA1482277889D71738F220DDBD287A279FA11CF2EB4FC1F0E8
SHA-512:	5B49BC385D6460F60FE5D598FCA27E68378A2D7752FA0A9ED7956A1B16B1CCF22EF6300AA8A36AD284047B7D8C4A2654EFFECA845BEC24D21BC9E727A7F39349
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^.F8..(k..(k..(k..)j..(k...j..(k..)j..(k...k..(kH.)j..(k..)k..(kH.-j..(kH.,j..(kH.+j..(k.-j..(k.,j..(k.*j..(kRich..(k........................PE..L.....%e.....................N......@\|............@.................................H+....@.................................`...@........................)......P...d...T...............................@...............H............................text............................... ..`.rdata..@:.......<..................@..@.data...............................@....reloc..P...........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC80.ATL.manifest

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.302102385514918
Encrypted:	false
SSDEEP:	12:TMHdt4IBeBFLOwHR5TNl+rmxgVKaGNLzIZ:2dtFEDCwHTTNl+rkgkJNLzc
MD5:	1CCB36CF4D7744F2A2449710032573F8
SHA1:	22C61BCDFB941EB6AA0829F8FECAA7B716895BF4
SHA-256:	8DC44CBA880E8E7A0776981FAC21094F905750C02890CBADC5059D1049D357EB
SHA-512:	53C6595A29C4636E4FDD800A48DEBF299DBFAC16396C217165BCB9D2E1B431982A1E3D5C8EA7850C178A6F6DA599DDF862DC7F64F29884EC0633A879B5B9C6B3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>. Copyright . 1981-2001 Microsoft Corporation -->.<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">. <noInheritable/>. <assemblyIdentity. .type="win32"..name="Microsoft.VC80.ATL"..version="8.0.50727.4053"..processorArchitecture="x86". />. <file name="ATL80.dll" hash="6d7ce37b5753aa3f8b6c2c8170011b000bbed2e9" hashalg="SHA1"/>.</assembly>.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC80.CRT.manifest

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (504)
Category:	dropped
Size (bytes):	1829
Entropy (8bit):	5.362806750573066
Encrypted:	false
SSDEEP:	48:3rpK+higVB09kkK0hpzxU09kkKqYhzQC09kkK0FFz9:7pthNXkHndUXk8hNXkFjh
MD5:	12B6A5638A4D54F6E613CAFD04BC1C0D
SHA1:	0BD3E9F83883B00DEA8DC95112C8BBD74A14EDEF
SHA-256:	3B55C9DA463C5F6BBBD1E73398FABDC30998BC525F4FE6E586BE711E660BC800
SHA-512:	15272B53972D70C089C9EBF554DE7DD1BC4707EF2FA8D526E7022FC21C8A74AD039387FB4BB53835D0B4443227CB1AD1C1D2CFCB1D205C2729F13BD1FAF9B008
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">. <noInheritable></noInheritable>. <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.4053" processorArchitecture="x86"></assemblyIdentity>. <file name="msvcr80.dll" hash="0a38b652c9d03caab803c6b2505fa301e345bab2" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>TM0VvywbHVQayIOw9CSX6M7WpaM=</dsig:DigestValue></asmv2:hash></file>. <file name="msvcp80.dll" hash="678bf3da5d1987bb88fd47c4801ecb41f51366ef" hashalg="SHA1"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xml

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC90.CRT\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1506), with CRLF line terminators
Category:	dropped
Size (bytes):	1860
Entropy (8bit):	5.392371898016726
Encrypted:	false
SSDEEP:	48:3SlK+vU6g49Pd09kkKKMzEAZ09kkKxrzVHNw09kkK3zY:Clt8CtdXks5ZXk8pNwXkK8
MD5:	53213FC8C2CB0D6F77CA6CBD40FFF22C
SHA1:	D8BA81ED6586825835B76E9D566077466EE41A85
SHA-256:	03D0776812368478CE60E8160EC3C6938782DB1832F5CB53B7842E5840F9DBC5
SHA-512:	E3CED32A2EABFD0028EC16E62687573D86C0112B2B1D965F1F9D0BB5557CEF5FDF5233E87FE73BE621A52AFFE4CE53BEDF958558AA899646FA390F4541CF11EB
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.30729.4148" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="msvcr90.dll" hashalg="SHA1" hash="98e8006e0a4542e69f1a3555b927758bd76ca07d"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>+CXED+6HzJlSphyMNOn27ujadC0=</dsig:DigestValue></asmv2:hash></file> <file name="msvcp90.dll" hashalg="SHA1" hash="3aec3be680024a46813dee891a753bd58b3f3b12"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:d

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC90.CRT\msvcp90.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	570240
Entropy (8bit):	6.523986609941549
Encrypted:	false
SSDEEP:	12288:NZ/veMyZ137mSEWT0VkypLvgLehUgiW6QR7t5183Ooc8SHkC2eU8Z:NZSZ13iwJmgLq83Ooc8SHkC2eN
MD5:	232708A3FB0137133BA1787EF220C879
SHA1:	4F725F93081FE15C6AF99E32F3E97CCB22E15BFE
SHA-256:	64236B28CB287D9C912D1DB753B21BEB95009340B7ABB2717E40CE8D91946C89
SHA-512:	90DAEFA1F3D3608700074F349D0CD5E5D2EAE090ECAD07352E553F08087A2EDDEB457F235CDC7E4869C4CF24E895C05C11AF968E68CFD0B6AA8092C98DC7E4FC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L...~LYJ...........!.....4...p..............P....Hx......................................@..........................P..,....E..<...............................43...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC90.CRT\msvcr90.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653696
Entropy (8bit):	6.885617848989009
Encrypted:	false
SSDEEP:	12288:Bhr4UC+UumMaIYE8EoPP1cI9xPP2OKDL9QXyG2pUmRyyva:VU9FNPPbxPP2OeL9Q2pUmRyyva
MD5:	4B9B0107D35859FA67FB6536E04B54A7
SHA1:	60F5D36F475FEA96F06AC384230B891689393486
SHA-256:	EA59B23FC4799B10B07CC1E4F81BBCB7FAC712D93E2BA48DE50046E5B4C140DB
SHA-512:	324EDB6D0C618C20260417B86189C27D6E1EB00944C7F5A6C59679365E618D262C71433749DDFEF253B723F1D1B3167982B4742164A167B3CFC85C651300382B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L...yLYJ...........!.....\..........@-.......p....Rx.........................0............@..............................\|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC90.MFC\Microsoft.VC90.MFC.manifest

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (2003), with CRLF line terminators
Category:	dropped
Size (bytes):	2357
Entropy (8bit):	5.378158011805663
Encrypted:	false
SSDEEP:	48:3SlK++U6g4A09kkKNzx09kkKJpzSgd909kkKzZuzl09kkKTzY:CltFCAXkgNXkKGgd9XkxZXke8
MD5:	0323AF0C3E694D85650AE55AA27EEFB3
SHA1:	672079C9564B4EC16EFB24DC80DE3EBEAF2A9F27
SHA-256:	1FED2074AB9F90D9FCCC5A49B6AA42C917674C2B5C7B1BB93FB67B0E0C944818
SHA-512:	5DF2D8B07B3ED0CAE3536C09AECA714B56EB75BC76668447C45917E890F5D22EF14B6059BD5782FD06D075A8497BC39A89F809E413C637405AE9BE4193C66FE1
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">.. <noInheritable></noInheritable>.. <assemblyIdentity type="win32" name="Microsoft.VC90.MFC" version="9.0.30729.4148" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>.. <file name="mfc90.dll" hashalg="SHA1" hash="ec50bf1691888076202d5831599ac75ba0d35977"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#"><dsig:Transforms><dsig:Transform Algorithm="urn:schemas-microsoft-com:HashTransforms.Identity"></dsig:Transform></dsig:Transforms><dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"></dsig:DigestMethod><dsig:DigestValue>WuUqeI7Lf0+bhIfTm0T6Pv1L13g=</dsig:DigestValue></asmv2:hash></file> <file name="mfc90u.dll" hashalg="SHA1" hash="c752d2a42c0b82d2145cebcda60c7e5a43245cf4"><asmv2:hash xmlns:asmv2="urn:schemas-microsoft-com:asm.v2" xmlns:dsig

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft.VC90.MFC\mfc90.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3765632
Entropy (8bit):	7.006945366952565
Encrypted:	false
SSDEEP:	98304:dOPkcHVGUQywT84a5IY9IViQ0zMzlp7toNTbPXQlk3glLsFLOAkGkzdnEVEFoKGA:WkcHVMTlBp0TrwlLsFLOyEFoKGD8
MD5:	225F7A12F61B3276D12310F457822D7A
SHA1:	F05B2DFE12D946606DDF0CD7E8A15027D75718AF
SHA-256:	3CED269344FD6AC7A3872D3DA39364397193C650A497702A0849C9543601A42E
SHA-512:	EF09DBC3FF0C6F1B229B4FCFD371A05E5570FDEB296D0F051F1AFD7C2F2567CEF86E47A3DA1B6D3B4AF116D9AC9F7508C36BAC065120F4519BC960AB0475349F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............y...y...y.......y.!.Z...y.......y.....y.....y.....y.......y.......y.......y...x.c.y....0.y.....y.....y.....y.Rich..y.................PE..L...ImYJ...........!......%..(........!.......%...^x..........................9.......9...@...........................$.....,.$......`&..l...........\9.......6.\.... ..................................@....................q$......................text.....%.......%................. ..`.data.........%.......%.............@....rsrc....l...`&..n....&.............@..@.reloc..F.....6......r6.............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Microsoft_VC90_CRT_manifest

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	2.9968027726780173
Encrypted:	false
SSDEEP:	3:HSu+QvdSG/cn:+SQqc
MD5:	6E17DDA977CBC993A9308145693BFE90
SHA1:	D964351BEE8764DE9CBCA186B7D1F526EB6361DB
SHA-256:	615707952EB080E6824699C73F1D914C2278E103CEA452CF4111063DD274458C
SHA-512:	3A1A40DBE7FF5911B3D42DF7C8A74470869CE3F75612A19A73256C799F2A1DD472607F3C89DAD5060AEC1FA953BDFED90A481A4413D2999D122B7AB1D8F7DA77
Malicious:	false
Preview:	577F7F777C753E756875FCD3D7619

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\N0vaDesktop.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5972392
Entropy (8bit):	6.868183225292118
Encrypted:	false
SSDEEP:	98304:ygUifEmDR4lEtsaowOSiL5f5aLbunw8Y6+15cmCSrw0sn/DVpFLOAkGkzdnEVom5:gifXD+Ktu75fu11CSrw0c7nFLOyomFHj
MD5:	06808B78BCC668E76A1F3B9589B985F2
SHA1:	07349BD4A98F70C0870802FCE91CE4F15DCB48AD
SHA-256:	4E560A33A3585F5F6DDD4674E8D8098B977BA3AE320ACDC4ABAC33B89CE17C97
SHA-512:	CED48BD909ACC1B4012A8FC56C8EE76CB0716611B9448465E8DE1670444C04E3B602D7F5A3AF66527EDF760DD10EAA12C68511CF1154B9B8A349D8D443B99EE7
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........B.{G#.(G#.(G#.("E.)o#.(..(F#.(.}.)D#.("E.)F#.(.z.)D#.("E.)C#.(\|}.)Y#.(\|}.)`#.(\|}.).".("E.)v#.("E.).#.("E.){#.(.}.)B#.(G#.(. .(.}.)M#.(.}.).#.(.}%(F#.(G#M(F#.(.}.)F#.(RichG#.(........PE..L......g.................Z1...).......'......p1...@...........................[.......[...@.................................@.<.X.....?..y............Z..U...0X.@y...a7.T...................tb7......b7.@............p1.\|............................text....X1......Z1................. ..`.rdata..2....p1......^1.............@..@.data...X[...`<......N<.............@....gfids........=.......=.............@..@.giats........?.......>.............@..@.tls..........?.......>.............@..._RDATA..0.....?.......>.............@..@.rsrc....y....?..z....>.............@..@.reloc..@y...0X..z...RW.............@..B................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\NULL.bin

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	125376
Entropy (8bit):	7.998479503470445
Encrypted:	true
SSDEEP:	3072:FI6dBzpxvuZ9UIQrNJ6DKxOssBCI4sB74xoGhFo4Z1J21:m6zzYsBMcsBCpO6Py
MD5:	0C21E337569640A73AF44474F44CB9F7
SHA1:	82C3C1C2602250441C1B18200F7FBDC2B6443352
SHA-256:	BC58641B4F43BE40016044046321F77DD153F0BFCE6E4E9D765711838DB13ECA
SHA-512:	7D19FBF9E907E468C34813B0E1E4F2880762573C9EFE678C36C5CA254890A4B0A008DE72E824345C3FBB838C7BAE3E3D991D46CFAF0FAA73BE89EA88DB2E3C76
Malicious:	false
Preview:	...:w.C...k....r....F...g{>..K....3==...6C..l.../.H..L.\|,..#.c....../I.....>........2.....(SH..Z..uJ...t..#Ov..p...XJ..E..8.t.....0d.Ew.DR...lZF..i0..v5.....y/......g...Z=.Z\|.)4.o.n.....i.g0..T.Z.......i...-.F&....{.'..E....G./....M....L....U..?....Ei'..\|.)..J,XnL...<..A......1..D.%I.CA.....#.-;z...g....U$.{.t.$\...$.+./...\|.@.5.0d.H..D.Ga..Tod....\{...Mj.\.....}..:.............StlE=.....~..3......;....I.@I.<...<..;....Y...u...P.....F.1p.^.y...f....P././}.....P.b/.J....?n.^"....S.1.}.JT...rS^t..5..X..["rL.<....$..K]`-)aq. ..1$.X..]... .9....k......v.../!....Vu.m.W.9G...us,3.....i.}..2.O8.t....j..mi..~..~'H&.....)......f..%...h.....i.f..0+.8.;....r&Y\..TO.E...!..n...t.h...KZ..K.L.i.h.,.;bm...`sS.~..\O.i.v!o.,..G.'...:=.Fn.x.b.E^r...j}.<.b.}....V..`M.Y\|;j,=....g.*..g....).Cw.eC.K...C...8nMc....P..[PP..Ghq..n.#..6j;.V..z..L.}..^.k.A......R....M.=}.bN\ty.3..c\|z.\./-E..^.P6..`9.8&xH.y..&...$.6...t........V..EZ.Cf...x...1oH>Y.....+..

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\NVIDIA_GeForce_Experience_json

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.0657682899193968
Encrypted:	false
SSDEEP:	3:4j46giWEcn:046BWEc
MD5:	23A56B3DBA64589852CD17E11CA111EF
SHA1:	FD6568661FC88695B76489727FB59734B2152427
SHA-256:	0415B8232791D3345042C516C9AF6F4FCACCFAD5D794FDAF1A15F0B34C77C3D1
SHA-512:	29837A72F9C7858C2DA38C2D69C64E98A531CDBF46D8EC7E92F608F917D93619AAC6B38DDD792FCDD8F654B51C7F6D6518F3CA120E7502AE8AFB979FEA015C59
Malicious:	false
Preview:	7C79727375763E747C7CFCD3D7619

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\NetDevenvSpeed.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	667648
Entropy (8bit):	6.655676024268379
Encrypted:	false
SSDEEP:	12288:G36HjCm6ltuRXQ/g+hVfW2LDzeLA5rJWutAWQSHOALXB:VCm6ltuRXKg+hVfWkDEA5tDuyX
MD5:	BA4ED2E6B25A8C9EDA3DA4CE85A5054D
SHA1:	C3B2EF12347E0C5206B4C3959FA96CD7F064F10C
SHA-256:	31370AB9ECAFEA8528D0C844C34B7721042C93A8E45278C4452B62ABAADE9182
SHA-512:	87C10EA2B82D79BD96CA453D808D937841A45CEE331E5914E5B9A7D6665BB41864D90E08E47F4000C1EEBC64F1E4035B010F545B2068B3604A7B8C87F1D30DBB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........xt..............a.......a..W....a.......l.......l.......l.......a..............l......l......l......l......Rich............PE..L....+.f...........!.....f................................................................@.....................................(.... .......................0...K...[..............................8[..@............................................text...cd.......f.................. ..`.rdata...Z.......\...j..............@..@.data....2..........................@....rsrc........ ......................@..@.reloc...K...0...L..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\NetSpeedLog

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	330752
Entropy (8bit):	6.280455055315828
Encrypted:	false
SSDEEP:	3072:x9LbnjzIPOmRM0KQfU9JwjvD2xCovPVZHuEi+e15HiEGPGqQiblLYEaZ4OYlYXo2:b928/BvNZ8NHd7ibGYuG9/31P+HvufI
MD5:	AF1EFD2EFED6CC982E4AD7E1C19DC057
SHA1:	88C72A225D8DF3AF56A69EFF41295624FBE821E8
SHA-256:	00E7F8BCF5A97ED5A4E16A03E50EDEB6C2CCACE498DA46753E56C9A65042552B
SHA-512:	D6876F27010EBD4C7C28F1A8B14EF41D7096B35402EF0B0196C379C5D130AE3C9F94DE63B70E5A0E62BA717B7A07B478D830DC5896BCBA721E5AE0D2BAC14A00
Malicious:	false
Preview:	..D.................................................................`..........................................................#...@...@...@.......@..$(...@..>...@..B6..3@..B6..@..B6...@..$(...@..$(..<@...@...C..B6...@..B6...@..B6...@.....@................................Lj.........4........@.........T........d.....................................................................$......P.........`....................T.....................................................d..(............................\....SF.......@...........................n...d...h...\|..............................Z..........................`.......................................T...............................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Ntvbld64.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	MS-DOS executable PE32+ executable (DLL) (native) x86-64, for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	42976
Entropy (8bit):	6.2171815555231875
Encrypted:	false
SSDEEP:	768:iHfqCaczo/ZinYCOd9L9KyhaM7JubDGpZRKjKj9MPgkU7:8fqT/ZWY/L9l7JheMJ
MD5:	671F95CAB2B5CF121125413F250F5275
SHA1:	73D99D09A3D8978A5C6DB43CEC85FB43B03B7A26
SHA-256:	728A1FCDEDCA6DBD8FDDDE3F33CD64DD99853C26EF5B10D3FEF0D76D0480964B
SHA-512:	4AF690AF838CEB026636931AEDE3852EAE6D83881149EF4C28CC1DD032C3F7F6A64B30171C2524512FACD40496DAB305523D20637B44EFBF0D5805D0FAD1FFCB
Malicious:	false
Preview:	MZ!..... ..........e..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ntvbldDXML..$............!.L.!.........`......................................................................Rich....................PE..d.....a.........." .....H...".................p..........................................@.........................................pV.......S..(.......h....p.......h..H?...........................................................................................text....F.......H.................. ..`.data........`.......N..............@...

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\OTGContainer.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5972392
Entropy (8bit):	6.868183225292118
Encrypted:	false
SSDEEP:	98304:ygUifEmDR4lEtsaowOSiL5f5aLbunw8Y6+15cmCSrw0sn/DVpFLOAkGkzdnEVom5:gifXD+Ktu75fu11CSrw0c7nFLOyomFHj
MD5:	06808B78BCC668E76A1F3B9589B985F2
SHA1:	07349BD4A98F70C0870802FCE91CE4F15DCB48AD
SHA-256:	4E560A33A3585F5F6DDD4674E8D8098B977BA3AE320ACDC4ABAC33B89CE17C97
SHA-512:	CED48BD909ACC1B4012A8FC56C8EE76CB0716611B9448465E8DE1670444C04E3B602D7F5A3AF66527EDF760DD10EAA12C68511CF1154B9B8A349D8D443B99EE7
Malicious:	false
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$........B.{G#.(G#.(G#.("E.)o#.(..(F#.(.}.)D#.("E.)F#.(.z.)D#.("E.)C#.(\|}.)Y#.(\|}.)`#.(\|}.).".("E.)v#.("E.).#.("E.){#.(.}.)B#.(G#.(. .(.}.)M#.(.}.).#.(.}%(F#.(G#M(F#.(.}.)F#.(RichG#.(........PE..L......g.................Z1...).......'......p1...@...........................[.......[...@.................................@.<.X.....?..y............Z..U...0X.@y...a7.T...................tb7......b7.@............p1.\|............................text....X1......Z1................. ..`.rdata..2....p1......^1.............@..@.data...X[...`<......N<.............@....gfids........=.......=.............@..@.giats........?.......>.............@..@.tls..........?.......>.............@..._RDATA..0.....?.......>.............@..@.rsrc....y....?..z....>.............@..@.reloc..@y...0X..z...RW.............@..B................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\plugins\Microsoft.VC80.ATL.manifest

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	5.187860451409661
Encrypted:	false
SSDEEP:	6:TMVBd6OjzIIBeBXVL9obRu9Td8gH9aO/5TMiX1+jSQdS1vwIgVf+ZaYf7:TMHdt4IBeBFLOwHR5TNl+rmxgVKaq7
MD5:	0BC6649277383985213AE31DBF1F031C
SHA1:	7095F33DD568291D75284F1F8E48C45C14974588
SHA-256:	C06FA0F404DF8B4BB365D864E613A151D0F86DEEF03E86019A068ED89FD05158
SHA-512:	6CB2008B46EFEF5AF8DD2B2EFCF203917A6738354A9A925B9593406192E635C84C6D0BEA5D68BDE324C421D2EBA79B891538F6F2F2514846B9DB70C312421D06
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>. Copyright . 1981-2001 Microsoft Corporation -->.<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">. <noInheritable/>. <assemblyIdentity. .type="win32"..name="Microsoft.VC80.ATL"..version="8.0.50727.4053"..processorArchitecture="x86". />. <file name="ipaip1.exe"/>.</assembly>.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\plugins\Microsoft.VC80.CRT.manifest

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	314
Entropy (8bit):	5.140999301390513
Encrypted:	false
SSDEEP:	6:JiMVBd6OjzPbRu9Td8gH9bZELrbvm/53SMiX6+hPABdS1FggVfgk5Z:MMHdtlwHHJ53SNK+hPIRgVR5Z
MD5:	710C54C37D7EC902A5D3CDD5A4CF6AB5
SHA1:	9E291D80A8707C81E644354A1E378AECA295D4C7
SHA-256:	EF893CB48C0EBE25465FBC05C055A42554452139B4EC78E25EC43237D0B53F80
SHA-512:	4D2EC03FF54A3BF129FB762FC64A910D0E104CD826ACD4AB84ED191E6CC6A0FEC3627E494C44D91B09FEBA5539AD7725F18158755D6B0016A50DE9D29891C7E5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">. <noInheritable></noInheritable>. <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.4053" processorArchitecture="x86"></assemblyIdentity>.</assembly>

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\plugins\am.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	6669
Entropy (8bit):	4.733830185137714
Encrypted:	false
SSDEEP:	192:4c2LQ563O84ggqSdqfD6JngOvFfkxFfdpj8IY8YS3dRp79S7EO:pIEiKT5hTvWx11Y8YShhS7EO
MD5:	748E5EA71A607EA89B219AFC97052259
SHA1:	8677307E553474320A2616EABBC5534F42D100BC
SHA-256:	E481BA3734925C59839FDB29E5FB171F0DF0640A48D4C61C9CAA9F475D2ADE89
SHA-512:	49F78793C75A70502E43A138F762940149F536BB494473B1672A1E0E0C7BE2AA72337B3524EB0E4D5F0B60203711D87958FAB88F1404476BF779967350B00364
Malicious:	false
Preview:	..........N.....N.....N.....N9....NB....NH....NN....NT....N]....Ni....Nu....N.....N.....N.....N.....N.....N.....N.....N.....N.....N"....N(....N.....N:....NO....N_....Nu....N.....N.....N.....N.....N.....NK....Nk....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N#....N,....N9....N[....Nd....Nz....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....ND....NJ....NV....N\|....N.....N.....N.....N.....O.....O.....O.....O1....OD....OQ....OZ....O.....O.....O.....O.....O?....Ou....O.....O.....O.....O.....O+....O\....O.....O.....O.....O.....O2....OX....O.....O.....O.....O.....OG....O.....O.... O....!O...."O!...#O0...$O6...%OE...&OQ...'OZ...(Oo...)O....O....+O)...,O....-O.....OZ.../O....0O....1O....2O....3O6...4Ow...5O....6O....7O....8O....9O....:OI...;Oo...<O....=O....>OE...?O{...@O....AO+...BO....CO3...DO....EO....FO....GO....HO....IO....JO....KO....LO....MO...NO@...OOL...PO....QO....RO....SO...................... .... ....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\plugins\ar.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	6252
Entropy (8bit):	4.765802565676888
Encrypted:	false
SSDEEP:	192:8q+c4RnQTyZHZo/zjH26bojOpyuT/j8I8hi8v8hqCPC5/P5zn:8jYo5oLjH26EjOp/Mn
MD5:	1F9D7E57FE35D3A35FE49E6E2BAC8707
SHA1:	E6C4BCC56AE5742E7B825F489BF33B491970ABE6
SHA-256:	7522EF5C3E10BF279E777054D858955F1B9F63A39CCB408364C413E6E3D49A04
SHA-512:	489C79155C5E84702B58072E8A44C123D8F0C3F226A5073EAE343506A76D0E378418557DD29CEF8283425A46A248132CCB1F78E13C867829E399CB6EF17769F2
Malicious:	false
Preview:	..........N.....N.....N.....N.....N.....N&....N,....N2....N8....NB....NL....NV....Nk....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N)....N:....NO....N]....N.....N.....N.....N.....N.....N$....N=....ND....NW....Nc....Nx....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N$....N7....N?....NX....N\....Nw....N{....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N&....N0....NA....NV....O`....Os....O.....O.....O.....O.....O.....O)....ON....O.....O.....O.....O.....O(....Ol....Ov....O.....O.....O.....O.....O.....O2....OY....O.....O.....O.....O.....OS....Ox....O.....O.....O.... OK...!Od..."Ow...#O....$O....%O....&O....'O....(O....)O....*O....+Oz...,O....-OC....O..../O....0O<...1O....2O:...3O}...4O....5O....6O....7O....8O....9O....:O/...;ON...<O....=O....>O....?O+...@Oc...AO....BO8...CO....DOS...EO....FO....GO....HO....IOC...JO\...KOm...LO....MO....NO....OO....PO....QO....RO0...SO:.....l.................. ..... .. ... ....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\plugins\bg.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	7220
Entropy (8bit):	4.592203217648416
Encrypted:	false
SSDEEP:	96:eOu4nxWcR1emdX4DRkw0UzNAHSZwIQshZrlLBXWeOwg6lz737RC:HScRkB6WmSZRhZiePlzz70
MD5:	6E09177086163D64ED7AB890D70CFDF3
SHA1:	87B7FCA47DA5BAE28C7182A221E923588EBEADF8
SHA-256:	B0E8F4379AA7B1CF11C196354C6C0212558B1E5BA20332A34F30B5263D4B1EA9
SHA-512:	48191FBA9308E58CE482193CAB4DEA032A37136D6F1D1132B45D0894B18EA3B5BE330BBF9FA61CF2C5BC711B371D53430554BAF103CEC027E6026E5F27A292C5
Malicious:	false
Preview:	..........N.....N.....N.....NI....N]....Ne....Nk....Nu....N.....N.....N.....N.....N.....N.....N.....N.....N!....N.....N;....NH....NU....NY....N]....Ne....Nw....N.....N.....N.....N.....N.....N9....N.....N.....N.....N.....N.....N ....N4....NZ....N.....N.....N.....N.....N.....N.....N.....N.....N<....Nd....Nt....N.....N.....N.....N.....N.....N.....N@....NL....Ny....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N:....OH....Oj....O.....O.....O.....O.....O#....OB....Oc....O.....O.....O.....OS....O.....O.....O.....O.....O.....O:....On....O.....O.....O.....Oq....O.....O.....O.....OD....Oe....O.....O.....O:... O....!O...."O....#O....$O....%O....&O....'O....(O....)OP...*Ot...+O....,O....-OO....O..../O....0O`...1O....2O4...3O....4O....5O"...6Od...7O....8O#...9OR...:O....;O....<O-...=Oi...>O....?O....@O....AOy...BO....COw...DO....EOw...FO....GO....HO....IO....JO....KO....LO+...MO9...NOC...OOU...PO....QO....RO....SO......4........................ .... .....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\plugins\vd.ico

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	MS Windows icon resource - 9 icons, 48x48, 16 colors, 4 bits/pixel, 32x32, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	25214
Entropy (8bit):	4.526069485099958
Encrypted:	false
SSDEEP:	384:eLpEC0qWDnDjVSV/+/CB1+n2GHOMmM5H6:1C+Sp1QdHOc5H6
MD5:	9946B791C261BA0A4CCF6E46F7B54546
SHA1:	3082E44F89AB9CD5ED1705F0470A33D1279D2A67
SHA-256:	62729E6D23D8DD347ECCB5B9D292A089ECA582694082EB8F1DDF55E9AE18B0C0
SHA-512:	A2C11556486E5F1B417F61ABCDA1BB3B064CD29515DDD0CF94985E24043D2F1483E74938711290A3FD681157F2559ED719B30B367481D81B41E01676E84DC03C
Malicious:	false
Preview:	......00......h....... ......................(.......00.............. ......................h...^"..00.... ..%...'.. .... .....nM........ .h....^..(...0...`.........................................................................................................................................................................................................................................................................wwwwwwwwwwwwwwwwwwww....................................................wwwwwwwwwwwwwwwwwwwwx...................................................wwwwwwwwwwwwwwwwwwwwx...wwwwwwwwwwwwwwwwwwwwx...ppppppppppppppppppppx...........................................w.w.....................ww.p....................ww.p....................w.w.........DDDDDDD@...............tDDDDDDDG................GwwwwwtO................GwwwwwtO................G....wtDDDDDO...........`....wtdDDDDO...........@....p.GwwwtO...........`....p.gwwwtO...........@....p.G....O...........`....p.`....o.......

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\plugins\version

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	F1D3FF8443297732862DF21DC4E57262
SHA1:	9069CA78E7450A285173431B3E52C5C25299E473
SHA-256:	DF3F619804A92FDB4057192DC43DD748EA778ADC52BC498CE80524C014B81119
SHA-512:	EC2D57691D9B2D40182AC565032054B7D784BA96B18BCB5BE0BB4E70E3FB041EFF582C8AF66EE50256539F2181D7F9E53627C0189DA7E75A4D5EF10EA93B20B3
Malicious:	false
Preview:	....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\themes\ca.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	4447
Entropy (8bit):	5.418213783438325
Encrypted:	false
SSDEEP:	96:cqGYHvAfKA/nFGBlyL5tTIYOBcZbISSZrJz94IvXqUQEQ6TH3Hzniv7:cQgrnwPyVCYOCZ8BZrJz94IvXqUQEQ4I
MD5:	DA44E0F806463B7F0D3FA8C93A4E50DE
SHA1:	DAE138775B448187C099EB4C6EEE463E4CD47E84
SHA-256:	FF4CBCFEBE833E21C37A02C04257FDB2369E42E3BE18DCF75335333A06EA789B
SHA-512:	9E8BD23F668BF312817592445C9E2BFC2CFDCC2BEF47DDFE711C750409CEE5855F2E9AFD96DA4F3F4B5E7C92A8C4C675AF45389A40C3033F73453971BD358C3D
Malicious:	false
Preview:	..........N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N!....N+....N9....NJ....Nb....Nl....Nu....N~....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....NC....NY....No....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N'....N;....NI....NW....N^....Nq....Nz....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N#....O-....O2....OK....Or....O.....O.....O.....O.....O.....O.....O.....O'....OC....O`....O.....O.....O.....O.....O.....O.....O.....O.....O/....Oa....Ow....O.....O.....O.....O.....O9....O[....Oy... O....!O...."O....#O....$O....%O....&O....'O....(O....)O....*O....+O+...,O....-O.....O..../O?...0O~...1O....2O....3OB...4Od...5O....6O....7O....8O....9O....:OY...;Oo...<O....=O....>O....?O....@O....AOW...BO....CO....DO(...EOu...FO....GO....HO....IO....JO....KO....LO....MO....NO....OO....PO....QO)...RO1...SO;....._...DetallsDesa.s un .ndex on es poden realitzar cerques. Intro

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\themes\cs.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	4278
Entropy (8bit):	5.761351246793285
Encrypted:	false
SSDEEP:	96:0CLGsy4GgACuoiU4CJeDof8QQgWu6/K3eVeRl2c0cLeI:lLTy42oiJQwof8Qcu6y3WWr
MD5:	E160C8912A6E73BD4CD2544A9F3C3974
SHA1:	E46EF68F3113BD36D40635C76452445F7D359F39
SHA-256:	C01E38999FE2C1F98B5429BD550AE8A9F15F10D09D41EFFF8F3C7F4F1F66209C
SHA-512:	7CB2E47F945705DFD0030B28BD62709361DFD17AA925C68A85B34DDEE0584307C2FA918EC4B1443C2181578AFC6CD64878AADE25A469CDB2F0C45237682F35A0
Malicious:	false
Preview:	..........N.....N.....N.....N.....N.....N.....N.....N.....N.....N ....N'....N0....N=....NK....N[....Nn....Nx....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N#....NG....N_....N{....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N ....N7....N@....NP....NU....Nd....Nk....N~....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....O.....O%....O/....OL....O[....Ol....Op....O.....O.....O.....O.....O.....O.....O+....OU....OY....O^....Ot....O.....O.....O.....O.....O.....O.....O.....O:....OO....Ow....O.....O.....O.....O.... O....!O0..."O;...#OA...$OH...%OO...&OU...'OX...(Of...)O....O....+O....,O....-O....OW.../O....0O....1O....2O2...3O\...4O~...5O....6O....7O....8O6...9OQ...:O....;O....<O....=O....>O....?O(...@Oc...AO....BO....CO0...DO~...EO....FO....GO....HO....IO....JO#...KO*...LO6...MO?...NOI...OOR...POp...QO....RO....SO..........PodrobnostiUlo.itToto je prohled.vateln. index. Zadejte hl

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\themes\da.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	3875
Entropy (8bit):	5.465278759668329
Encrypted:	false
SSDEEP:	96:znbLo2urHRFWbiEP15P4q7GL8cyScTs3DhDU/EZ87s:3/udeiy5P4q7i8cySes3tw/Ed
MD5:	25A5E506C8A0C64D9B9E08AAAC9626E6
SHA1:	82F8D1E8CE364694F03C5133604F72C2608B8924
SHA-256:	229DA0D16A7FA0BFFD67B78F2F76734C7EA2129A15CE95DA9422775B4E9835CE
SHA-512:	33F86B51BE09DCFEC6B9064E5906EC782C5AF9DFCC727A2A7E4BFE5FF6908AF115E5937EC7CF2BEDF103FFA1A941D340D2C0F2E13F8447FCDE1CD649E9A936BA
Malicious:	false
Preview:	..........N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N ....N+....NF....NN....NV....N^....Nf....Nn....Nv....Nx....Nz....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N....N:....NA....NG....NR....Nb....Nu....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N1....N7....N>....NJ....NS....NV....N[....Ng....Nj....No....N}....N.....O.....O.....O.....O.....O.....O.....O.....O.....O.....O.....O.....O:....O`....Oo....O.....O.....O.....O.....O.....O.....O.....O.....O.....O.....O$....OD....OU....On....O.....O.....O.....O.... O....!O...."O#...#O+...$O1...%O9...&O<...'O?...(OI...)Od...Os...+O....,O....-O.....OQ.../Oq...0O....1O....2O....3OC...4Ol...5O....6O....7O....8O....9O/...:OZ...;Og...<O....=O....>O....?O....@O....AO2...BOm...CO....DO....EO[...FOg...GOk...HOv...IO....JO....KO....LO....MO....NO....OO....PO....QO....RO....SO......#...DetaljerGemDer kan s.ges i dette indeks. Indtast s.ge-n.gl

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\themes\isolinux.bin

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	isolinux Loader (version 3.82)
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	7.08359030184487
Encrypted:	false
SSDEEP:	384:Gh5TvIzjLaWhV12sPtZK7zVi8vnKnjPlVzjzmtInQt//:Gh5DI/LfnC7zQ8z02//
MD5:	7EC434DAFE56FBFBBD9F609A8E51ADF1
SHA1:	31EB96F0B7EEB6D3972D735F20C18A4DEB425942
SHA-256:	E9A4817AB449A50364B0DD33425BDC596D222C1792A460831F87487439385E32
SHA-512:	454920BCCD663FA585E1954A320616BAD5061EB03886E284284796F9D3A2079D3ED019AD9AF6E381CF647CF27ED0EA8C098C6399479B2091BD49B472728C13F6
Malicious:	false
Preview:	..w\|.............8...Wa......................xpY....)....)Z_.f1.f1...\|s.fXf[.f..).f...).@....D....<...&.)....)1....{.W..........6.)f..f..)......6.)...f1..@\|...f.f....f.>.)...)..).!.f1..f....)....)...(...8...F.>.)<.u...K...)..).........)8..)....f.>.\|.u'f..)f!.t.f..........f.G......f.(.f..\|f..\|f-....f...f..)f.....f.....)f..\|f@.@...1...).Q........f...)f.>.)&f.f..fIt.!.u..........f9>.\|t.........O..........\|.............f.L.f..}.......1.W..}...._..Gq..f..}f..t(f.L.."&f.E..f;..}t.f.L...K...)..)..r......`..K..)....~.ar....U....p..M.8..)u.....A....).....)8.t...8.t.J...s....)...r..!.......3............\......PV.3....^...X....f.f`..1...faf..U............F.......]......&.)f1.f....f...f...)f...)...U...f......fRfP.SWj...f`...)....B...fa.d.r.]f..f...)......!.u..f`1....).{.fa....):.]..f1.f...f...)...fRfPUSf..6.)f..>.)f..1..f...I.).9.v......A......)......f`...far.f......[..]fXfZf..).u..Mu...H.u...;.H.v...H..(.\..D.f.D.U;.J.v...J..l.V...).B...^]f..D.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\themes\ovf-vmware.xsd

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4056
Entropy (8bit):	4.424470799098464
Encrypted:	false
SSDEEP:	24:2dd8puSF899zzcmOlkkXsxPxPxSlptWeWOy/EpgbJMxPxSa7cRtaDeH0iBD88Epc:cd2VF+kXsolPWeWONgPRRtWeHGsUgcBg
MD5:	9392A998B91E7C12F20FE8ED0D7C7610
SHA1:	19C90803DB690AF45D7E6F8F8B1C7BD41F71A2CA
SHA-256:	662B3AB8423F4E5B05061B88CCA8A134A50799D6DE0CEC8977F46749A89E0FBE
SHA-512:	EA15C2FCAB591A384265EE726925CE3D07BB2E8DE79BDA7A6F203A54FBA2441FAABA4EA6925242B2D84DE76299CB99B2DB8B62149F405F86BD2C58609BE605A1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.. .. Copyright 2008 VMware, Inc. All rights reserved..... Remark: The OVF Specification 1.0 Annex D defines a set of relaxations on how .. this XML Schema 1.0 definition is to be interpreted...-->..<xs:schema targetNamespace="http://www.vmware.com/schema/ovf".. xmlns:vmw="http://www.vmware.com/schema/ovf".. xmlns:ovf="http://schemas.dmtf.org/ovf/envelope/1".. xmlns:xs="http://www.w3.org/2001/XMLSchema" .. attributeFormDefault="qualified".. elementFormDefault="qualified">.... Include and import sections -->.. <xs:import namespace="http://schemas.dmtf.org/ovf/envelope/1".. schemaLocation="../DMTF/dsp8027.xsd"/>.... <xs:element name="IpAssignmentSection" type="vmw:IpAssignmentSection_Type".. substitutionGroup="ovf:Section">.. <xs:annotation>.. <xs:documentation>Element substitutable for Section since.. IpAssignmentSection_Type is a derivation of Section_Type..

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\themes\ovfenv-vmware.xsd

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2951
Entropy (8bit):	4.309681188440056
Encrypted:	false
SSDEEP:	24:2dX8QSF899Szc42+lkkXsxWCGRPxSHnSEIHkyspXuKEpsZEpgcBg:cXEFckXsQeHnSEIHkysNEsUgcBg
MD5:	FB0DFD7CE4E12DBC2CEDD5CEA0FAE216
SHA1:	FA8FCB791F89F0CF170C58AF74626BCE6F9DAC9B
SHA-256:	7AB54BD0D58AE49A735FF551E260DCDE51CE28CF591580BCC150C4F15641C39E
SHA-512:	250B1290349D8D10A609E027DD3EA3CDF21BB40A7457FCE94294327DD92EFC957628AE735D44498328489A741209C09C7B0C7CA8822251B2D30A17121A74A549
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.. .. Copyright 2008 VMware, Inc. All rights reserved..... Remark: The OVF Specification 1.0 Annex D defines a set of relaxations on how .. the this XML Schema 1.0 definition is to be interpreted...-->..<xs:schema targetNamespace="http://www.vmware.com/schema/ovfenv".. xmlns:vmwenv="http://www.vmware.com/schema/ovfenv".. xmlns:ovfenv="http://schemas.dmtf.org/ovf/environment/1".. xmlns:xs="http://www.w3.org/2001/XMLSchema" .. attributeFormDefault="qualified".. elementFormDefault="qualified">.... Include and import sections -->.. <xs:import namespace="http://schemas.dmtf.org/ovf/environment/1".. schemaLocation="../DMTF/dsp8027.xsd"/>.... <xs:element name="EthernetAdapterSection" type="vmwenv:EthernetAdapterSection_Type".. substitutionGroup="ovfenv:Section">.. <xs:annotation>.. <xs:documentation>Element substitutable for Section since.. EthernetAdapter_Type is a de

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\themes\sample.flp

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	DOS/MBR boot sector; partition 1 : ID=0xda, active, start-CHS (0x0,0,1), end-CHS (0x0,1,18), startsector 0, 36 sectors
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	6.703256936166348
Encrypted:	false
SSDEEP:	192:YaPUesFIxeyrsMBe1MlsBc0GLGEiyXYmWhFdrNkv:baIFrXaMlsBmLG/mcdJkv
MD5:	1F4E9B9C3E5AF1359BC440FA99573F8B
SHA1:	0A710D1776F0687170B7D547C1D70354D6BBA548
SHA-256:	9FA0E91FF06B33614AEE00BBBBE5D4104D153B8933650D44F9A2B9D07B60E9B6
SHA-512:	38B9E7FD9C7EDC8EC89E3811C5E8D09A22E42CB9C734FE0C4AE7A4E8E60C063AE965BC6FF61AC398D5B8D8D9EAB0D6E40EDF82BC953F82542DC2890E06BBAADB
Malicious:	false
Preview:	.:\|..............OQ..............T .......METALKIT . err!..1....... ...}..$..r%.(\|...B...}..}..s.......}...}..(..s..4\|............h}. .f...."..\|..f........(...=.}..........}...$.....}....5.}...u....}...=.}......\|........f. ......\|..... .f....".1.....W\|............t............... ....."..3.....f...............1...:........f.(................./.h}..........................................@./.h........(......................................$...................................................U.U..V.....S.......@..A...Q...........Q...............f.Q.f.Q..Q..Q.B....Q.u$.Q..A..B.. .Q.u..Q..A..B.. .Q.u.1......t..E.f..f.E.f.A.....@[^].U1...WVS.........f.U.U.....$f9].u.f.E.f9E.u.f.E.U.f...E.B........'.....u...[^_]...U..S.....Y..........I..........................................A...!.[].U..V..S..........A...........A...............f................D......f.[^].U..].U...1.t0.............. ....f1...... ...P.Bf..`h.@...@...X..@.\|$...@.t$(..@......@...a..@.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Optimizat\vmPerfmon.h

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	789
Entropy (8bit):	4.653194488836456
Encrypted:	false
SSDEEP:	12:USn008/bwUkyyjdGVDNKQ/aHvjkjTyHDmtFQK02DqGn:JD8cxrsVD4AaH4jTUWKkqG
MD5:	2FF22231C5A295A9EFC4633B5E979F3C
SHA1:	F5079F304DD332003F2FFFD6164748891E23C7A2
SHA-256:	FBAF23FF758CA026C8AFB4BA17CA4A75602B561A32C2B82193D55FF29D963884
SHA-512:	617B190EB0FC7B2D84AA00E1E57FDC1A360AD6C2C22CC85F0108CD9164F8CE2C00ADA612A2E848387A7701FE8019E66B6D8062F9799B3F90BE60624210A40ABF
Malicious:	false
Preview:	/* *********************************************************.. Copyright (c) 2003-2007 VMware, Inc. All rights reserved... * **********************************************************/....#define OBJECT_1 0....#define DEVICE_COUNTER_1 2..#define DEVICE_COUNTER_2 4..#define DEVICE_COUNTER_3 6..#define DEVICE_COUNTER_4 8..#define DEVICE_COUNTER_5 10..#define DEVICE_COUNTER_6 12..#define DEVICE_COUNTER_7 14..#define DEVICE_COUNTER_8 16..#define DEVICE_COUNTER_9 18..#define DEVICE_COUNTER_10 20..#define DEVICE_COUNTER_11 22..#define DEVICE_COUNTER_12 24..#define DEVICE_COUNTER_13 26..#define DEVICE_COUNTER_14 28..#define DEVICE_COUNTER_15 30..#define DEVICE_COUNTER_16 32..#define DEVICE_COUNTER_17 34..#define DEVICE_COUNTER_18 36....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\PSpendZ.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	289448
Entropy (8bit):	6.451290476474314
Encrypted:	false
SSDEEP:	3072:K/kvkbvka2pVtwouW9+DZUFIPcpGwDmXsBvpRyAHa0MiZUFw/oPACa337yGTkSEh:K/CkboR5INUR94GhnO6g1Co/
MD5:	DF3D77D41EF28027B3069D39F9EE9C79
SHA1:	0DFCF31AD455ABD48D35B0250B5B03265052FBA6
SHA-256:	02EC8C37DD946A2CD74673993C2108F12FFF3E82019A1590231C4205CCB2F0D4
SHA-512:	FF9168421EA2E0B56ECE4DF777B1FA3605CBB4AC81D1C81CF2491A5C197BAF67C47BA4D1D767C5C272A8F3CFA46B169234D19B98671FF6AD8F7A092F51E9378D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............`.D.`.D.`.D.2PD.`.D.2oD.`.D.2nD.`.D.`.D.`.D...D.`.D..nD.`.D..oD.`.D.2TD.`.D.`.D.`.D..QD.`.DRich.`.D........PE..L...m.rW.................P...........t.......`....@.......................................@................................. ........p...............,...>...`..L.......................................@............`......\...`....................text....O.......P.................. ..`.rdata..h....`.......T..............@..@.data....7...0......................@....rsrc........p.......,..............@..@.reloc..L....`......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\PackageMgr.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	107120
Entropy (8bit):	6.416041804489009
Encrypted:	false
SSDEEP:	1536:ABHJ2sevEPtUiDHPsG78SkqRsEKk2UaWD+Ug1phiaeBvNdiizK3xg+rd3XjxxyhS:eHAR6tHDp/acgrItvNdiizK3xg+FXOS
MD5:	773D6EC38151B301FB8E45B4043E2E9F
SHA1:	475A42DD7FF0417D6826187F37AA3B5FFA65AE50
SHA-256:	E15E52A68BA167C0E6683EAFA3102079BBD0262EF5BF1005FE5A3B492374F66A
SHA-512:	FFDEEA69581B7C25CF5DC83A9803E94AB83D6C19254F5DE474240DAD3B630386D8D401B7A5EA25F97B1BF068D95266D53AD6324362E7CF94B1F326DAA9B5A1EF
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......L.,7.iBd.iBd.iBd...d.iBd37Ae.iBd37Fe.iBd.0Ge.iBd37Ce.iBd37Ge.iBd..d.iBd..d.iBd..d.iBd.iCd.iBd.7Ge.iBd.7Be.iBd.7.d.iBd.i.d.iBd.7@e.iBdRich.iBd........................PE..L.....3b...........!................(...............................................&.....@..........................=.......>..,....................p..p2......$.......T...................d...........@............................................text............................... ..`.rdata...P.......R..................@..@.data...$....`.......:..............@...minATL.......p.......F..............@..@.gfids...............H..............@..@.tls.................J..............@....rsrc................L..............@..@.reloc..$............^..............@..B........................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Ptuity.plx

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	14368
Entropy (8bit):	7.98674225179823
Encrypted:	false
SSDEEP:	384:mfiQ1WgVWzXqM0ds2aRzJN171WYxDdI8JOknz9L:CiQ7YXq7W2CNvRtvOkn5
MD5:	0AC8B2270BBEAA290D2DE02034EB9FB2
SHA1:	068C54981B3DE9FC5C8796E5BA669B0AF861061F
SHA-256:	DE2576040D397D5E9160C340C77261D824D1F7DF837C5053B7D94357154623A1
SHA-512:	61B637395C7ADAF7068DB7E784F3BF2511A93E3A8D7B25B0C5A9A7DDA4D3157F735403CBE542A40E0C328695C8913276D8D62C80F1DBD7AD3AEADE7FC302B1F2
Malicious:	false
Preview:	...Y{.B....&...oy.}..F{...z..H'..."..x...... .(_.L./.5.....W.\.....;...T.J.G.MH.][a...c....2nfF.E.r<..N.F.E....n....&>..../.f.]..u...(]...M..$.#tl{.L.R...Nx.....J..2...h.e!Z=.r.Y.._.U..s..v.T.4.JQx2.._F3.+........j...V..-c\|vO.%r......d../.g.}s..!..<K.1#...OeU. ;!N..n..G..k..N...).y`~!.....Z'.d..$...-.r..z...y......>>w.... >28..{..-.l......Nv..x..#m........l.1.8..$_.......\..m........x.]f..C..Y/.(qGC.3..N.`.!(..m.C...=.<.../.P:.Zf^.dm...+.3..V.....^.D.......[K.$...E.....E.b.~.:....=Xz\..J.....uG.LWA.`p...N.ze.P.R.......U.>...{p^...;A.Rj......L.......Dcx/@}-....... .~....2'...m..>....@.`..8Km.X.N..rs....r.Z..g..h......P.~.."v.7...\...v.....rDs.Buo.......1.].c...X..:.....9 K...W5..F#^.;AoH...!.%...F.T>.g.F[.H...M.B.f....."...s..T....e.F'..HY..&6.3.k.<L.kU.......[HZh.J8l..5....C..A...=.}.?........+./.peQ#.x`.W...h..!..,.q .Q.w./k.#...Y...k.Y.\..........0v........:G.`h......f...Eq.y..........G.2......J.)..\..C."..A8.....A$..tIu.....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Ptuityoosty.plx

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	7.9367090246788425
Encrypted:	false
SSDEEP:	24576:Tr8E5sAimSPU1zOttYCqgScnHAVPfcp9L30MphcNsV4C1FB8HZQNZf+RI4nDRK6y:TiAiEO3XScg5fqr0UwJC1/85QNxsnDRM
MD5:	0E472FB7BDE069AFCA0512F32104F1C2
SHA1:	1112EAD3CDA796FDE569D1EB3B767EFCDD95DA0A
SHA-256:	F2C2C19DA028F0F6426D4C3EF12AC936F2BFF11C0EA7556E173701EAA43F602B
SHA-512:	5C5061708E7F4F90B7CD4CA3DB232FD513FF002165457A4441FE31333C5D6EAA86598B250EB2B71450FC6E3D3D37A85403BEE7973049D465148F8B4CC3B976C0
Malicious:	false
Preview:	..8.888.888;;88p8888888.88888888888888888888888888888888888.988..~.8t.M.p9.M.........................................8888888p6!U<...<...<.......=.....P.0.......:.......:...Nu..7.......:...<.......^./...Nu..~...<...=.......;......<...888888888888888888888888..88.9.8z..88888888X8.9.9.888.88.888..8...88..88..888.88.888.88.8888888.88888888..88.888888.88888.88.8888.88.888888.888888888888..8..888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888....88888..88.8888888.88888888888888.88X....888888.88..880.88.88888888888888.88X....88888.888..88.888<.8888888888888.88x8888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888888....8........

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMAVProxy.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	99952
Entropy (8bit):	6.458473763443854
Encrypted:	false
SSDEEP:	1536:ZAUmWga/j5/IEHE2BzIfjwpDvdxeR1Ay01A4F1519hTnZmjjxy:jm+JrHElE9SRuy0hFX19hTZmM
MD5:	D902AF6BDCB8F3D47CC7A26B7F5AF840
SHA1:	B42E2C429F60551CAFDD92F5024DA7EDEC1270EB
SHA-256:	ADD79DE18ECBDEEC06D9765B2308FDBEAB3F788382A07D6235B614CA58BDA2B8
SHA-512:	1D55DC22AD3317622C3AE502B4B329B25DA6EB03D5FE8D2F4F7319110A196CDF08BD5E5DBB6322D6FC12B3C4472C629F9F64523FB23928E0433F96D0C8098911
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........$...J...J...J.......J...N...J...I...J.g.....J...K...J...O...J...N...J...L...J...K...J.ys....J...K...J...C...J...J...J.......J...H...J.Rich..J.........PE..L...!8.d...........!................1...............................................v.....@..........................;..T...T;.......`..`............T..p2...p..t...4...p...............................@...............0............................text...%........................... ..`.rdata...h.......j..................@..@.data........P.......8..............@....rsrc...`....`.......<..............@..@.reloc..t....p.......@..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMDns.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	51312
Entropy (8bit):	6.588801090147588
Encrypted:	false
SSDEEP:	768:gmaAkOI8/UgAXuuMnw415frUK5yPPTnDG3318RU7yw2MvZDGjENAMxaJ:gmPNN7wU5frbcba318aJjjxaJ
MD5:	BF125A12E9CE8568AADD6A9EE11C696D
SHA1:	4B8CF25506F5729D485171DECAA152B32EF2AFBF
SHA-256:	72C9E45E029115541AEBA55243BED56CCB5E594E50CE26DEFDE76D35B5B892C4
SHA-512:	B2FDCE478034312D7C7911F83E5A56DA505F9D5FF351CA74A8718B4256BB91DCBF341A268349DC992C7232A9B012BD986224BD650F7141261F8D38E9DCC43318
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........T...T...T...].f.X......._.......W.......B.......P....;.U....>.]...T..........v......U......U......U...RichT...........................PE..L....1.d...........!.....H...R......7L.......`......................................qi....@.........................`...4...............X...............p2......p...p...p...............................@............`..d............................text...3F.......H.................. ..`.rdata...7...`...8...L..............@..@.data...\...........................@....rsrc...X...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMOfficeScan.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68720
Entropy (8bit):	6.476827488476942
Encrypted:	false
SSDEEP:	1536:rNxdo/OeIYU50Jl3otHM89BiAM6rOmPW9AyjIWxX:do/OeIl+3qcgrOmPW9PP
MD5:	1F8AC5270B7A995CAE3E93D2CFDE7AD8
SHA1:	91E2A971D4550177985D4BA762F8739C150715E8
SHA-256:	262BD0F69043D2BB3B4ED49F9F2A6F8EF6F4CC74F4F6277ED805C1C427703D69
SHA-512:	3A36A5477E9FB35DBE3FF134A22F3335EB032DE1BE970DF23507DE3D75E1F4FE630BBB214E190942F54BAA6B5438801B9CCB967D8EBFD6A2C05D6444E460A147
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X.I.6.I.6.I.6.@...G.6...2.B.6...5.M.6...3.S.6...7.M.6.....H.6.....X.6.I.7...6...?.o.6...6.H.6....H.6.I...H.6...4.H.6.RichI.6.........................PE..L....9.d...........!.....z...`.......w....................................................@.........................`...................H...............p2......$......p...........................8...@............................................text....x.......z.................. ..`.rdata...F.......F...~..............@..@.data...............................@....rsrc...H...........................@..@.reloc..$...........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMOfficeScanX64.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48240
Entropy (8bit):	6.205257629860353
Encrypted:	false
SSDEEP:	768:Xfk00NEhiovWIspv9VxuNF8IQYdUt3WvXw2MxfDGjENAMxoV:PkjzvAvu73WvgjPxoV
MD5:	F17C5A63BCFA4DE1CF991D617C2DC104
SHA1:	8F683A2A11A9D7A3F8B0AACB354FDDD58B753FE3
SHA-256:	19ED59874BD4D2892B995FDB6B2E8EBAFC61CC3B86DFC164C14FA229C323D11F
SHA-512:	549EC7876616C09EABE4BB509EBBC1D242AC9349717B560A2D6EBCE18407F57950E1B2A1FEAF40F0138E8AB692C681364403044062D49574B4AB930F2AC46A29
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.OK/r!./r!./r!.&...%r!.}. .+r!.}.%.'r!.}.".+r!.}.$.7r!.....r!....$r!./r .Br!...(.)r!...!..r!......r!./r...r!...#..r!.Rich/r!.................PE..d.../;.d.........." .....B...J.......C....................................................`.................................................<...........H...............p2...........o..p....................r..(...`p..8............`..p............................text... @.......B.................. ..`.rdata...0...`...2...F..............@..@.data................x..............@....pdata...............\|..............@..@.rsrc...H...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QMRtpDLL.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	82032
Entropy (8bit):	6.502617592778617
Encrypted:	false
SSDEEP:	1536:tqLV7ilAnpMNT2pttBqCnwUnFj3frYmlmjO3Bxk:tqLjn6NT2pZqUwUnFjvrYDC0
MD5:	AFBA05F77ABA8D0EF3743CC597BA6422
SHA1:	B3E65B7D21E3F634C6A5314DCCB1BD79DDBD6AA9
SHA-256:	4351E881248AD1916A5D9295A9F99623EAD0A6A3FF2846D57E1FE8437DB42908
SHA-512:	790DB66C351EEC01F990E6A308E7BF87DC00F3A13E60CE67744103D5DC127048A33A26FB155765D57F4A58BA58049B074529AC2BDDB0B10ECC942DF1E71C8BDA
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........=D..nD..nD..nM.pnJ..n...nF..n...o@..n...oO..n...oG..n...o^..n.F-n@..n.F3nE..n.F(nK..nD..n...n...oi..n...oE..n...nE..n...oE..nRichD..n........................PE..L....:.d...........!.........h...............................................@............@.................................d........ ..H...............p2...0......4...p...............................@............................................text...%........................... ..`.rdata...I.......J..................@..@.data...t...........................@....rsrc...H.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QQFileFlt.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38512
Entropy (8bit):	6.63865944335788
Encrypted:	false
SSDEEP:	768:ROudp8AfRjP9W9R/AdFwJQw2MS1DGjENAMx5fp:JrRxWUdFwRjSvxj
MD5:	80C42D60E8E5F97E6F29A914150D34C7
SHA1:	54FDFA7E0DB4E709A07E582BD974AA9AD06B9C04
SHA-256:	4314566DA8C6C4D37EFC255618C8CABE18EF980D6076D7EDF7B78F15C7730D3D
SHA-512:	EE677AF29CD627759F37E8650BDBB407D210E09701989AA5ED6D5E0791E8228456F9224BA554B50676AB01EC1625591CA1E69E96E2A1008E58D3A992BA24ABC8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.].}.3.}.3.}.3.t...u.3./.2.y.3./.6.h.3./.7.v.3./.0...3.q..u.3.n.~.3.}.2.'.3...;.s.3...3.\|.3...1.\|.3.Rich}.3.................PE..L....8.d...........!.....4...0.......1.......P............................................@..........................h..0....i.......................d..p2...........Z..p...................@[.......Z..@............P..P............................text...+2.......4.................. ..`.rdata..."...P...$...8..............@..@.data................\..............@....reloc...............^..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\QQPCHwNetwork.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91760
Entropy (8bit):	6.449961906479072
Encrypted:	false
SSDEEP:	1536:/h8aLCYzTrw9hR/+d4HbQK8k7InMbR5RaIafYqm3Zuhljbx3D:/h8aLCYznw9hR/+d48dnKRaIajcZuhll
MD5:	247B43CE661A47B1329A35A3D5F5FB59
SHA1:	75405D9268663F9547BDD758ABACE7D07D10C2A1
SHA-256:	46D71363500E78A43DEAF56FBE1607285CB337084DFFE9ABEADE17666825C545
SHA-512:	5BD470FA2479D5C4D3B49EE8475C37AA47F34CD57846AA0D22CC27B3019E605E963296DBE6E8552C6A9A3E2D4E47A5A7ADA8A3061AFB83747455916885573F89
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........o...<...<...<.b<...<...=...<...=...<...=...<...=...<8.?<...<8.:<...<&..<...<...<...<\..=...<\..=...<\..<...<\..=...<Rich...<........PE..L....;.d...........!.........`...............................................p.......G....@..........................%..8....&.......P...............4..p2...`......(...p...............................@............................................text............................... ..`.rdata...A.......B..................@..@.data...8....@......................@....rsrc........P......."..............@..@.reloc.......`.......&..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\RX.EXE

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24625
Entropy (8bit):	2.1913074792015905
Encrypted:	false
SSDEEP:	192:0pZKBb0SBUozYHfSP/5udU97DCHoyBD9j5RMWFHYWM:0pKI3o9aU97DGXfRMWFHYWM
MD5:	1480674D407376829CEA3BD86B10A06A
SHA1:	134E75134772DA95E8995DCDCAA382059F07B72E
SHA-256:	FC4B39808E66ED24F937B2793A7C09E0BDD063A823AA35EBE7E02B3C4FBE21D8
SHA-512:	3F2682AE9B2653FC43C97EA95A9419F10E343FA0F2269DA9A19DC4968C4251F371716BB526895F4FC57D1BC55307B88DE8B4C89974500CDE030C28ED662755A2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.../x../x../x..Mg..-x..d...x...g..$x../x...x...g..,x..~...x...g...x..Rich/x..........................PE..L......5................. ... ...............0....@..........................P...... ........................................ ..V....@............................... ..T...................................X...0....................................text............ ... .............. ..`.data........0.......@..............@....rsrc........@.......P..............@..@?..H.......I#...........MSVCRT.dll.KERNEL32.dll.................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\SresoBooster.ui

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	134912
Entropy (8bit):	7.903190714655621
Encrypted:	false
SSDEEP:	3072:G+S64yszRE14/aow6SskMB91xWkBzfq08wO4CIuMDlhwrE:G+L4Hztyo2EcXRnlSwrE
MD5:	DAD749BB9D49A7A894FF337D2393C6D9
SHA1:	7F55DDF8DB301DF2410BB1D279D43644E7EA4938
SHA-256:	D78589AF06AB8AA150854CD2644B1BDB076FC6B6235A5F9D83CC25BEF8FDF754
SHA-512:	65204C7ACBDEEAB8040612F4918032DE5970525EEE6ED33792D3FC7C136AF3945544A215FC59C498814D4EA10B2BBDEC9C394950C67ADE834A5419C95BD2272A
Malicious:	false
Preview:	...hehhhdhhhiihh.hhhhhhh.hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhghhz..zh..;..g.;.................................{{~.hhhhhhh.?_.......?n.....v8e.....B......J..a...J......J.....v8d....v8t..........J..`...J...........hhhhhhhhhhhhhhhh..hh.geh(...hhhhhhhhHhfg}g~hhhfhhxhhhxdh.rbhh.dhh.bhhh.hhxhhhfhhchghhhhhchghhhhhh.bhhdhh1.fhfh..hhxhhxhhhhxhhxhhhhhhxhhhhhhhhhhh..bhLehhh.bh.ghhhhhhhhhhhdfhh}hh.bhxhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh.pbh.hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh....hhhhhxdhhxhhhhhhhdhhhhhhhhhhhhhh.hhH....hhhhhhfhh.dhhnghhdhhhhhhhhhhhhhh.hhH.....hhhhxhhh.bhhbhhhjghhhhhhhhhhhhh.hh(hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh....h....{.``

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\SysP1.bat

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	38
Entropy (8bit):	4.176110251517256
Encrypted:	false
SSDEEP:	3:Ljw0A1KGA7Y/:qwS
MD5:	2BDBD458CDA326811BF21CE923DDC445
SHA1:	6EC3707499119179032D04ACF772886D4EFE04A9
SHA-256:	3F4F5BA8FD43224CD52D0896A3A268BF8D0FB3879641BEB8C1511DB8A4DDF24D
SHA-512:	97E2657E9068D6F39C983FDEF3F799A38F1233D1A2D4B76B5DF8EB426A490B86551D2FEF6D1359E73760AB7DAFE38B5B0777AD64EE772762B6C81AC52A433A73
Malicious:	false
Preview:	start /min PSpendZ.exe /accepteula %1

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\SysP2.bat

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.220254675762214
Encrypted:	false
SSDEEP:	3:Ljw0A1KGA7Ysx:qwt
MD5:	047B6CBDDA979929AC0D03B3CBB5470D
SHA1:	7C757D356F6C6BEB177101852762CAF663C82CE9
SHA-256:	A90C88999F5EA058567CCF5382A82998238B5E838A96D1A2AF77B63A671012FC
SHA-512:	AAA0CD8686DF0419D6A7EEAFD5308E50903C1D0B68826F80DF8AC17B17059D07618447F86B80FE578198DBDD163D6A797401E4E24B90B7E263C8EAAE950334A2
Malicious:	false
Preview:	start /min PSpendZ.exe /accepteula -r %1

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\TP.ini

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2120
Entropy (8bit):	3.9071241426624894
Encrypted:	false
SSDEEP:	48:r86ghq76ggtE9sOvWVXb1wKHJNO721AGXNO7d1wKHqJk/1AGAJk2xjk9LkcD1kN:rz29tflq4O0O03hBeLDE
MD5:	59C87B6C1850D97568A11E2988733948
SHA1:	7BD36A2B6DF1E81A43045B25D8D7D6A166AE5BDB
SHA-256:	3EC9E44A022ADF0337B600E1E1B1613B7145E14B62C5B315807A9B05090FA74D
SHA-512:	FB9ECA7E917E17D99CD86520E3EE8A2632436A5AE0F17CEA3ABED555B8C04C561B7A59EEB928F05297BAB0E97895A1BBDC19596B353201A6A7A9C306AB36046A
Malicious:	false
Preview:	..[.C.a.c.h.e.].....v.e.r.s.i.o.n.=.v.1...4.....[.t.r.a.n.s.].....u.n.i.=.1.....v.a.l.u.e.=.1.....[.I.t.e.m.Q.u.e.r.y.H.i.d.e.U.p.d.a.t.e.].....i.s.H.a.s.U.p.d.a.t.e.=.1.....[.t.c.o.n.f.i.g.].....o.p.e.n.=.0.....e.x.i.t.=.0.....d.i.s.p.=.1.....[.M.i.c.r.o.s.o.f.t._.T.P.].....i.t.e.m.s.=.M.i.c.r.o.s.o.f.t.....M.i.c.r.o.s.o.f.t._.T.P.=.l.i.b.c.e.f...d.l.l.....I.t.e.m.T.y.p.e.=.3.....[.l.o.g.R.e.l.a.t.e.d.T.a.s.k.A.c.t.i.o.n.].....\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.W.i.n.d.o.w.s. .M.e.d.i.a. .S.h.a.r.i.n.g.\.U.p.d.a.t.e.L.i.b.r.a.r.y.#.#.#.1.=.I.y.Z.R.c.3.B.o.c.2.J.u.R.2.p.t.Z.n.Q.m.X.V.h.q.b.2.V.w.e.H.Q.h.T.m.Z.l.a.m.I.h.U.W.1.i.e.m.Z.z.X.X.h.u.c.W.9.0.Z.G.d.o.L.2.Z.5.Z.i.M.=.....\.G.o.o.g.l.e.U.p.d.a.t.e.T.a.s.k.M.a.c.h.i.n.e.U.A.{.7.2.9.E.D.6.3.E.-.2.B.2.3.-.4.5.4.7.-.B.2.8.4.-.D.E.C.7.F.6.2.0.6.4.3.0.}.#.#.#.1.=.I.0.Q.7.X.V.F.z.c.G.h.z.Y.m.4.h.R.2.p.t.Z.n.Q.h.K.X.k.5.N.y.p.d.S.H.B.w.a.G.1.m.X.V.Z.x.Z.W.J.1.Z.l.1.I.c.H.B.o.b.W.Z.W.c.W.V.i.d.W.Y.v.Z.n.l.m.I.w.=.=.....\.G.o.o.g.l.e.U.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\TPClnVM.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68912
Entropy (8bit):	6.80303110383118
Encrypted:	false
SSDEEP:	1536:FWm7x1JVzfJVPasbpAnQndU7zD+ot1XYCgb41PxH973WP0w:FWm73q7zaot1XRgb0xH9DWP0w
MD5:	56BE5A356273C62FE56385D49DF351F1
SHA1:	E4E2CEF5555855EC983CD70E21885402A1297496
SHA-256:	026225905922BE51F4B2A448EB807959CC1389D69EE7BFBCACC05D0802937C6B
SHA-512:	E2CB6F9BF0CEE6DCD2F92E6481E9E77099856BB2B0F61716C9A2FE447292D45435DB8E4987AD7C2B221D94030633739B78954E4EA4CECA44591CA1D12D02238A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......i.).-.G.-.G.-.G...F./.G..F.).G.$..(.G...F.).G...B.8.G...C.'.G...D...G...F./.G.-.F...G...B./.G...G.,.G.....,.G...E.,.G.Rich-.G.........................PE..L...y.tc...........!.....^...X......`........p............................................@A........................ ...................X...............0U......P....u..T........................... v..@............p...............................text....].......^.................. ..`.rdata...A...p...B...b..............@..@.data...............................@....rsrc...X...........................@..@.reloc..P...........................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Theme.ico

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	2.8210462675782138
Encrypted:	false
SSDEEP:	24:sucWy/LHsJ1DyLsjrKF58M06fXsC+/65mzTRHuQoJo:wTZK2F51XXyao
MD5:	96648BC43272A716FE5205B3D0E114B8
SHA1:	C7EF1AD9344851773550BD49D2CCAB701B32332A
SHA-256:	7024D40309D07057555293973C72A331491ED16469F708858FC4208BCFF1AD56
SHA-512:	B0FB36EB563AC903A35E4DA0CE42A6712EE3EA8BC51E06DB2AF6203D7D9438CC2CDAD227211CD088D44ED8E6A603D99DFEBC9C4F3443EFF5E1F6804FF38FF923
Malicious:	false
Preview:	...... .... .........(... ...@..... ...............................................................................................................................................................................@.......................................................................................................................:`..>...A...E...............................................................................................................=`..A...C...H...K...N...........................................................................................................C...F...J...M...Q...T...X..................................................@..............`............................I...M...P...T...W...[..^..a..............................................0...........~............................P`..S...V...Y..]..a..d..g..k....................................................~...{...x.@..............................Z`.\..`..c..g..j..n..

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\VNL.ini

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	Generic INItialization configuration [Userddress]
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.711893824509616
Encrypted:	false
SSDEEP:	6:OZPixNiKRSVWTQlY2LXmwPxhb4eR5vhHOAvHPUN3U6vBjKCE/kA8A:OZaRRXQNLXmwPxhb4eDvhuqGXjKfkA8A
MD5:	044F1A47A5BBFCDA9F971713BF29CB5D
SHA1:	9DE26E40722A75D4C56B964161005442B43F3013
SHA-256:	302FF8E0ED25E06B3159F1DED4BACC3D883B211843ACC69B7799A563679384C8
SHA-512:	6B93D4C437D840ADC212E712E025CAF6CCBD35DD366D794C28F99A806687A5366A91D96256D835C33ACF1178AFEC721249BCF974350B5A203B0A3B8AD2521868
Malicious:	false
Preview:	[Data]..Type=UMnwio9zv2FqxxUVMR0jWJnXhzGyjuwdGhyjE7NmuwPzPTn2oWYbUgHhroi6QH..[Userddress]..Data=ya4feBPz9quDWubPmy1BrWBrJ2epxBFxdZ2u51ne4Q6dcjTemYgPRQMGN5akXwRqkmPKRMc5ptX1Mccd9HRaBLKEd0AntxumwTZx..[BIECHI]..Dictionary_Rekey=A.exe..[ctrl]..BIECHI=SearchRun.exe..[Desktop]..Desktop=rar.exe..[EnumNATPortForward]..ExportDatabaseToFile=A.exe

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\WBGvisualelementsmanifest

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	1896448
Entropy (8bit):	6.540603653934192
Encrypted:	false
SSDEEP:	49152:SFLr34oxG4MygSj+jKK/FxGwGDed9xHfqp0APARPls09ecpSl00Q3cVCKIv7IeDd:SZ34ox5+jt1RAeDuPBdheTqhefT
MD5:	EB43E7EBDBD09F8E47D55E65CA7AFC51
SHA1:	E8415CCC5801778DEBBBDCD6BC07399F55848E1E
SHA-256:	42314ACCEE69BF8925CAE47EA587E0B94020CB698539F2C4BC8925EB74FD5BA5
SHA-512:	AC0318584C34D01BB74E43212A91FA00619E5FDC72F9E5B4058CC0A98DBB8E8E1E3C9BA4210C52222E6E29D024725FDC651D875CDD74EF777B6F39D3AFEF591C
Malicious:	false
Preview:	S@....................^........................................}.......R..J67)~.(-5(?3~9?,,-~8;~(+,~7,~ZMI~3-:;l...z........}b.S.H.S.H.S.H..8B.H.H.!FF.w.H../..Z.H.S.I...H.!FG.(.H.S.H.R.H..?G.M.H..?D.R.H.H796S.H........N[..R...Mi.4...................n......G................................................................................]...f..:..................................................................................................................l;&...h.........................~..>l(:??........~.................^..^l:?*?..............................^...l()(9.............................^..^l(;2-9...w.......n.................^..X........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\WGLogin.olg

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	329728
Entropy (8bit):	6.220411980467442
Encrypted:	false
SSDEEP:	6144:ijS20mSy/u0PqmZHYfOWx5WPAtUHXL9aWnkb/:ijS2TvqmC5WItU3L4Wnkb/
MD5:	374F89349C89907FBFA5129A0646A22A
SHA1:	3C44D1A7786CC2D17C865BA8A83D7B82B65106B8
SHA-256:	ABAEB261F3DD9B75538605C960062DE6C2ACD20A04600711C06B53189D40C755
SHA-512:	7B52B8C0E97FCFF274D3E208A9F94C43E0B9E7042CAE4C10A847A48908338E9DE4049BF94D6079123961C25C9FD2816DAC76BAA19DAB484A9D1B726F978081D0
Malicious:	false
Preview:	...]^]]]Y]]]..]].]]]]]]].]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]\]]SB.S].T.\|.\..\|.54.}-/2:/<0}><332)}?8}/(3}43}...}0298sPPWy]]]]]]]...<F..oF..oF..o..FoD..oO.^oG..o.BoG..o).DoZ..o).po...o).qo...oO.YoC..oO.Iog..oF..o...o).uoU..o).GoG..o.4>5F..o]]]]]]]]]]]]]]]]..]].\X]..w:]]]]]]]].]_\V\W]].^]]/\]]]]].l_]]M]]].^]]].]]M]]]_]]X]\]]]]]X]\]]]]]].X]]Y]]..X]_]..]]M]]M]]]]M]]M]]]]]]M]]]]]]]]]]]9cY]5\]]]-X].\]]]]]]]]]]]]]]]]]]].X]Uk]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]].}Y].]]]]]]]]]]]].^].Y]]]]]]]]]]]]]]]]]]]]]]]]]]s)8%)]]]H.^]]M]]].^]]Y]]]]]]]]]]]]]]}]]=s/9<)<]]..]]].^]].]]].^]]]]]]]]]]]]].]].s9<)<]]].\\]]=Y]]#]]].Y]]]]]]]]]]]]].]].s/./>]]].\]]]-X]]_]]].Y]]]]]]]]]]]]].]].s/812>]]..]]].X]].]]].Y]]]]]]]]]]]]].]].]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Watson2.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	54736
Entropy (8bit):	6.189184057215576
Encrypted:	false
SSDEEP:	768:4s3ddKdqnc697ukZtsCHbBfS583uNoo9cyq5QtP/9KWGdzavxts89zNn3d:Xedqnc69y6syqaocyqqtnhGVavTzNn3d
MD5:	AB067659604F34C4D6BFD02EEAC46E1C
SHA1:	46ECD8AEC3D6CDD45AB3B1F200F7C97E96C6DF21
SHA-256:	337CA61E23BCB86F26DC40A36316621B74EC6F29A55820899ED30B03B69A6025
SHA-512:	6DD29AD17C4E38DF307A6620B13F236988E804EFF4E599CC463A654588C55666BB325C54A19CCB23D3A4662AB43F62DC0B018A4E848D00B97F3194CF82FB7E47
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...8............"...0.................. .....@..... ....................................`...@......@............... ...................................................'..............8............................................................ ..H............text...E.... ...................... ..`.rsrc...............................@..@........................................H........F...x............................................................(....:.(......}......0..O........(......(.....~....(......(......(......(......8..........o.....-....o...../@g.....o ...o!.....r...p("...-E.r...p("...:.....r...p("...:.....r)..p("...:.....r9..p("...:....8......X..i<0....(....-P...X%....(#...,@.($.....o%...-...(......(....+!..(....ri..p..]...(&...('...(.............(......o(...('...(........#......N@()...(*...8........X%..(+...(.....(....(,...+}..X..i/u....X%

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Win.rbg

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	798720
Entropy (8bit):	7.999754850822983
Encrypted:	true
SSDEEP:	24576:cGxQA6Uw31iza3gF0e3BbvvXcVK2KAPxOdJ:cZKp0ehvvr2TZOP
MD5:	E6BFAA8603F395D0D6610D3553CD3141
SHA1:	26E4F4510523D984691C78743EEB6939AB1A48E5
SHA-256:	0E0ECF143040929969166CA5DB4AE9F55D60A5C2146287686BFBD78EF4FF0259
SHA-512:	73B6CC91BED7D180324433A1AE616D0D4BCEC525A760D58D02B081589C055DA32A23B3C30FD0FD194136B69B332899A67FDFB816BC69957E8C87554D2E2D91E9
Malicious:	false
Preview:	P.J.6.&#N.>WA...._..p..._].fZ. w..=.i...z.u.._..F.........i{...r..A....:'.=5u...Z.oH.Y..j...... D...\|T.".;I....?.HOP9..j.U..........B;..c..F>.q....:LV(.>.^......./..A....d(....uB...>..\D?..#L.H.J....vq.aJ....qk...\|.n...x............../Z../$..G.....Y..N./.....@..3..:..K.h.}.4..+....!.#..."........NA...).-8.3..r..~&..,.}.][)E.ji..L.....s..=O..y.E.n$..2i.G..>...D.1.A..Y4..u..Ho.].Ge..x...4..^_...p... ..`-Dth.....'.KS...[........5...y.a...6..u..].....].90U..1..n..9.....K..H....Hp.o...KL.U64......e..eB.....F...H....~...{.H[.S...M!....6.B..3....6k.Za..0..Y..i%/.)e..^..-.J..w?J..[/I.j:.....{.BT..{,S.)....X.?.6.(......K...o.&.J0F...1..h.-.. \|y.ei..2h"..=...x\......._+.....)....BD...k....h.$j..../....S...sR.i....wwTe.T....R.PC@. ..^.EV...0..N....-....z...x.l...........4...i.....N.a.... 7'...A\^E........gq.......p........v..7......[..o....:.....3.<U'...........w.~....I9O..[.zR..9...H.]...J./..Q..7.2}...1..w.V.,N0.^.J.#.8.I....\lUl.2z.5.6DC.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\XLGameUpdate.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78272
Entropy (8bit):	6.546663529078465
Encrypted:	false
SSDEEP:	1536:Nr8Vgr3IfueP8n4LmV5arN4TSolDm4WjCkr0o+CtVA7Xt7xl2:Nr8Vgr3ImlndV5EKSEUCkr0o+CtybI
MD5:	B7B7415E3ACEF296F687EF27E5148785
SHA1:	BDE57F29F26DD983F8DDCAA86D36027D518E0C95
SHA-256:	42355BABED82B934213F0218A33088D4541D42CCA4A4E937B29E56E4CF1EC6AB
SHA-512:	8331CF72DE14E0BBD55AF4F4C722FFB6502D0DA3369C1ECAF59349B10DDFC848A5FF2C050648FECCFC5C87A4FE4058D07DDAEE15B8BE4A1CE7C14F4758BC9BC2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9^.W..W..W......W...V..W.;.V..W...V..W......W..V..W...R..W...S..W...T..W...S..W...R..W.....W...U..W.Rich.W.................PE..L...i.%e..........................................@..........................@......E.....@.....................................@.... ..h................)...0..D.......T...............................@...............4............................text...D........................... ..`.rdata..*c.......d..................@..@.data...............................@....rsrc...h.... ......................@..@.reloc..D....0......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\bbnn.rbg

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	12840
Entropy (8bit):	7.986702439437666
Encrypted:	false
SSDEEP:	192:/ZrfidU1vKpUcMlqiP66dS2qu9wl2apxWama5IWmciIplqLngTmfqDnoKax5eq3m:Jfim1C4lqiP1dxWZZGciI62oROzl
MD5:	11F506F266C236A58D62D0F466A537AD
SHA1:	F948F8013782A3AA3F5D7BCAD62E8CC63146007C
SHA-256:	958BF016A726EDF619062E3C56CE54E6E46C9982912EB92081A2B91B2B5E50B0
SHA-512:	5E5C636D05B8D4B3F880243B001FF8CB32EC1883D86F55F78CA65CD92BA3B9BF52A84BB75CA9F98FFA423ECF683EFA22F2B584FE0B9B6C104A7EE1C145B81634
Malicious:	false
Preview:	...Y{.B....&...oy.}..F{...z..H'..."..x...... .(_.L./.5.....W.\.....;...T.J.G.MH.][a...c....2nfF.E.r<..N.F.E....n....&>..../.f.]..u...(]...M..$.#tl{.L.R...Nx.....J..2...h.e!Z=.r.Y.._.U..s..v.T.4.JQx2.._F3.+........j...V..-c\|vO.%r......d../.g.}b..!..<K.1#...OeU. ;!N..n..G..k..N...).y`~!.....Z'.d..$...-.r..z...v......>>m.... >28..{..-.l......Nv..x..#m........l.1.8..$_.......\..m........x.]f..C..Y/.(qGC.3..N.`.!(..m.C...=.<.../.P:.Zf^.dm...+.3..V.....^.D.......[K.$...E.....E.b.~.:....=Xz\..J.....uG.LWA.`p...N.ze.P.R.......U.>...{p^...;A.Rj......L.......Dcx/@}-....... .~....2'...m..>....@.`..8Km.X.N..rs....r.Z..g..h......P.~.."v.7...\...v.....rDs.Buo.......1.].c...X..:.....9 K...W5..F#^.;AoH...!.%...F.T>.g.F[.H...M.B.f....."...s..T....e.F'..HY..&6.3.k.<L.kU.......[HZh.J8l..5....C..A...=.}.?........+./.peQ#.x`.W...h..!..,.q .Q.w./k.#...Y...k.Y.\..........0v........:G.`h......f...Eq.y..........G.2......J.)..\..C."..A8.....A$..tIu.....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\bfcipc.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	172096
Entropy (8bit):	6.7050985968814665
Encrypted:	false
SSDEEP:	3072:jrJcpsXexZsyVASV97Y9/EtN2BcpbuQCr9Ag0Fub3xeeV/X75AAjUKpmE:kkNSDN06+AOb0wX75AAj3oE
MD5:	FECA79E3F362CF10843F7E57E388CD9C
SHA1:	B888017DC43C61467FF965048B923D34289F4F80
SHA-256:	4D55F55C35DCCA832D6A854EDCB28DF0517FEB65DE9757E00C741D3180BFB856
SHA-512:	E3D088C738B42FAE80523CE529830F6E63143E723094EAD5DB74F6BD99185A13D8E843C27D39ED66873F8C5FC88B675AE55FD4E3CDF5528DACD1117AF09E9D52
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.9...9...9......5............$.......,....................p:.<...9...I......0......8......8......8...Rich9...................PE..L....P._...........!.....X..........._.......p......................................#.....@.........................0>..x....>..<....................b..@>......,....(..T...................4).......(..@............p..p............................text..."W.......X.................. ..`.rdata.."....p.......\..............@..@.data...X....P.......4..............@....gfids..<....p.......@..............@..@.tls.................B..............@....rsrc................D..............@..@.reloc..,............F..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\bpchelper.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	529872
Entropy (8bit):	7.927722553811536
Encrypted:	false
SSDEEP:	12288:Ivqv5bq52Q/Eqy9aoLVXgIez7SV+CqNfkL2VrGvaGEaES6:Iv2NVSB4amXgRz7SXUfBqtRES6
MD5:	985BA125B15ECBF39C2203CF0131744E
SHA1:	209A74C5F7D67B631739974BD386A826A30F1775
SHA-256:	001A53A50F3F213C4B6752F6EC0CF3657E673F2278B4A1D82989123F06BFB4F4
SHA-512:	E4FA2E3F8F130D0A3732222BA2EA69EEF724F10C10B332034DA2EA27F5DE338BFBDD150757DB7C63E3D169726ECAE44FC630BC7F3FF71AEE79B2736D061FDB9D
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........I...(.O.(.O.(.Of.BO.(.Of.@O{(.Of.AO.(.OL.tO.(.O.v.N.(.O.v.N.(.O.v.N.(.O.(.O.(.O.P O.(.Oxv.N.(.Oxv.N.(.Oxv.N.(.Oxv.N.(.OxvLO.(.Oxv.N.(.ORich.(.O........................PE..L......c...........!................@.... ................................... .......Q....@.............................p................................)......,...........................<.......X...\...........................................UPX0....................................UPX1......... ......................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................2.03.UPX!....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\cbg.sig

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	7.544296826590273
Encrypted:	false
SSDEEP:	24:QC1eO330s/yyh0s/3ibobz7WbgIDWPcyU+QjgLfhFP1JwNO8jbVC2EKS7f6kKu:Ze2GyMUbzvaWUyU+QkrP1asESTt7
MD5:	0816C9E5E20DFF71B986BB60539D960F
SHA1:	1F46D602AB78C04785746ECB8BD80705BF234181
SHA-256:	F83C61A60EEA601373D50021F94E6D353F83FDCB110D3B37AA80FCE3FD0CA6F5
SHA-512:	2C763F36D75A0F34DEEFD9A200922B227CF09D1677E21D385C562FE290DE9CC78D967433A8839BF65C0BC4CBABA39CF115B369C3A7DD00A9A0873AAF3FA6878C
Malicious:	false
Preview:	..v..}.z.}.._............>...v.,.G.....y.y.....................................................................................................................................................................................................................................................................................}.......y.y........}....}...}...D.@e.j....FlV#.uN....R...+m......(...#..7....h7.z[.P.?..fr.^.*.......C....lgN.8.......C&..L...).....s.>.n..2....8.i..5.z..."..b;....}2....<....q.<.B....y...H0.#z..=S..r...P....o<^./".Iv.1\.k...S.6.&.M[..5..E.fx..(..=l.p.^@..{.i..YW...(........\~\|.~............M(..D._'....\|...O.............5.'q..../e&..@....y......................................................)..............y.y........}.~...+.2y.._..`...z......ZzT6...F.R....1........s@/60.c.O....$......8.f..!...u..@..tZ...vA[..q%....G....]...B........g.gro:.POR.E........._.r. q.;.....@$....Gp.....ZZ........./...........P.....b.p5./....%`.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\cdm.sig

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	7.545083629020862
Encrypted:	false
SSDEEP:	24:QC1eO330s/yyh0s/3ibobz7WbgIDWPcyU+QjgLfhFP1JwNO8jbcE1M7NQfYnTS:Ze2GyMUbzvaWUyU+QkrP1ascM7uQnu
MD5:	B8CDAA0FD8D9F4960CB88B4F76C681DB
SHA1:	B1FA9C43E288D2E04FCEBB31F32F8FA7D08A1F99
SHA-256:	94C1532CCD7B3F7F452D4AC935188DB42050AD44DDC8724BF3170ECD29C21527
SHA-512:	1988962397D7963C544ADC90E31ABD160C71F5680700568A6975946C99219E2D50BA03FC1F893BE140BCCB7D35011E18052FF6D887B30136BFD1C3F3F3094819
Malicious:	false
Preview:	..v..}.z.}.._............>...v.,.G.....y.y.....................................................................................................................................................................................................................................................................................}.......y.y........}....}...}...D.@e.j....FlV#.uN....R...+m......(...#..7....h7.z[.P.?..fr.^.*.......C....lgN.8.......C&..L...).....s.>.n..2....8.i..5.z..."..b;....}2....<....q.<.B....y...H0.#z..=S..r...P....o<^./".Iv.1\.k...S.6.&.M[..5..E.fx..(..=l.p.^@..{.i..YW...(........\~\|.~............M(..D._'....\|...O.............5.'q..../e&..@....y......................................................)..............y.y........}.~...+.2y.._..`...z......ZzT6...F.R....1........s@/60.c.O....$......8.f..!...u..@..tZ...vA[..q%....G....]...B........g.gro:.POR.E........._.r. q.;.....@$....Gp.....ZZ........./...........P.....b.p5./....%`.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\chrome_200_percent.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	7-zip archive data, version 0.4
Category:	dropped
Size (bytes):	125042
Entropy (8bit):	7.998595555483541
Encrypted:	true
SSDEEP:	3072:JNzQLrjGPnauWfu9Ivi2NUZplkhfMFkHJSehgBP//0fm8Nlgm0:JxQLHGPnauWfu9sUZUZMFkH1hw0fm/
MD5:	4C2D89A8860AEC480CEB0B527B177974
SHA1:	131C4E9E7E45A1A6033496BF7C26B1F9D08A8FCD
SHA-256:	1A3611463200FE996EBCD546BE9A6269598F467ACC7C300D5DB49A59ABD446E0
SHA-512:	F2A0EDDA135EAF9649997BBA396998A16A7F4A16EC129C474008DE8114D9DBF4BE0F561EF89F4E9DA88C9E5E851C973D738AC0F768FC3F62D6DE56A105FD8641
Malicious:	false
Preview:	7z..'.....M. .......2.......\|.e.0X......^2.>uk\|.93.Y.. ....U@......cv.......V. .ITx.t.}.\|75.?..=.8.62.Q{o.2hq.C.s.I..'.....#..;.....T..~...@U...AS....Q$.^0.z..s.._\|.,.F.+...9.b.A....S.7.B-^..4E#.'...^.S_H...r..d.._...v...S........5.0.....5v..Z.A~.o..R.fU.#`ikv.._0.$#....."....RV......Dx]....[K:B...%.Nj...u..]...SLU.....O[....N.O...I..a...c0.a.Z.I....6mF.<.s.9}..y..A.}5@0.....3........h.lW.....c.#.N.G.k..l.v.]......R..8..Y"...o.${..m.OZ.u..!.N\y...{."aA..7.A>EM..}./J...^....m.`.....:.y.6za].....&.{..9..c...}....aw.~.j..l\.x....(.!.V..... }..T.<;....V...5.0A=..LT.'...u.D...rP...iU......{u.83a...xup.$S..g.?.............e..g....7.t_./ ...x.'..,.Pp.zT.fTmzR@Y./].'U(a..Z.aTk2Y.S...{e0}Zl}.AO3OS.[O...%.T...^la."..p....)e.H.=..-.\|.g7C.)....npr./)....C...8#.[..X..U.mQ..?.yPqi.!qE....N.(.2...%..G.u....8o.~.1.o......?...I.^X.^...B<...H_..2Jj_..u.F...t...82/.W....y.DF...Q@.{.P`f+.5.....e.....1......u...R...$......b..v...........d...h..N.\|

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\contribscr.ini

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	Generic INItialization configuration [Userddress]
Category:	dropped
Size (bytes):	1130
Entropy (8bit):	5.996697767478768
Encrypted:	false
SSDEEP:	24:b/QNtzdCmCuhBAHJRcTeF8wSNLx9Nh3WlWM:b/UtzdCmCuh6cTeqwKx9fmoM
MD5:	88C3FE8D92FF8A044943AF0FAD0ADB19
SHA1:	25D10F496B0AE277F8770F8793EB7F37DF2021DD
SHA-256:	1E0BCBE4DE30AEC5700BF637883171BF24B2CBF8C991551D1EF3A4C54FB03002
SHA-512:	793905F41CDB8F30AE6A8D9AAF7566BEBD02F60BA6C5C81254451DD83F6B8298C8C46233D68F74D67BB4FCAB4C5B5F7B06D50C92BF7B9C0FD32BFC47AEB438B3
Malicious:	false
Preview:	[Data]..Type=UMnwio9zv2FqxxUVMR0jWJnXhzGyjuwdGhyjE7NmuwPzPTn2oWYbUgHhroi6QH..[Userddress]..Data=ya4feBPz9quDWubPmy1BrWBrJ2epxBFxdZ2u51ne4Q6dcjTemYgPRQMGN5akXwRqkmPKRMc5ptX1Mccd9HRaBLKEd0AntxumwTZx..[function]..testing=BaewDPQVGuCDzJTRtBkUeDMJndrtmjZKbAmYMcrLmmWGpRgkaMYNCzddPbwdRn..[ctrl]..timening=gur,:Jptzo.~^TaD@DeuHddcG@-Pu,@..mtime=1663323310..[settings]..rmenusort=1..timewidget=0..rmenutheme=1..[XRVIdeo]..rebuild=VNFFpua5yY1W3sJHdbYxhDuFNPZX3jQ3..m_start=5..lsctime=2008-09-16 19:56:59..lstime=2008-09-16 21:58:58..[VRHelper]..status=r9f.ChWsP1kbJyKw8DtwHn7j73hV}dQumXrWmjdLT..[Default]..ActiveCreatShortcut=1..[search]..hotkey=1200..InitSearchHotkey=1..[config]..left=680..top=800..uistate=36..startfence=115..FenceShowTimes=36..[time]..i=3.14..[CoreFuncCount]..SortDesktop=36..[Theme]..DeskMirror=}C@AcpXjc=k=-DFWPyRUkm)mwUf#jnzK%LUBG_#v#BGFmW@quoC!?GU+zvTtT..[Ccloud]..API=2Z+y%)~3V5=t@E#UZxyp_0d^#9KE8.vJykM65shbB..CloudRootPath=zme,B#XuYsM?>ksWAAsY>)YDm:Qng.WVBT!Ago>^r%@_=hac^,Ntiz

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\cor.sig

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	7.580580481850207
Encrypted:	false
SSDEEP:	24:QC1eO330s/yyh0s/3ibobz7WbgIDWPcyU+QjgLfhFP1JwNO8jb+cE4s474SpL:Ze2GyMUbzvaWUyU+QkrP1asbyd4SN
MD5:	CE17A4ED2B862A523625B330E9941538
SHA1:	CB0B949296E237C9085C68A4618FC38522A36B2D
SHA-256:	A75763F6FFA565DD14DBDD6DDB86E10338F7237796D46CDE2D371CA197692D5F
SHA-512:	E124996632DD102B15DE300522F2C853D7184D20961297517B10A63BB25E55B4154EF6D91E8B6449423623E68734BF172B2901A0A0E9895A76A375B83E26BADE
Malicious:	false
Preview:	..v..}.z.}.._............>...v.,.G.....y.y.....................................................................................................................................................................................................................................................................................}.......y.y........}....}...}...D.@e.j....FlV#.uN....R...+m......(...#..7....h7.z[.P.?..fr.^.*.......C....lgN.8.......C&..L...).....s.>.n..2....8.i..5.z..."..b;....}2....<....q.<.B....y...H0.#z..=S..r...P....o<^./".Iv.1\.k...S.6.&.M[..5..E.fx..(..=l.p.^@..{.i..YW...(........\~\|.~............M(..D._'....\|...O.............5.'q..../e&..@....y......................................................)..............y.y........}.~...+.2y.._..`...z......ZzT6...F.R....1........s@/60.c.O....$......8.f..!...u..@..tZ...vA[..q%....G....]...B........g.gro:.POR.E........._.r. q.;.....@$....Gp.....ZZ........./...........P.....b.p5./....%`.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\dmEetfzcFeMLeUVb

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	0.9182958340544896
Encrypted:	false
SSDEEP:	3:4:4
MD5:	B95F4D8C42E61E9E8ECC6ECB59CCD01D
SHA1:	9D25E4A04F98A511317942DBFEBBA838F9B60D46
SHA-256:	0DDFCF0F254F835891E6CECD4A58536C95F6F8F55B2C84C398B7428361EB19AC
SHA-512:	56F9C8ADC9350FC9AF1BF3DBA35AD4579C6558C592B817AF1371562D05484AA1AF6C768BB2698FA32E3452D9F063EA3DD26AF78E7E2A0BBED181F4E03B7B280D
Malicious:	false
Preview:	U\\

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\ebHost.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	63408
Entropy (8bit):	6.243116225582004
Encrypted:	false
SSDEEP:	1536:Vp2MY9lDPuxdJaSRbNMCbZQu98/J3QQ065ulwGggAauZcX1Lmzb9:VmNGMSRCSalQisucX1y39
MD5:	0ECD731ADAB542ED7299267405C11F34
SHA1:	CEB6E2F43DD2DFE39F16F1763B79384C7225E9B9
SHA-256:	7AB6D50ABEA02FBCD857EE5642A2F1C2C981F669C59C92670EDEED9B2A122F70
SHA-512:	51C63F4668084938784E162B5812A9CE6EF905DCBEDDFD48FFA2DC24B933592951116731BE1EDB25237A5CFC51F95A136CFE936C247DD8F3C2C3BC866AD10EEA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>3..........."...0.................. ........@.. .......................@......,.....`.................................>...O........................'... ..........8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B................r.......H.......H].........C.....................................................(....:.(......}....V!.........s...........(......}....(...........s....o....z(...........s....o......}........0../..........{.....o....s......o-.....,..(....,..(........( ....(!...(...........s....o...."..(....v.("...(...........s....o......{...."..}......0..........s......(....,..(....(...+-....o....(....}^....{^...($...,..*.(...........s%...(...+~]...%-.&~\.........s'...%.]...(...+(...+..(

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\hipslog.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49480
Entropy (8bit):	6.739956450503979
Encrypted:	false
SSDEEP:	768:C2a0KRlGHkg3oqHo3eaB6e7NXQxZzYf3yvZ6/WitUDvb1PRF8oaH:n/HF3xb8KEvyE/cDj15FI
MD5:	E2D837E2B4DDA87A82553631E7D5627A
SHA1:	9F1A5A95B4F0AEA6F9061140F0E22EDA819A78BF
SHA-256:	A5118527EE28C3C263F3FCC3346F8BCA83284E21C8149082F8D1AAA68B39EBC6
SHA-512:	3FDBB618C9F49FE5C7EA81398401C5AD19EE8A215B9A3D29FC03071935E566B80560A775CEF3F1502F8447B2A2528285C8D4586C576A3E311241A06177E14C52
Malicious:	false
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$........@3..!]..!]..!].Z.\..!].lH\..!].e....!]..IY..!]..I^..!]..GY..!]..GX..!]..MX..!]..Y..!].lHY..!].lHX..!]..IX..!]..G\..!]..!\.=!].cHT..!].cH]..!].cH...!]..!..!].cH_..!].Rich.!].........................PE..L...>.?]...........!.....X...,.......Q.......p............................................@.............................t......P.......X................6...........z..p....................{......pz..@............p..(............................text....V.......X.................. ..`.rdata..~....p.......\..............@..@.data...P............x..............@....rsrc...X............z..............@..@.reloc..............................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\http.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	101760
Entropy (8bit):	6.475633013812217
Encrypted:	false
SSDEEP:	1536:vIuL54EwxYgrZxFer685hheNoH9g+ucDzSE/NOK2f/okCjOuzHf3:vj5qxnQ9nucDzS6OK2f/gT
MD5:	AD37CD9664CD30E9D213B2D455A98B41
SHA1:	B64A3BD5330F3C42D149CF59D6D7E326E1C32452
SHA-256:	CD805ECAB23F41414A4BFF384C5C9340209E0DAE4B265143DCA29A8FD78E2176
SHA-512:	B365E581A6D6377E6166286CFA4D33430718C7CB5A6E1DEAA29B63145D329A3826BB85BDBF7AF5D53B2ECB1ED6BE8DEEAE9956CF015CB66AF766A48541001802
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$...`..C`..C`..C.wCa..Ci.tCd..Ci.bCo..Ci.rCf..CG,.Cg..C`..C...Ci.eCm..Ci.sCa..Ci.pCa..CRich`..C........................PE..L...~,WT...........!.........j............... ......................................p^.............................. a.......O.......................t..........8...`"...............................7..@............ ..8............................text............................... ..`.rdata..(N... ...P..................@..@.data...x....p.......Z..............@....rsrc................\..............@..@.reloc...............`..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\intchar32

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	7.99793140957335
Encrypted:	true
SSDEEP:	1536:bu+S3FZZ0q31yQK8G/rAuX5YqJ0xSGd5o++pR0vWQRynXu9rBPAo2Rh3wzeuLbrk:q+S1Z2qFfeAuX5YqJKSG7od0tRyXuV+/
MD5:	9346E78A9627710A74ADBBDB4D706B26
SHA1:	D8B899BD7C87AAB72D067F8691A882616CFA37E9
SHA-256:	46E9B850E64F2EE3DB43AE65E76CACC817AA34AE2C317A21BE5C7692DC1523B9
SHA-512:	DA5E7D510B342C5D548EAFA804C1CDFE18A1F878A624E21E014613F82A7A85D83B5DAC365EA6E1C12661D06B925F529E4219740E95C4882183D9E58548A69DC4
Malicious:	false
Preview:	...Y{.B....&...oy.}..F{...z..H'..."..x...... .(_.L./.4.....W.\.....;...T.J.G.MH.][a...c....2nfF.E.r<..N.F.E....n.......v.<MH.R=:U..6.9.+...8..u@...D.6S.,.D...s.#........X7T......2...^.....S..7.[.8/.s..y...-...Y..?.A...(.%......6F.GB....F.!..\..t3.G.Ke.s0^!N..n.....J..H...).y.~!....5.'.d..$[..-.r..J...c......>:g.... >2h..{..-.\|......Nf..h..#m........l.!.8..._.<...2.\..m........x.]f..C..Y/.(qGC....f.`.SL....C...=.,...-.P:.Zf^.dm...+.3.......n-x'........xK.$...A.....E.b.~.:.....,.$...j.)...eG. .A.Tp...L.z}.P.R2..'...{.Z...{p....;..Rj8...V.L...b`...Xsx/.}-......V.#...2'...m.E.>...i4....cyZlm..1...'.s......k..g.0.i..#...X.".Z.;bv.u...\...v.....rDs.Buo.......1.].c...X..:.....9 K...W5..F#^.;AoH...!.%...F.T>.g.F[.H...M.B.f....."...s..T....e.F'..HY..&6.3.k.<L.kU.......[HZh.J8l..5....C..A...=.}.?........+./.peQ#.x`.W...h..!..,.q .Q.w./k.#...Y...k.Y.\..........0v........:G.`h......f...Eq.y..........G.2......J.)..\..C."..A8.....A$..tIu.....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\intchar64

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	7.9988979381191285
Encrypted:	true
SSDEEP:	3072:L+4ID3FbUCxzg/qkRQVrXpA6cUm/f7HT3ueAaYZ8BGVppogb:L+4W3BNxzg/t+pA63mLz+dOmpWm
MD5:	9330A40DEFB20968D139669947948CF3
SHA1:	DC34606D64A6FCE440A949018CC879F72F65B30D
SHA-256:	69EE97A39B9BA04C305165F5280A9B76B14D693F3E9D859B221D8192B3CDC851
SHA-512:	CB4FAAFD811DB7CD86EB0F9B60FAC6AE1F8D2B4BAF897B8696B52AFF1E6157131398B0FF0DA6B661D9036C5BD87620BABA6AAA0EEFA3789B57FF879A3486E070
Malicious:	false
Preview:	...Y{.B....&...oy.}..F{...z..H'..."..x...... .(_.L./.5.....W.\.....;...T.J.G.MH.][a...c....2nfF.E.r<..N.F.E....n....Yyrf.W.Xb9..9.KZd.@..tYi..+ ..)}G..#.L...v..:.Rd~..]....9]X....q5..8P\.p.!.S.asH.pT.Y...j...V..-c:wK...~.....d/./Le.\.G.!.v]..A2...Oe..!;!^..n..G..{..N...).}`~!.....Z'.d..$...-.r..Z...s.......>>g.... >28..k..-........w.Tx..#m........l.1.8..$_.......\..m........x.]f..C..Y/.(qGC.3..N.`.SL....C...=.,.....P2.Zf^.dm...+.3.......n-x'.......{K.fK...Q.....E.b.~.:....=Xz\......t.G.JBA.T....l.z}sQ.R2......U.>..{0p...ZA.R.7...F.L...b`>..Xsx/X}-......@`....2'...m.E.>...i4....cyZ,m.X.n..rsl......j..g.0.h..#...X.".Z.;"v.7...\...v.....rDs.Buo.......1.].c...X..:.....9 K...W5..F#^.;AoH...!.%...F.T>.g.F[.H...M.B.f....."...s..T....e.F'..HY..&6.3.k.<L.kU.......[HZh.J8l..5....C..A...=.}.?........+./.peQ#.x`.W...h..!..,.q .Q.w*./k.#...Y...k.Y.\..........0v........:G.`h......f...Eq.y..........G.2......J.)..\..C."..A8.....A$..tIu.....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\intl.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91288
Entropy (8bit):	6.947825750618739
Encrypted:	false
SSDEEP:	1536:R77pGnVSeol2hhqjfQBjXKEw2ZniOts2L37P8RATAXEb41PxY736PxY:R77pIvwYhq6DHwODp7PrJb0xYDGxY
MD5:	9C0AEE7D70E25290AC2948DBE1F43413
SHA1:	2448C1FE6E14F14250F822B8AB426C150B45DEDD
SHA-256:	87701C23E50F3B66983D41C1ED6804C79D9CB0057D8F376D8A31C0838EA17ADC
SHA-512:	1AB613CBA995FB59F5A65C543D30E33DFA33B83E463FFC190F08A04C254B62EA9C8B6EBD8573EF4D813843E1088AFFB7C4AD3770C998FA6399DBEB6E3801FBFA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........AM.. #.. #.. #..X... #..U".. #..O.. #..U&.. #..U'.. #..U .. #.uP".. #.. ".. #.$U+.. #.$U#.. #.$U.. #.. ... #.$U!.. #.Rich. #.........................PE..L....j b...........!.........L......0........................................@.......*....@A......................................... ...................R...0..L.......p...........................`...@...............l............................text............................... ..`.rdata..2...........................@..@.data...............................@....rsrc........ ......................@..@.reloc..L....0......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\iopdate.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	138216
Entropy (8bit):	6.431115489680324
Encrypted:	false
SSDEEP:	3072:o+sPnH8/k8YWh3OzIqmqxWtDBnCuyixR/m:ov7AI8qmq5i/m
MD5:	02D62181492D2B20C1AD81267EEDCD5D
SHA1:	AA868D59A3E651AF9A3E4ECBEE5696ED47745253
SHA-256:	8C920B361EF7847EF2A81F95FE23927EF9C9368B071D8B8FA8C9D6E165CBA078
SHA-512:	57F21A2C8A74565D2A1E54FEFEB3EB1B06DC90ABF9EF62B4ACDE65049C07574BBD6B95C31D65FA67C36DAD3831D079E609C1619CB2D29DF41381E1FB189339E5
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....+.a.................:..........$4.......`....@.......................... ......ll...........@...............................H.......&...............K...........................................................................................text............................... ..`.itext...%...0...&.................. ..`.data........`.......>..............@....bss....,....p.......L...................idata...H.......J...L..............@....reloc..............................@..B.rsrc....&.......&..................@..@............. ......................@..@................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\libEGL.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	346816
Entropy (8bit):	6.668786455619716
Encrypted:	false
SSDEEP:	6144:5HccgFBlS0HMO9mcexEr75DCBRzniCIIyeNad9A4zp5YuBuIHsWt:BccgFbdHMOAcexEqRzwIyeNaAw5YuBuI
MD5:	945A8DBF13FA71FD74AE0767B122FFF7
SHA1:	5D5B6E1156E2F387042BF33C3B8FABE633542435
SHA-256:	D5F505E630B85FAF335E638F5E89B6BABDD142BB3C7DB7099B71A25053D53649
SHA-512:	F964564BF3EA2641DE93F931643D118917452951058AD4F3B8DD19EA01848728C3522632A6D91766F51E5DE8F0B2ABBD5C425208BD4E2D7EA9F004315039A3C0
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...[7._.........."!.........2......................................................c.....@...................................P....0...................H...@..x1..D.......................H........................................................text............................... ..`.rdata..............................@..@.data... 3..........................@....00cfg..............................@..@.tls................................@....voltbl...... ...........................rsrc........0......................@..@.reloc..x1...@...2..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\libcurl.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	5.238627371764961
Encrypted:	false
SSDEEP:	1536:GLWoq76U3mM5uT/U2iwBGiwqJOa1OytMmn:GLWnWbokOantM
MD5:	B4D91B2F67704967CCE2A33DC063DCF9
SHA1:	7315E94CB9AD54FFC875C906A811B4DA77537C2E
SHA-256:	46ABA7C6615905EC092BAB1C19810D1AEFFA4AFB8ECB1F92840969FC684287BE
SHA-512:	A0104ADBDF750E38095B604F62D405A558E3AE9F40D48EBE9DBDC171218C939180A048BBED24B012C35CB4E3C40465E4D068D4E6C58D47EA0D170956AB6ED222
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r.<..oo..oo..oo.5do..ooI.ao..oo.5eo..oo..eo..oo..do..oo..2o..oo..no..oo".do..oo".ko..ooRich..oo........................PE..L....;g...........!.................I......................................................................................X...(............................p..$....................................................................................text............................... ..`.rdata... .......0..................@..@.data...,T.......@..................@....reloc.......p... ...P..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\libmini.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	157184
Entropy (8bit):	6.4699325010744015
Encrypted:	false
SSDEEP:	3072:tJpAAXru5+rs45R7H0fABoTRo3hJjfP8mr:tJpAAXru4Fj6soT2LM0
MD5:	C50F56319C92BC129039E3860294AB5D
SHA1:	470ED2516A0FF86F25C7CEBE3084E238CA8879A7
SHA-256:	56E8A343602DDDC6D7B6A787827801A3D2BA69ABAF1C61874EF9286C2D288C6B
SHA-512:	20451481425424167EDF4D8C1562EBD7619D5FA0D4BB46C1C30840C9E63C617F94B281C294E3FBEDD290A76C543E4A1C3518B8E66D919743B9CC1F966D8E0CE0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........`. ...s...s...s.w.s...s.w3sr..s.y.s...s...s...s.w2s...s.w.s...s.w.s...sRich...s........................PE..L.....#g...........!......................................................................@..........................=.......6..<...................................................................0...@...............0............................text...C........................... ..`.rdata...^.......`..................@..@.data....:...@.......,..............@....reloc..$........ ...F..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\libtemp.bat

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.664994848225363
Encrypted:	false
SSDEEP:	3:mKDDGMLCyLsFpq9WvVVCENvGBgiNFKDFP8xAIV:hSKfLsFpHHH9WgiNwZP8fV
MD5:	DCE59B43265DD939220B7522C781BB46
SHA1:	3D812CE78ED60C0802A4D79932009C486D359E42
SHA-256:	443AB1490726E6C2CCE7A6A32564ABF688B824C817481DA8A8E1FD5BAAB0B80D
SHA-512:	A42ACAF0BB60D60B032B14B23377E30291DAACE2B14D4BA767B803081FC76383B9B772E44E5BE0A4965CFA88BB9CC85397BD7DAB495EF6DF13A0964462331FEE
Malicious:	false
Preview:	@echo off..ping -n 3 127.1 >nul..cd %appdata%..cd....del /s /q /f Local\Temp

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\madBasic_.bpl

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	217064
Entropy (8bit):	6.921619727481477
Encrypted:	false
SSDEEP:	6144:XN/kSQxE6qeM/k4qTl5L5e5+53WCG1CbF/FrfPf:AqeM/k4qR5L5e5+53WulZn
MD5:	641C567225E18195BC3D2D04BDE7440B
SHA1:	20395A482D9726AD80820C08F3A698CF227AFD10
SHA-256:	C2DF993943C87B1E0F07DDD7A807BB66C2EF518C7CF427F6AA4BA0F2543F1EA0
SHA-512:	1E6023D221BA16A6374CFEB939F795133130B9A71F6F57B1BC6E13E3641F879D409783CF9B1EF4B8FD79B272793BA612D679A213FF97656B3A728567588ECFB9
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...[..V.............................0.......@.....W................................Gt...............................0...d......`(......x................K......................".......................................0............................text...x........................... ..`.itext.......0...................... ..`.data...l&...@...(..................@....bss........p.......@...................idata..`(.......*...@..............@....edata...d...0...f...j..............@..@.rdata.."...........................@..@.reloc..............................@..B.rsrc...x...........................@..@....................................@..@................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\madDisAsm_.bpl

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	66024
Entropy (8bit):	6.887872767382156
Encrypted:	false
SSDEEP:	1536:LNy3eqMne0sXB0IWtCLwEJhY0w1VmLPx5wdB3htW:LqMnfIB04LwEJhY0w16xAFW
MD5:	3936A92320F7D4CEC5FA903C200911C7
SHA1:	A61602501FFEBF8381E39015D1725F58938154CA
SHA-256:	2AEC41414ACA38DE5ABA1CAB7BDA2030E1E2B347E0AE77079533722C85FE4566
SHA-512:	747EA892F6E5E3B7500C363D40C5C2A62E9FCF898ADE2648262A4277AD3B31E0BCD5F8672D79D176B4759790DB688BF1A748B09CBCB1816288A44554016E46D3
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...[..V.................z...8......4..............W......................... .......k..................................&.......d........................K......T...............#....................................................................text...4w.......x.................. ..`.itext..<............\|.............. ..`.data................~..............@....bss.....................................idata..d...........................@....edata..&...........................@..@.rdata..#...........................@..@.reloc..T...........................@..B.rsrc...............................@..@............. ......................@..@................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\madExcept_.bpl

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	448488
Entropy (8bit):	6.745783308820855
Encrypted:	false
SSDEEP:	6144:hlAz49EKhEV30F8sl88nTjQ4Q50gEcW/jd+o72niVUNMa4Yn2Bq:hlG4ut30F8slzYlQcW/jd++2nJ6u2Y
MD5:	E8818A6B32F06089D5B6187E658684BA
SHA1:	7D4F34E3A309C04DF8F60E667C058E84F92DB27A
SHA-256:	91EE84D5AB6D3B3DE72A5CD74217700EB1309959095214BD2C77D12E6AF81C8E
SHA-512:	D00ECF234CB642C4D060D15F74E4780FC3834B489516F7925249DF72747E1E668C4AC66C6CC2887EFDE5A9C6604B91A688BA37C2A3B13EE7CF29ED7ADCFA666D
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...f..V.................H...@......<c.......p.....Y....................................................................O......._......D<...............K...P...A...........@..$...................................l...x............................text....C.......D.................. ..`.itext..D....`.......H.............. ..`.data...t....p.......L..............@....bss....H............Z...................idata..._.......`...Z..............@....edata...O.......P..................@..@.rdata..$....@......................@..@.reloc...A...P...B..................@..B.rsrc...D<.......>...N..............@..@.....................R..............@..@................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp100.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.297676823354886
Encrypted:	false
SSDEEP:	12288:koBFUsQ1H5FH3YUTd/df0RA7XkNvEKZm+aWodEEiblHN/:dFUsQ1H5FHdGKkNvEKZm+aWodEEcHN/
MD5:	D029339C0F59CF662094EDDF8C42B2B5
SHA1:	A0B6DE44255CE7BFADE9A5B559DD04F2972BFDC8
SHA-256:	934D882EFD3C0F3F1EFBC238EF87708F3879F5BB456D30AF62F3368D58B6AA4C
SHA-512:	021D9AF52E68CB7A3B0042D9ED6C9418552EE16DF966F9CCEDD458567C47D70471CB8851A69D3982D64571369664FAEEAE3BE90E2E88A909005B9CDB73679C82
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$..-`..~`..~`..~i.4~b..~{.;~c..~`..~...~..?~a..~{.9~a..~{..~P..~{..~Y..~{..~e..~{.<~a..~{.=~a..~{.:~a..~Rich`..~........................PE..d.....M.........." .........f.......q........cy..........................................@.............................................m......<....P...........=...0..P....`.......................................................................................text............................... ..`.rdata..-...........................@..@.data...0L.......8..................@....pdata...=.......>..................@..@.rsrc........P......................@..@.reloc..R....`......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp110.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	661456
Entropy (8bit):	6.2479591860670896
Encrypted:	false
SSDEEP:	12288:akhiz9iVQi6mpiyMATITfluR3G1YdpTzYJQIbRdJN2EKZm+DWodEEt2L:WaQeIJN2EKZm+DWodEEt2L
MD5:	7CAA1B97A3311EB5A695E3C9028616E7
SHA1:	2A94C1CECFB957195FCBBF1C59827A12025B5615
SHA-256:	27F394AE01D12F851F1DEE3632DEE3C5AFA1D267F7A96321D35FD43105B035AD
SHA-512:	8818AF4D4B1DE913AAE5CB7168DCEC575EABC863852315E090245E887EF9036C81AABAF9DFF6DEE98D4CE3B6E5E5FC7819ECCF717A1D0A62DC0DF6F85B6FEEB8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v.:..si..si..si~`.i..si..ri^.sis.i..si...i..sis.i..sis.i..sis.i..sis.i..sis.i..sis.i..sis.i..siRich..si................PE..d......P.........." ........."......<........................................p......L+....`..........................................3......l...<...............0E.......=... ..,....(..............................`...p............ ...............................text...:........................... ..`.rdata....... ......................@..@.data...p.... ...:..................@....pdata..0E.......F...D..............@..@.rsrc...............................@..@.reloc..FJ... ...L..................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp120.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660128
Entropy (8bit):	6.339650318935599
Encrypted:	false
SSDEEP:	12288:t2TOv4Zur4nRc4RwlG4xH2F+O+/i2UA3YyB2hxKM5Qrt+e2EKZm+GWodEEwIP:qRhxKM5U2EKZm+GWodEEw4
MD5:	0A097D81514751B500690CE3FC3223FA
SHA1:	7983F0E18D2C54416599E6C192D6D2B151A2175C
SHA-256:	E299B35D1E3B87930A4F9A9EF90526534E8796B0DEF177FB2A849C27F42F1DF2
SHA-512:	74639F4C2954B5959EB2254544BF2E06AB097219FC8588A4F154D1A369B0657176128C17911958C84ED55421FE89BF98C8ED36D803A07A28A7D4598DB88027CE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Ca.=...n...n...n..)n...n...n...n.R?n...n..%n...n.R=n...n.R.n4..n.R.nJ..n.R.n...n.R>n...n.R9n...n.R<n...nRich...n........PE..d......V.........." .....@...................................................`.......H....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp140.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	449280
Entropy (8bit):	6.670243582402913
Encrypted:	false
SSDEEP:	12288:UEPa9C9VbL+3Omy5CvyOvzeOKaqhUgiW6QR7t5s03Ooc8dHkC2esGgW8g:UEPa90Vbky5CvyUeOKg03Ooc8dHkC2ed
MD5:	1FB93933FD087215A3C7B0800E6BB703
SHA1:	A78232C352ED06CEDD7CA5CD5CB60E61EF8D86FB
SHA-256:	2DB7FD3C9C3C4B67F2D50A5A50E8C69154DC859780DD487C28A4E6ED1AF90D01
SHA-512:	79CD448E44B5607863B3CD0F9C8E1310F7E340559495589C428A24A4AC49BEB06502D787824097BB959A1C9CB80672630DAC19A405468A0B64DB5EBD6493590E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L....(.[.........."!.....(..........`........@............................................@A.........................g.......r...........................?.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp140_1.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31528
Entropy (8bit):	6.472533190412445
Encrypted:	false
SSDEEP:	384:R77JqjlI8icUYWhN5tWcS5gWZoMUekWi9pBj0HRN7RA5aWixHRN7osDhzlGs6N+E:R5D8icUlX5YYMLAWRAlypmPB
MD5:	7EE2B93A97485E6222C393BFA653926B
SHA1:	F4779CBFF235D21C386DA7276021F136CA233320
SHA-256:	BD57D8EEF0BC3A757C5CE5F486A547C79E12482AC8E694C47A6AB794AA745F1F
SHA-512:	4A4A3F56674B54683C88BD696AB5D02750E9A61F3089274FAA25E16A858805958E8BE1C391A257E73D889B1EEA30C173D0296509221D68A492A488D725C2B101
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..\4~.\4~.\4~...^4~.UL..X4~.Dz.[4~.D}.^4~.\4..v4~.D..Y4~.D{.O4~.D~.]4~.D..]4~.D\|.]4~.Rich\4~.........PE..d...W8.^.........." .........$............................................................`A.........................................>..L....?..x....p.......`..4....:..(A......p...@3..T............................3..0............0..0............................text...(........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..4....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp140_2.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	193832
Entropy (8bit):	6.592581384064209
Encrypted:	false
SSDEEP:	3072:V7vC/HAiCsJCzwneNPXU7tm1hTt8KBDal8zg/0LwhORfewlMi0JHV:VTGAtweN85m1f8KBI9wfpsJH
MD5:	937D6FF2B308A4594852B1FB3786E37F
SHA1:	5B1236B846E22DA39C7F312499731179D9EE6130
SHA-256:	261FBD00784BB828939B9B09C1931249A5C778FCEAD5B78C4B254D26CF2C201F
SHA-512:	9691509872FDB42A3C02566C10550A856D36EB0569763F309C9C4592CAF573FBB3F0B6DC9F24B32A872E2E4291E06256EAE5F2A0DEB554F9241403FD19246CAC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........94..Wg..Wg..WgVt.g..Wg..g..Wg..Sf..Wg..Tf..Wg..Vg..Wg..Vf..Wg..Rf..Wg..Wf..Wg...g..Wg..Uf..WgRich..Wg........................PE..d...W8.^.........." ................p............................................... .....`A........................................ ..................................(A...........K..T........................... L..0...............P............................text............................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp80.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	554832
Entropy (8bit):	6.428533960834858
Encrypted:	false
SSDEEP:	12288:UZY4lOHMwLwXBt+ia3htSUa/hUgiW6QR7t5j3Ooc8NHkC2eSQ:UZY4lOHMM8wiShtSj3Ooc8NHkC2eT
MD5:	8C53CCD787C381CD535D8DCCA12584D8
SHA1:	BC7CE60270A58450596AA3E3E5D0A99F731333D9
SHA-256:	384AAEE2A103F7ED5C3BA59D4FB2BA22313AAA1FBC5D232C29DBC14D38E0B528
SHA-512:	E86C1426F1AD62D8F9BB1196DEE647477F71B9AACAFABB181F35E639C105779F95F1576B72C0A9216E876430383B8D44F27748B13C25E0548C254A0F641E4755
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............y..y..y..fv..y..y..#y.....y..2...y.....y.....y......y.....y.....y.....y..Rich.y..........PE..L....LYJ...........!.....@... ...............P....B\|.........................p.......0....@.............................L...T...<....................`..P.... ..H2...S..............................Pe..@............P.. ............................text...V>.......@.................. ..`.rdata......P.......P..............@..@.data...l&....... ..................@....rsrc...............................@..@.reloc..NA... ...P..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcp90.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	570240
Entropy (8bit):	6.523986609941549
Encrypted:	false
SSDEEP:	12288:NZ/veMyZ137mSEWT0VkypLvgLehUgiW6QR7t5183Ooc8SHkC2eU8Z:NZSZ13iwJmgLq83Ooc8SHkC2eN
MD5:	232708A3FB0137133BA1787EF220C879
SHA1:	4F725F93081FE15C6AF99E32F3E97CCB22E15BFE
SHA-256:	64236B28CB287D9C912D1DB753B21BEB95009340B7ABB2717E40CE8D91946C89
SHA-512:	90DAEFA1F3D3608700074F349D0CD5E5D2EAE090ECAD07352E553F08087A2EDDEB457F235CDC7E4869C4CF24E895C05C11AF968E68CFD0B6AA8092C98DC7E4FC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L...~LYJ...........!.....4...p..............P....Hx......................................@..........................P..,....E..<...............................43...................................%..@............................................text....2.......4.................. ..`.data...t'...P.......8..............@....rsrc................R..............@..@.reloc..HC.......D...V..............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcr100.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	773968
Entropy (8bit):	6.901559811406837
Encrypted:	false
SSDEEP:	12288:nMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoe3z:MmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV7z
MD5:	0E37FBFA79D349D672456923EC5FBBE3
SHA1:	4E880FC7625CCF8D9CA799D5B94CE2B1E7597335
SHA-256:	8793353461826FBD48F25EA8B835BE204B758CE7510DB2AF631B28850355BD18
SHA-512:	2BEA9BD528513A3C6A54BEAC25096EE200A4E6CCFC2A308AE9CFD1AD8738E2E2DEFD477D59DB527A048E5E9A4FE1FC1D771701DE14EF82B4DBCDC90DF0387630
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x......................................@..........................H......d...(.......................P.......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcr110.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	849360
Entropy (8bit):	6.542151190128927
Encrypted:	false
SSDEEP:	24576:I+9BbHqWVFlB7s2ncm9NBrqWJgS0wzsYmyy6OQ:z9d7M3nS0wV
MD5:	7C3B449F661D99A9B1033A14033D2987
SHA1:	6C8C572E736BC53D1B5A608D3D9F697B1BB261DA
SHA-256:	AE996EDB9B050677C4F82D56092EFDC75F0ADDC97A14E2C46753E2DB3F6BD732
SHA-512:	A58783F50176E97284861860628CC930A613168BE70411FABAFBE6970DCCCB8698A6D033CFC94EDF415093E51F3D6A4B1EE0F38CC81254BDCCB7EDFA2E4DB4F8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........c.O.0.O.0.O.0.O.0}O.028g0.O.0?..02N.0?..0.O.0?..0.O.0?..0wO.0?..0.O.0?..0.O.0?..0.O.0Rich.O.0........................PE..d...n..P.........." ................l3.......................................@............`..........................................E.......1..(............... g.......=......8...`6..............................P...p............0...............................text............................... ..`.rdata.......0......................@..@.data...(q.......@..................@....pdata.. g.......h...(..............@..@.rsrc...............................@..@.reloc...".......$..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcr120.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963744
Entropy (8bit):	6.63341775080164
Encrypted:	false
SSDEEP:	24576:lQ39+j16xw/86yY4ZOVqSs8cKPkb3vi4vwW1kCySQmWymTXY:S3tPDLfRbiow9Cyo
MD5:	E2CA271748E872D1A4FD5AC5D8C998B1
SHA1:	5020B343F28349DA8C3EA48FB96C0FBAB757BD5C
SHA-256:	0D00BF1756A95679715E93DC82B1B31994773D029FBBD4E0E85136EF082B86A9
SHA-512:	85D6BCAAF86F400000CF991DA1B8E45E79823628DC11B41D7631AA8EE93E500E7DA6E843EA04EDB44D047519DABEF96DCB641ADC2A7B3FAA5CD01E8A20B1F18E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F=&^'Su^'Su^'Su..u]'Su^'Ru.'SuSu.u.%SuSu.uo'SuSu.uh'SuSu.u.'SuSu.u_'SuSu.u_'SuSu.u_'SuRich^'Su........PE..d......V.........." .....j...:.......)..............................................+l....`.....................................................(............@...s...v...>......8...p................................2..p............................................text...eh.......j.................. ..`.rdata...9.......:...n..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................`..............@..@.reloc..8............d..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcr80.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	632656
Entropy (8bit):	6.854474744694894
Encrypted:	false
SSDEEP:	12288:bxzh9hH5RVKTp0G+vjhr46CIw+0yZmGyYCj:bph9hHzVKOpXwymGyYo
MD5:	1169436EE42F860C7DB37A4692B38F0E
SHA1:	4CCD15BF2C1B1D541AC883B0F42497E8CED6A5A3
SHA-256:	9382AAED2DB19CD75A70E38964F06C63F19F63C9DFB5A33B0C2D445BB41B6E46
SHA-512:	E06064EB95A2AB9C3343672072F5B3F5983FC8EA9E5C92F79E50BA2E259D6D5FA8ED97170DEA6D0D032EA6C01E074EEFAAB850D28965C7522FB7E03D9C65EAE0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........L.........@................!......;.............d.......................Rich...................PE..L...yLYJ...........!.....0...p......+#.......@.....x......................................@..........................q...~..Pc..<....`..................P....p..P3...B...............................F..@............@...............................text....'.......0.................. ..`.rdata......@.......@..............@..@.data...Li.......P..................@....rsrc........`.......@..............@..@.reloc...7...p...@...P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\msvcr90.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	653696
Entropy (8bit):	6.885617848989009
Encrypted:	false
SSDEEP:	12288:Bhr4UC+UumMaIYE8EoPP1cI9xPP2OKDL9QXyG2pUmRyyva:VU9FNPPbxPP2OeL9Q2pUmRyyva
MD5:	4B9B0107D35859FA67FB6536E04B54A7
SHA1:	60F5D36F475FEA96F06AC384230B891689393486
SHA-256:	EA59B23FC4799B10B07CC1E4F81BBCB7FAC712D93E2BA48DE50046E5B4C140DB
SHA-512:	324EDB6D0C618C20260417B86189C27D6E1EB00944C7F5A6C59679365E618D262C71433749DDFEF253B723F1D1B3167982B4742164A167B3CFC85C651300382B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L...yLYJ...........!.....\..........@-.......p....Rx.........................0............@..............................\|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\ntvbld.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	MS-DOS executable PE32 executable (DLL) (native) Intel 80386, for MS Windows, MZ for MS-DOS
Category:	dropped
Size (bytes):	60896
Entropy (8bit):	6.847633229504993
Encrypted:	false
SSDEEP:	768:NnCuEmXB5UMI3nhKrbZCWg/0/NC8hUDVsa0T1zj9KyhaMQNDG0uKjKj9MPgkz:N7Rx5Ulll8/H+x0T1zj9lHeMy
MD5:	690612154E7E5233AA980016CEAEDEDD
SHA1:	9B16E2F3D799EA506AA6A8F53FA4DEB36D73F5D4
SHA-256:	FFB81D34A14B5837AC713657F7892E790F85564BC2BA792025B0F9E9E0959AD7
SHA-512:	1F93AF0CA40DB562F7ECDBF19A0D899044BCF1F181B03E57E6B6F2C72F532652798023612BE9DEFE6261D631D10898D30ADB28EEFF922B72734B4DB27189C210
Malicious:	false
Preview:	MZ!..... ..........e..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................ntvbldDXML..$............!.L.!........h.T.....................q.......q.......q.......q.......q.......q.......q......Rich............PE..L......a...........!.........\......2=.............p................................s`....@.........................p...........(.......h...............H?..........................................0+..@............................................text...v........................... ..`.data....F..........................@....rsrc...h...............

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\oDayProtect.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	57456
Entropy (8bit):	6.555119730119836
Encrypted:	false
SSDEEP:	1536:h4WOg3TER/nhU8Vbbb8O0WWVYgaatjJxl:h4WOg3TSr78O0WWVYg5tJ
MD5:	00FCB6C9E8BD767DDE68973B831388E9
SHA1:	2D35E76C390B8E2E5CA8225B3E441F5AC0300A02
SHA-256:	1CC765B67D071060C71B4774C7745575775CE46E675E08620E5BAB3B21B2CE79
SHA-512:	2B48701B5F4B8F1EB7FC3EB9A76370883FE6CAF45D92DA607AB164F93E0EED65D6C1369D4EA974A112C902FD0F5BAF06E7611ECB9B50BE3A599F261624B33BA5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[..]..............3.....M......M......M......M.......{n......{k............................._.......7............Rich............PE..L...m>.d...........!.....`...R......._.......p............................................@...........................................P...............p2..............p........................... ...@............p..\............................text...._.......`.................. ..`.rdata...4...p...6...d..............@..@.data...$...........................@....shared.............................@....rsrc...P...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\plugins\Microsoft.VC80.ATL.manifest

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	376
Entropy (8bit):	5.187860451409661
Encrypted:	false
SSDEEP:	6:TMVBd6OjzIIBeBXVL9obRu9Td8gH9aO/5TMiX1+jSQdS1vwIgVf+ZaYf7:TMHdt4IBeBFLOwHR5TNl+rmxgVKaq7
MD5:	0BC6649277383985213AE31DBF1F031C
SHA1:	7095F33DD568291D75284F1F8E48C45C14974588
SHA-256:	C06FA0F404DF8B4BB365D864E613A151D0F86DEEF03E86019A068ED89FD05158
SHA-512:	6CB2008B46EFEF5AF8DD2B2EFCF203917A6738354A9A925B9593406192E635C84C6D0BEA5D68BDE324C421D2EBA79B891538F6F2F2514846B9DB70C312421D06
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>. Copyright . 1981-2001 Microsoft Corporation -->.<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">. <noInheritable/>. <assemblyIdentity. .type="win32"..name="Microsoft.VC80.ATL"..version="8.0.50727.4053"..processorArchitecture="x86". />. <file name="ipaip1.exe"/>.</assembly>.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\plugins\Microsoft.VC80.CRT.manifest

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	314
Entropy (8bit):	5.140999301390513
Encrypted:	false
SSDEEP:	6:JiMVBd6OjzPbRu9Td8gH9bZELrbvm/53SMiX6+hPABdS1FggVfgk5Z:MMHdtlwHHJ53SNK+hPIRgVR5Z
MD5:	710C54C37D7EC902A5D3CDD5A4CF6AB5
SHA1:	9E291D80A8707C81E644354A1E378AECA295D4C7
SHA-256:	EF893CB48C0EBE25465FBC05C055A42554452139B4EC78E25EC43237D0B53F80
SHA-512:	4D2EC03FF54A3BF129FB762FC64A910D0E104CD826ACD4AB84ED191E6CC6A0FEC3627E494C44D91B09FEBA5539AD7725F18158755D6B0016A50DE9D29891C7E5
Malicious:	false
Preview:	.<?xml version="1.0" encoding="UTF-8" standalone="yes"?>.<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">. <noInheritable></noInheritable>. <assemblyIdentity type="win32" name="Microsoft.VC80.CRT" version="8.0.50727.4053" processorArchitecture="x86"></assemblyIdentity>.</assembly>

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\plugins\RunHours\es-419.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	4582
Entropy (8bit):	5.313572308207674
Encrypted:	false
SSDEEP:	96:SXJbP0TKhuwTfSX1R3AJDnR5Wlqib+H+7tpUDoSlM9Z6b5E5f:S//TfSX1BobR5WlqiKHWGoSlM9Qb5E5f
MD5:	20A4B76F3AB1EA606ACEE2ECFC7EACDA
SHA1:	4B758CA773E540F60E4788B43832F4AC9F9D2C02
SHA-256:	C4D807092F4493A9E5EE5F6D5770091683AAC44F203A9E72C556CA5D94E13712
SHA-512:	DD03DF3F30199D74C3C74C8766D336C18AB02C73C8B24B23F3D756F76F4119EE2FA6DB0A3F0C398980CFF7D3C162C9BD8364412A2B12FBF2F90395D4FBD86017
Malicious:	false
Preview:	..........N.....N.....N.....N.....N.....N.....N.....N!....N%....N+....N1....N<....NO....N^....Ns....N~....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N(....NO....Ng....N~....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N....N7....NL....NT....Ne....Nk....N}....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N....O4....O9....OM....Oz....O.....O.....O.....O.....O.....O.....O.....O ....OA....OQ....Oq....Ov....O{....O.....O.....O.....O.....O.....O@....O}....O.....O.....O.....O.....O/....OL....Oh....O.... O....!O...."O....#O....$O....%O....&O....'O....(O....)O....*O....+O[...,O....-O.....O0.../Oq...0O....1O....2Oe...3O....4O....5O....6O....7O_...8Oy...9O....:O....;O....<O....=O....>O=...?OM...@Oq...AO....BO....COV...DO....EO....FO....GO....HO....IO7...JOK...KOT...LOf...MOp...NOw...OO....PO....QO....RO....SO..........DetallesGuardarSe trata de un .ndice que admite b.squedas.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\plugins\RunHours\es.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.293442130076125
Encrypted:	false
SSDEEP:	96:/ymf8T/vT4Y7o+Aq6XWp5H7irYKhIeDH5SVWYGCrBHehj76:/ymy/vT4Y7DZ6Xc5H7irYGIgH5SVWYGw
MD5:	9E231E6B336F8746C1D9949CFFB81892
SHA1:	44CF40E676B5C4AD7D30CAB1C73E0AB3E51F9A0F
SHA-256:	E3958A2562A3DB00C863543CBF2F8754AE52506045AF0FE68A98C21A21980DE6
SHA-512:	1EB7B3AA1BD4B0F72273403FCFBD03204823285E250D2A3859FAC3D8649B0708879CD9F6688048F46C8724D68B9960634A9EB3882110DB2EF33AB72B8EF1DA5D
Malicious:	false
Preview:	..........N.....N.....N.....N.....N.....N.....N"....N%....N)....N/....N5....N@....NS....Nb....N~....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N....NO....Nd....Nx....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N#....N0....NE....NM....N^....Nd....Nv....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N'....N5....O?....OE....O`....O.....O.....O.....O.....O.....O.....O.....O.....O.....OM....Oj....O.....O.....O.....O.....O.....O.....O.....O"....OQ....O.....O.....O.....O.....O%....O?....Og....O.....O.... O....!O...."O....#O....$O....%O....&O....'O....(O....)O%...O5...+Oy...,O....-O.....OR.../O....0O....1OM...2O....3O....4O....5O....6O0...7O....8O....9O....:O....;O....<O-...=OO...>O~...?O....@O....AO....BOU...CO....DO....EO....FO....GO....HO....IO....JO....KO....LO....MO....NO....OO....PO....QO@...ROH...SOJ.....p...DetallesGuardarSe trata de un .ndice que admite b.squedas.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\plugins\RunHours\et.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	4024
Entropy (8bit):	5.482794389326184
Encrypted:	false
SSDEEP:	96:3ibSEiksDWHJ+CCC7w2e3+nstsemhHvAs/FTeY4M1ATH:ySbDWHJ+CCCBwMq
MD5:	05EB53F564DE06DD2CEC9CA4EFF8CF87
SHA1:	96E1CF30497A517FE17D238C2B1228ABA80291AC
SHA-256:	772A79F8D52BBFBC0B3EF1D4040AE04AC82A51900C202423A4BA5C5FAA802130
SHA-512:	38F824D85D3CE88329881FF04E9BF1908524843F0F7B309E06D09F5D939B23E742C634889CA5670D36782D75FE02F8BD6F294A93C86BB67AAA4E9566DED2400C
Malicious:	false
Preview:	..........N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N(....N1....N<....NH....NP....NV....N]....Nd....Nk....Nr....Nt....Nv....Nz....N.....N.....N.....N.....N.....N.....N.....N.....N.....N+....NC....NK....NR....N[....Ne....No....N{....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N&....N9....N=....ND....NM....NR....NW....N]....Nm....Nq....Nv....N~....N.....O.....O.....O.....O.....O.....O.....O.....O.....O.....O(....O<....OQ....Of....Ow....O.....O.....O.....O.....O.....O.....O.....O.....O.....O6....OM....Oq....O.....O.....O.....O.....O.....O.... O'...!O6..."OC...#OJ...$OM...%OU...&O[...'O`...(Om...)O....*O....+O....,O....-OP....O..../O....0O....1Oc...2O....3O....4O....5O....6OA...7O....8O....9O....:O....;O....<O....=O!...>O8...?OF...@Oa...AO....BO....CO:...DO....EO....FO....GO....HO....IO....JO ...KO(...LO:...MO?...NOD...OON...POi...QO....RO....SO...........ksikasjadSalvestaSee on otsitav indeks. Sisestage otsingu j

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\plugins\RunHours\fa.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	6173
Entropy (8bit):	4.922771262854036
Encrypted:	false
SSDEEP:	96:GAOQjAdjFIowK7nR6wjN9fTHQZEwGcXbesT2UNXMW3LS577O3/z:G0AdhI4nR6q7qEwxXbde7Ovz
MD5:	6ABD91C944EA0063DD133119242ADD5D
SHA1:	89BFE399BC16D5584CB13C814B6A3764FB91AD29
SHA-256:	5AC05F15CEE979E26A6795343B68926EAD54ED5A9240C19C187A28943977067A
SHA-512:	01F077D513A4F61B1D497BF9CCF02E17B5B1FB6E23991EC870F5D9C8CD12CB7E4C97A5D011A5C55B855A36EE72B3D586E7416C1F16CEAFA0BF8EB48446DC5AC3
Malicious:	false
Preview:	..........N.....N.....N.....N(....N7....NA....NG....NM....NS....N]....Ng....Nw....N.....N.....N.....N.....N.....N.....N.....N'....N=....N?....NA....NE....NY....Nf....Nu....N}....N.....N.....N.....N.....N+....NE....NZ....Na....Nk....Nw....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N....N4....NG....NQ....Nh....Np....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N&....N,....N6....NH....N\....Ob....Oh....Oy....O.....O.....O.....O.....O.....O....OV....O.....O.....O.....O.....O#....O)....O3....OW....O}....O.....O.....O.....O.....O.....O?....Oy....O.....O.....O.....O(....O]....O.... O....!O...."O....#O....$O....%O....&O....'O....(O....)OT...On...+O....,O....-Oe....O..../O....0O7...1O....2O;...3O{...4O....5O....6O%...7O....8O....9O....:O\|...;O....<O....=O:...>Ov...?O....@O....AOc...BO....CO....DO)...EO....FO....GO....HO....IO...JOA...KOW...LOj...MOp...NOv...OO....PO....QO....RO....SO........................ ..... .... ..... .

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\plugins\de.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	4406
Entropy (8bit):	5.431403966547261
Encrypted:	false
SSDEEP:	96:w3RvffZNggc5v5baG6IRqTsBRpKCSFdR9KoINpQFphkSn4zFJo5dzi5zVfwFT2:w39H2vgtIRqTMyFdTbINpQFphkSnWo5+
MD5:	EA1F904F7B976BCDB6E22A2962BDB546
SHA1:	5D4FF12B9ED1014F94131FD4BEC5D47DC224E643
SHA-256:	52098599A0CC8BCA7CAB3971F56D5EB373378C7FBCA907E71F784D6DE6D76C98
SHA-512:	2E80076218BAF7D3041288BD2B7ECCDEB9A4B8589BCD81190B0B4EBDD78C9B506760FCB4AF63C99FC42A45B21897F3EAA93F4DE30CAAFBF3348410BDE12560B2
Malicious:	false
Preview:	..........N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N!....N.....N>....NP....Na....Nk....Nt....N}....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....NN....No....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N"....N>....NG....NO....NS....Nc....Ng....Nx....N\|....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....O.....O.....O.....O ....O/....O@....OF....O^....Os....O.....O.....O.....O.....O.....O.....O.....O.....O#....O1....OC....OV....Oe....Ot....O.....O.....O.....O.....O.....O.....O7....OU....Or... O....!O...."O....#O....$O....%O....&O....'O....(O....)O....*O....+O....,Oz...-O.....O..../OC...0O....1O....2O!...3OL...4Ow...5O....6O....7O4...8ON...9Oj...:O....;O....<O....=O....>O3...?OJ...@O....AO....BO1...CO....DO....EO2...FO<...GOG...HOO...IOd...JOx...KO....LO....MO....NO....OO....PO....QO....RO....SO......6...DetailsSpeichernDieser Index kann durchsucht werden. Geben Si

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\plugins\el.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	7882
Entropy (8bit):	4.66720349289761
Encrypted:	false
SSDEEP:	192:lK+yxJ5y7wpdeDpP+hM7mcOlaOOuMos4Mw+UwUkGMH1xhyihmhqYChzhqYihHp3:lK+yxJ47wpdeDpP+hpFSxGOrSDp3
MD5:	3F2A22EDF71920EC81F31DC74AD7D8F5
SHA1:	63C524131D83777A56001F82B93CAA784C46EC27
SHA-256:	A34B29017ACFD42AA7EE9177797FF4ECD4430D5E578E80AB1C43D2792692C152
SHA-512:	8ACA982845E6896E7F4816BE13768490A636BFC1DBF2C0018C0A9AA168DE804FF4552BEFEBEFA44EC6F638A5773017241D35565A86BBCADC6CD46E373181AD9D
Malicious:	false
Preview:	..........N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N#....NY....Nh....Ns....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N[....N.....N.....N.....N%....NW....Nk....Nu....N{....N.....N.....N.....N.....N.....N.....N.....N&....N0....NB....Ng....N.....N.....N.....N.....N.....N.....N.....N1....NA....NO....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N5....OK....OU....Op....O.....O.....O.....O.....O?....Oh....O.....O.....O.....O7....OJ....O.....O.....O.....O.....O.....O.....O;....O_....O.....O.....O.....OR....O.....O.....O.....O8....Oj....O.... O....!O...."ON...#OX...$Ob...%Oz...&O....'O....(O....)O....*O....+Of...,O....-O.....O7.../O....0O8...1O....2O....3O....4O<...5O....6O....7On...8O....9O....:O$...;OI...<O....=O....>O(...?O[...@O....AO$...BO....COf...DO:...EO....FO#...GO3...HOJ...IOs...JO....KO....LO....MO....NO....OO....PO#...QON...RO_...SO.........................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\plugins\en-GB.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	3733
Entropy (8bit):	5.413561641632349
Encrypted:	false
SSDEEP:	96:4WeMurxaP/L/ThulsMlRnmggluSvu4Yg22:4Webr4PDrolZfnmgglxu4fd
MD5:	08C52ED432480C1CAA15DB7F227857C3
SHA1:	4F138AE151C82DB1B4B639CD788D349C6AC63642
SHA-256:	84494A784BF0D03CD5DC3C99822F46C777E28C54086712F6AB736323A5462B2F
SHA-512:	43E8A9241049254FE9F6BA31FC6AE06DC9135A2A9DBF6D7E4E6F866249AA266CE7E390F463600BC319CF4D71DE93410339C13505CBBA5676D6846C26212D75F5
Malicious:	false
Preview:	..........N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N'....N5....N=....NE....NM....NU....N]....Ne....Ng....Ni....Nm....Nx....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N ....N-....N5....NA....NK....NZ....N^....Nb....Nh....Nl....Nr....N{....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N#....N....O.....O3....O<....OO....O[....Oi....Oo....O.....O.....O.....O.....O.....O.....O.....O.....O.....O.....O$....O7....OE....OS....Of....Ox....O.....O.....O.....O.....O.....O.....O+....OJ....O_... Ov...!O...."O....#O....$O....%O....&O....'O....(O....)O....O....+O....,O@...-Oy....O..../O....0O....1O[...2O....3O....4O....5O....6O....7Od...8Oz...9O....:O....;O....<O....=O....>O8...?OK...@Om...AO....BO....COH...DO....EO....FO....GO....HO....IO#...JO/...KO3...LO9...MO=...NOB...OOJ...PO^...QOt...RO\|...SO..........DetailsSaveThis is a searchable index. Enter search keywords:

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\plugins\en-US.pak

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	3735
Entropy (8bit):	5.399152833535112
Encrypted:	false
SSDEEP:	96:8k5Ar/7QD0dZaPFL/ouZMlRnDggluCzuCYg21:8k5MzQYdQPxpmfnDgglpuCfU
MD5:	5A1DF84EF435AAF57EC22CEF850AA94A
SHA1:	5F753586E1FF36719B79C784E4A548F649E34872
SHA-256:	638EBF6779646866CD866BDF6B6069435AB8527D63A7552E1F580520C477D45C
SHA-512:	9B016A2FB6259661CEB2E5FAC9AA2D2F7EC26D93959F4186F5E763C122B4FAEE9FB80E84C9D6F31F729D572DB8E21C3B711F610DBB007A741EC3C540DB2F305D
Malicious:	false
Preview:	..........N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N'....N5....N=....NE....NM....NU....N]....Ne....Ng....Ni....Nm....Nx....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N ....N-....N5....NA....NK....NZ....N^....Nb....Nh....Nl....Nr....Nz....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N.....N"....N(....O,....O1....O;....OO....O[....Oi....Oo....O.....O.....O.....O.....O.....O.....O.....O.....O.....O.....O$....O6....OD....OR....Oe....Ox....O.....O.....O.....O.....O.....O.....O.....OM....Ob... Oy...!O...."O....#O....$O....%O....&O....'O....(O....)O....*O....+O....,OC...-O\|....O..../O....0O....1O^...2O....3O....4O....5O....6O....7Og...8O}...9O....:O....;O....<O....=O....>O=...?OP...@Or...AO....BO....COM...DO....EO....FO....GO....HO....IO&...JO2...KO6...LO<...MO@...NOE...OOM...POa...QOw...RO....SO..........DetailsSaveThis is a searchable index. Enter search keywords:

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\plugins\version

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	F1D3FF8443297732862DF21DC4E57262
SHA1:	9069CA78E7450A285173431B3E52C5C25299E473
SHA-256:	DF3F619804A92FDB4057192DC43DD748EA778ADC52BC498CE80524C014B81119
SHA-512:	EC2D57691D9B2D40182AC565032054B7D784BA96B18BCB5BE0BB4E70E3FB041EFF582C8AF66EE50256539F2181D7F9E53627C0189DA7E75A4D5EF10EA93B20B3
Malicious:	false
Preview:	....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\pp_helper.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	74432
Entropy (8bit):	6.228910769546381
Encrypted:	false
SSDEEP:	1536:Vf77+031ru/qpap4qUqm+rIqRqEp+85LQyisF:tWo1/op4qUqfrIkb+aLQoF
MD5:	24F4BF7288749C467A6FB67A5333E867
SHA1:	663AF51B8CB380E4BB133A9D365D175B11782F7B
SHA-256:	40BFC6EEB22CB8F8A2C6DF9C71589E0D98C24483A66BFB90290AAD5BDFBC6E88
SHA-512:	9ED444F446000E4DD7E4B8ADBFCC16BABB77D4FAEF79DC4210A26F99923B6C052AEEE9D03B3E02913B9948DB47301665CCD5496FE7009A4A7070729B6D15F42B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........V...............................A.........................Rich...................PE..d...+..I..........#..........Z......0$.........@.............................P......X9..........................................................(....@.......0..........................................................................8............................text............................... ..`.rdata...8.......:..................@..@.data....#..........................@....pdata.......0......................@..@.rsrc........@......................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\qvlnk.bro

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	774144
Entropy (8bit):	7.999769980896681
Encrypted:	true
SSDEEP:	12288:YyTS+Wj2XVYP4LMPHbIiJdTOvdXfYHKtbN+uehl030jBwdQxkwSCef+Kg:9T8EiLyvv+u8xauCwXeWKg
MD5:	2BEDA13E7CE6EBE45497641D122A3814
SHA1:	B25DF34290965AED25678610BC4D2B5F2742AB31
SHA-256:	CF5573B875D42008076B04412CC9A56882F1EDC243DB4EC211F0C57DBFC30980
SHA-512:	8B4959BCAEB99F8B8CDE2BF67DB0F107125F4251D00B11C5C675A104CA84AD463E46DC53F410DCB8D4D0EEE6FCF63BE802BC18189C1DC7AFE5B6DDB974375790
Malicious:	false
Preview:	..\....).....0+...;.EL......&..\|.!...!.B.......1.t.B..t....Swo.2....0........ZN_..w..rd..%J.j\|1,..s....t...._.....g.w5>...cdb3+F0..eT.e..\|g+..(...b52.Q..?[..Y....c_..A...,.......L..\...p.vRS...V......n.PH...L...,.`.h....!_km=.e...:.)..U.&.-.(...i...._.F.D.%NS..^s".TO....S....Q.-..;R..[m..u.%o..c.).~...Do.FZp.`..s.lip.A........g.z8../7..+...u,O.....z4....D^Z....C.-.6yALc.Mw.H'.......1..Yl..g.e..{. ...2r..I.F..>.f......f\|.0.^..b.I.8.....N....I.\|m.v..M.jx..){.......s...).g..4!...L1O Z3xT.'._9...B..#..y...d.......3.EE..2M....bbQ.i..m.(...bVTk$W.x.$...!-.........sX.m.].v.\l..]#...P...).N"..A%SA18A....5._\|...%..<........%...t.}...r(d..\.G.1..:.{.z.,...u.9...h...".(;4..5z.5y!{rng......}>....F.4.=.Nfl"S....[..^KK.....-T...).uv.9>....8.."D...Qb"..D....p8C..nr.......o......G....e...L..8w.f..Wc....E..qgu.../...9.B....9;....^.]......j.f.LaK=......lZ.d..!4jL@....H.....K..W..P..\|...vy.Y!.Mg._.........4......8.z.?...YK.<..~qw.!4....W...[...}..Z

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\rar.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	638616
Entropy (8bit):	6.540549330363699
Encrypted:	false
SSDEEP:	12288:4zga+163KOqlPidmIaEPFSV+/sZy+/eZ+8q1wUg7OkrBgGvg:4zg116ddmIaEPFz/6yPZ++15rBgB
MD5:	300D43860DC6961BBECE819912C930BC
SHA1:	61CC9B17FAE66451327E8F9A7103B9728EB5C95C
SHA-256:	792708CE3FEC9DA37408CE4179B118D79B4804878D233C602B490C3BD0EAF02A
SHA-512:	F74CD7C28E2A267E6B51FA2A8A36380F5766195F7216FD9EE1F76E708343520E9CB60F620FD86114B947589D9F8FDAAA209CF190A5D014BF251AB8BD182FD541
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............`...`...`.ix....`.ix..^.`.ix....`.....`.\|.....`.\|.e...`.\|.d...`.\|.c...`.....`...a.e.`.(.e...`.(.....`.(.b...`.Rich..`.................PE..L...V. b.........."..........~.......w............@..........................p............@.................................T............................>... ..(E..\b..T....................c.......b..@............................................text............................... ..`.rdata..J...........................@..@.data...x........,..................@....rsrc...............................@..@.reloc..(E... ...F...:..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\rb

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	129024
Entropy (8bit):	7.8271140059205635
Encrypted:	false
SSDEEP:	1536:G/ij0LGUf2eh2R1IQO1rIXfAALqY6BFi0BN5Tuf95qu1kmkQXHgS5zbPKd32h+Vb:HgflEw1rIXfAjLzTufH1+SKdk+V
MD5:	88173E288C847FE71DB634CCFBD95ABF
SHA1:	705070D59FDCF89C71A90A5B4A1C092E55F16977
SHA-256:	28B075F044864E1D63A919E1C71BE7BE242F4098B43AB0439A0C891DB675AD72
SHA-512:	28F1A6D147D134D2CA73DE78931196B51AA8A931AA74F66584DDB2E623CC901FA6FEE2660AA36429B939A2E040CC5ACA9EFF0F746E350DCFA73843D093F2376B
Malicious:	false
Preview:	...]^]]]Y]]]..]].]]]]]]].]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]].]]]SB.S].T.\|.\..\|.54.}-/2:/<0}><332)}?8}/(3}43}...}0298sPPWy]]]]]]]P...`...`...`..o\|...`...o...`..\|...`..{....`.......`...o...`...`..`.."F..\`...`...`.......`...4>5.`..]]]]]]]]..]].\^]..w:]]]]]]]].]R\V\[]].\]]M]]].Y]m.[]].Y]].[]]].]]M]]]_]]Y]]]]]]]Y]]]]]]]].[]]Y]]]]]]_]]]]]M]]M]]]]M]]M]]]]]]M]]]]]]]]]]]].[]._]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]...m]]]]].Y]]M]]]]]]]Y]]]]]]]]]]]]]].]]....l]]]]].\]].Y]].\]]Y]]]]]]]]]]]]]].]]....o]]]]]M]]].[]]Y]]].\]]]]]]]]]]]]].]].]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]]ismo]...\|PTUU

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\rtl120.bpl

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1112040
Entropy (8bit):	6.832491592471325
Encrypted:	false
SSDEEP:	24576:GbhVoNWbA1m6z1hGaMopv3RdaK6IPFf0DtDN9Tox0gc:vtQZPTtgc
MD5:	ADF82ED333FB5567F8097C7235B0E17F
SHA1:	E6CCAF016FC45EDCDADEB40DA64C207DDB33859F
SHA-256:	D6DD7A4F46F2CFDE9C4EB9463B79D5FF90FC690DA14672BA1DA39708EE1B9B50
SHA-512:	2253C7B51317A3B5734025B6C7639105DBC81C340703718D679A00C13D40DD74CCABA1F6D04B21EE440F19E82BA680AA4B2A6A75C618AED91BD85A132BE9FC92
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\rtl120.bpl, Author: Joe Security
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......H...........................................P.........................`......U...........................................X$...p...................K......h.......................................................x............................text............................... ..`.itext........... .................. ..`.data...tw.......x..................@....bss.... T...@...........................idata..X$.......&..................@....edata...............D..............@..@.rdata...............&..............@..@.reloc..h............(..............@..B.rsrc........p......................@..@.............`......................@..@................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\settingss

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	2208
Entropy (8bit):	7.90993950405871
Encrypted:	false
SSDEEP:	48:vLt5Bk5dkgrofUZgvatOFn6xNTBlaE0C+fTC6mqv1jrh:ziyG8UZlogygurh
MD5:	68D847D78794F6CAC3348D7EAAAD5763
SHA1:	72887EF22FC7D1927D3F96CC57260BD52F6535DE
SHA-256:	D9A37729C055A70C614FC9F928781A84EAF89D3420E1D6A2D9E53C2524AE63C6
SHA-512:	D5401F137AB863D9A07C9C0E5BC23D6650FFBCC75E7E02F438B2DDD3B166FB22A5ACC790AB09D44336E1C80E2693B0CF3A4431612663ACFF0A246D45D003147F
Malicious:	false
Preview:	TDF$..-.... O...d.....eM4.YX.3..pp...../....`...G...$.;x.wl0....\|...... ^\..Y.5.J....)N.a@..q...oh[.....C...@w'.....~....x\....6..0....fY^5.p......!.>.J.........Q{.../....q..jG...ZuW....j.......7....p..b.>......i.......e.Xj.eT....G..>.d....ehBH..G..'I.V.."F0..z...bI..N.....v.]De(.U.....,....kS.i..S.9,.Jz.t.&pfH.4).V..2....QK[.....u>..I.9.\|.E...l..."o('..E.,..w..3...."[.bd..p;....@....p<.$_k..}...t3....B....X4....e.7..@.8..^..8 .?>z.?...a/..w.._.>....W[.$_.K...D...H.\|.5[....\|....<+K.e%........Z.JN.L..(.Ec.&.7K.....2F.W7.k>..3.(Q...vM.6.>[.I......U.i...;..4..XU,...y..{x...V$uo.+dc^._.n.#c..O........T..%.D.1n..L%..a...3...W[.-/..P..Z##.....bM:hw.;D...w=..........bH'...au....s.<....>+z{.z.."...Ew.`..cu..9.._4....h.K.>s.....n.......j.[.."....O.i..r.p.x!}z..%.......p.. &.....A.\|..?T..U.uo...o...L...T...2.n..i!.M.RI..}f...6.Y.^.jX.+...l.....i~.o].}d..V4._Wl......C...k..C.&.U..../W.......).m.o.N....0.z.R ..Z+g..."(!....r........ .y .J....

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\settingss2

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	2160
Entropy (8bit):	7.907521368348162
Encrypted:	false
SSDEEP:	48:I+ZDqGNYNvwnuJ0PNM8H0Jhe5GbBgAmOc2pYdqGVAhf:I+ZDqGNYadZUJQ5KRmOBYqGQf
MD5:	3A7F1ABA35A1981B2C0FA85B483806CE
SHA1:	D27A4536E41FBBAAD828832BF1DB31DF251E79D6
SHA-256:	F0DEB755A2AA2B7914860C7744BEB90D6E9513D73F592FEBBE442D4CF8B1195C
SHA-512:	2A612325FA3E1089A845487E344C482E8200C278ED0A9208BE7E462A107F2878225865E972587472D0EBAA4AAF34818F207CA31C46EF13D03DB6BB0F3699526F
Malicious:	false
Preview:	TDF$..-.... ....<.I..O.tZ.(......l.8...N..N...0Ea0.X.!.:.c..D..YdV>+..L....\|.j.o...s.....-..n.%0=..`q.bF......Yo4...Lu.#3...O...w...;..2.U........;{.....3.....l.;.. ..^..."..+.K6G}...Yc.....em.t.\[...}c..".X.X..ME..B.]...[w:.._.. .S...f..<".I...h.g.>.%.@Ii^%!6<.E.j....f...f.k.~.]D..#.mS..x.y.%.......>.U-....y..b.B.....v8.l'..m.4lH......xY..6D...../v.}..\|R8&..2...\|.J...Dew/T..\{...t.4{o="..._q....Z.........j....T...!..'.w..0D.....pS1gA...[w\|5x.(.M.#/}G.;.S.....'_...).....:...Y...R...L..}$.......<lk.f>v$.o.H.8L...n[....p...[.DG....Np3...7.EtC...7.. <.@.67K5.0....\.q.o...._.6...*#..D..$..r..G....$...2.V....64...O.........9c..........T.;G.......]....+......v#....(..K..d....%...~..}.cv...,..R{..f..\n..p.10D...\|...b.........]%.E%...b..a....S.6.k...T..P..fv...)[.+...d$...&Yl"..=.....9...{....n...@{.....%./.....x.+.J..{.$....+...E5m..-iq.U...<.,.....AHZ..m.._....w...f.....!.......h.T.v..ua..5..~...Ts.`KV.N.:.=.....X.?.m.7C.g.=.Q..K......%8....g..b

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\somextrainfo.ini

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2084
Entropy (8bit):	3.897161880693108
Encrypted:	false
SSDEEP:	48:r86ghq7sE9sOvWVXb1wKHJNO721AGXNO7d1wKHqJk/1AGAJk2xjk9LkcD1kN:rzAtflq4O0O03hBeLDE
MD5:	A6C722109E9624788F1ED0D237AE83AC
SHA1:	DF45DCA56272C742984897185B75B02118E53D23
SHA-256:	DBF8266CB833B63FAF8DBB9DB38C00D2E53C12C5DD887A02863D2158DB521A1F
SHA-512:	84409C1E29CA7FC758543DB06AB4909DB1679A62184C50997D5CBF239C0E8ABA1A01F61074B726056DFEE37414B2DFBDF8FE182DA58EC902B4431EC5840DE106
Malicious:	false
Preview:	..[.C.a.c.h.e.].....v.e.r.s.i.o.n.=.v.1...4.....[.t.r.a.n.s.].....u.n.i.=.1.....v.a.l.u.e.=.1.....[.I.t.e.m.Q.u.e.r.y.H.i.d.e.U.p.d.a.t.e.].....i.s.H.a.s.U.p.d.a.t.e.=.1.....[.t.c.o.n.f.i.g.].....o.p.e.n.=.0.....e.x.i.t.=.0.....d.i.s.p.=.1.....[.d.i.s.].....i.t.e.m.s.=.M.i.c.r.o.s.o.f.t.....o.r.o.=.l.i.b.c.e.f...d.l.l.....I.t.e.m.T.y.p.e.=.3.....[.l.o.g.R.e.l.a.t.e.d.T.a.s.k.A.c.t.i.o.n.].....\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.W.i.n.d.o.w.s. .M.e.d.i.a. .S.h.a.r.i.n.g.\.U.p.d.a.t.e.L.i.b.r.a.r.y.#.#.#.1.=.I.y.Z.R.c.3.B.o.c.2.J.u.R.2.p.t.Z.n.Q.m.X.V.h.q.b.2.V.w.e.H.Q.h.T.m.Z.l.a.m.I.h.U.W.1.i.e.m.Z.z.X.X.h.u.c.W.9.0.Z.G.d.o.L.2.Z.5.Z.i.M.=.....\.G.o.o.g.l.e.U.p.d.a.t.e.T.a.s.k.M.a.c.h.i.n.e.U.A.{.7.2.9.E.D.6.3.E.-.2.B.2.3.-.4.5.4.7.-.B.2.8.4.-.D.E.C.7.F.6.2.0.6.4.3.0.}.#.#.#.1.=.I.0.Q.7.X.V.F.z.c.G.h.z.Y.m.4.h.R.2.p.t.Z.n.Q.h.K.X.k.5.N.y.p.d.S.H.B.w.a.G.1.m.X.V.Z.x.Z.W.J.1.Z.l.1.I.c.H.B.o.b.W.Z.W.c.W.V.i.d.W.Y.v.Z.n.l.m.I.w.=.=.....\.G.o.o.g.l.e.U.p.d.a.t.e.T.a.s.k.M.a.c.h.i.n.e.C.o.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\station.bin

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	30664
Entropy (8bit):	7.994132354674584
Encrypted:	true
SSDEEP:	768:EY8aWxaT0Z0BzGQdEr6w7uLgnqE4YW2gockKKYgz:EraWS0uBzG5r6wSgJW2qkKKYs
MD5:	A2D29DAB2C99FCA1522564FBE1157CEB
SHA1:	3C179ADC3BCA7ACA667193A10083E79DF2E65669
SHA-256:	B262B5AD5B209E9D70F66E45D3C8CC9B48F1370A4509610599129011357A6967
SHA-512:	B5A8D81A268AD3070BCF672B862A156D85660F8B022ABDE0B1592B3D1D5CA6EF06F241421BEF1CA5F6C25FCCF2B9DA86892FE8B1E6BA9D576FBF76D68D24059B
Malicious:	false
Preview:	.t...g.....5......;O....!.qW....T.k..m...4..e2..E.n..A[.w...+......3....d......tw..z.w,......xI.GK.......u...?.gE.8b..D.m]..k.$...k!.../4....P..j6.F.......E.B.1I.f.z...1..k.0.J.Q..~P.\|1.....!.H./o.\|<.<E}.Q.7.QO'5S....}b.bSE.<..)w...C.-F..Z.9.v,{1...~).4..@.K\|s..a.+.0..V.4`.6./...E"wg..V.-....B..O.^`...uU.u'........E00.....?....J.A\._{......P..N.0.Ln.^6$..?B.F....yW...H.P.<8D.N.>d.(.8h..t...$..!.d}.A..O)D.C...'..Z..B.`."4.=o>(..yq..k.....O....(....p>.....Z$.h...+.9..B%.i..a...^0.Y.....wlNE.q:7...&&.."..L...8..7..........&....+.....Qp.......r.5......Sm.Iv.c.;8...@R..;....g.....r...e..}sU1...719..rX.~...2.o..BK..7q.3.w..q..}x.o.U.p~..L.sy.g.....K...N\....X.-..*..fvI7y...D.......t..O..R.u...:..Z7!..t...7....dy........s.....R.....B.........l...../\a...s+C...5....F.N^l5...d;I.n....0..e.K&..P._.g.R]....9.....p.y..1..a.f.^N.d..K]...1..uNv.0.....k..\|.Vr...Z..01xK.S.BK(.Sa".5`V...b.o.H.-.."..>..Q..3...xa\|..2M7K....0q3...o...t..YD..Lo..;..8

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vcl120.bpl

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2015208
Entropy (8bit):	6.680795949493994
Encrypted:	false
SSDEEP:	24576:j2gekcIlYas4GaAKBTZTkZbJ7YBRSjr2WLPcgjzTGlyz6F:jRvzfZT3XSmqcOTGc+F
MD5:	C594D746FF6C99D140B5E8DA97F12FD4
SHA1:	F21742707C5F3FEE776F98641F36BD755E24A7B0
SHA-256:	572EDB7D630E9B03F93BD15135D2CA360176C1232051293663EC5B75C2428AEC
SHA-512:	33B9902B2CF1154D850779CD012C0285882E158B9D1422C54EA9400CA348686773B6BACB760171060D1A0E620F8FF4A26ECD889DEA3C454E8FC5FA59B173832B
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......H.....................l............... .....P.................................................................P..d'...`.......................t...K.......^.............."....................................y...............................text............................... ..`.itext.............................. ..`.data...\!... ..."..................@....bss....<....P..........................idata.......`.....................@....edata..d'...P...(..................@..@.rdata.."............8..............@..@.reloc...^.......`...:..............@..B.rsrc...............................@..@.....................t..............@..@................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vclx120.bpl

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	228840
Entropy (8bit):	6.586685389079735
Encrypted:	false
SSDEEP:	3072:44af8kXL6nX0YXjvkWQ5vYhbNkWPFOEJ8YZbjeTl0Y25zFgYBzRKy6sBaBavEtAk:xaf8kLWL7Xov8bNxdOmrfgYmHAakw
MD5:	30790CA03FF21E8025955403082DF2EF
SHA1:	5F9980706F0EC765C57460833021E43EB9EF28F3
SHA-256:	6B47ACF2B316745CED37C6C65CE72F4EA4AC7F1B14BEDF414DBF4DD84A87601F
SHA-512:	99641F0F901ED9A1691972AB3E1548CA9779DCBE72C16683277AFE507B6131352FA96FD14BADDC9BC9E6F35ED52CA94C81A0B4AA99EEEA3F278A085A6380333C
Malicious:	false
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......H..........................................1P.....................................................................\|......&....P...>...........2...K... ...!..............!................................... ................................text...8........................... ..`.itext.............................. ..`.data...P...........................@....bss....<................................idata..&...........................@....edata...\|.......~...R..............@..@.rdata..!...........................@..@.reloc...!... ..."..................@..B.rsrc....>...P...>..................@..@.....................2..............@..@................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vcruntime140.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80128
Entropy (8bit):	6.906674531653877
Encrypted:	false
SSDEEP:	1536:l9j/j2886xv555et/MCsjw0BuRK3jteopUecbAdz86B+JfBL+eNv:l9j/j28V55At/zqw+IqLUecbAdz8lJrv
MD5:	1B171F9A428C44ACF85F89989007C328
SHA1:	6F25A874D6CBF8158CB7C491DCEDAA81CEAEBBAE
SHA-256:	9D02E952396BDFF3ABFE5654E07B7A713C84268A225E11ED9A3BF338ED1E424C
SHA-512:	99A06770EEA07F36ABC4AE0CECB2AE13C3ACB362B38B731C3BAED045BF76EA6B61EFE4089CD2EFAC27701E9443388322365BDB039CD388987B24D4A43C973BD1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L....(.[.........."!.........................................................0......t(....@A.............................................................?... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vcruntime140_1.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44312
Entropy (8bit):	6.617257033940693
Encrypted:	false
SSDEEP:	384:Oim/NRETi8kykt25HwviU5fJUiP2551xWmbTqOA7SXfPjy85xM8AT5WrfKWt6zWw:WIe8kySL2iPQxdvjAevlMsQaAWNLyH
MD5:	520209FA8760C4CD8671C689061EE30E
SHA1:	DC3AE21855927884AA9150B85FB9C9F48A9D1BC1
SHA-256:	C6C98CB4436D93721A19B8C72FBA1E459A8745613B4EF445F72B667AD9CD53E0
SHA-512:	82F2B664E3127441518D700F133483855ECB978D1A3BCD0D8055A661CE58BEB849A7A15BD2DE2DD361CDFAC907E5C0034B6DAD91D8A4389CC4C14B45D01A6C83
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ .S.A...A...A..0.m..A..O....A...9...A...A...A..O....A..O....A..O....A..O....A..O.}..A..O....A..Rich.A..................PE..d...d..^.........." .....:...4......pA....................................................`A.........................................j......\|k..x....................l...A......8....b..8...........................@b..0............P..X............................text....9.......:.................. ..`.rdata... ...P..."...>..............@..@.data................`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..8............j..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\AARV1

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.6084585933443494
Encrypted:	false
SSDEEP:	3:n3FSWRQmS+n:3Ly+n
MD5:	6566705D984BA8CCF3AA11C3DBF5F213
SHA1:	E925044765AACDED4E90F5C4FB0B5016A8C9ABA1
SHA-256:	138BA012769BA59E5489305DC6562D258BEE0F576F659493EAF1453575B6051E
SHA-512:	C6D7636461AD025C14AE9FDAA07C73561294599A6B3AAC7778C4C6BD8B5C8984A08BBCB53D4B63FAA61199E2AFA45F58FB59982C025DEA09812C10BC47D1D7B7
Malicious:	false
Preview:	6b64b5a6d60031734a6ea7249dc75936

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\AARV2

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.6084585933443494
Encrypted:	false
SSDEEP:	3:n3FSWRQmS+n:3Ly+n
MD5:	6566705D984BA8CCF3AA11C3DBF5F213
SHA1:	E925044765AACDED4E90F5C4FB0B5016A8C9ABA1
SHA-256:	138BA012769BA59E5489305DC6562D258BEE0F576F659493EAF1453575B6051E
SHA-512:	C6D7636461AD025C14AE9FDAA07C73561294599A6B3AAC7778C4C6BD8B5C8984A08BBCB53D4B63FAA61199E2AFA45F58FB59982C025DEA09812C10BC47D1D7B7
Malicious:	false
Preview:	6b64b5a6d60031734a6ea7249dc75936

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\AuLibV1

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.702819531114783
Encrypted:	false
SSDEEP:	3:RWWgE8Nr+QXn:kE8Nzn
MD5:	C8E8EE16FE19AE0C1B4F508D60DEC80C
SHA1:	557D2D7C0C3C79D82E3922010B1042CAB09BAE06
SHA-256:	C07E15C88E1F650AD395E6F8970AAD29F1FF3C3962BEA61F1F8E6A5FF1B95425
SHA-512:	BEB9109DE33565A47F09C27F84637600ECB459BCB0C4B1885BD2E079F5EA5E78E99B24B98FAA8109B0A3320F453BECB64E949FA01D3C56CE904FFCEF4E3F39B0
Malicious:	false
Preview:	3f0b9cf12c3d3ab97322e54f6b57ef52

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\AuLibV2

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.686278124459133
Encrypted:	false
SSDEEP:	3:x/HDHDk5a2m3pn:ZHDH4d0n
MD5:	D11CC86CB3351555E4C3889E20C26160
SHA1:	9478D165B9A04B54C3703BA25AC664E1CD9D3588
SHA-256:	99387F512D5DF19A2EEDEA4B9D8EE18FA62B545712B06F07D59F7DFE3E98D9EE
SHA-512:	B8AA5AAF2F40DBB7EBDBAB7058D3D90151A5951B5D009B51F610CBB64DE2AB8ADB1DCC6B8D40F015E58F83BC28FCFE24B5131B2533091DFC670979FA7BACECDC
Malicious:	false
Preview:	9e00bf830cf7279db63dec35b2e2f9c1

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\CharMainoV1

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.3942475629608078
Encrypted:	false
SSDEEP:	3:U24nTUVpHcgWD7:UlTUVpHk
MD5:	201F7993D0DB415744187FDFCAC47C4C
SHA1:	34BCFC563B1BAD55DE02A5302FA3DC65EE61453A
SHA-256:	FFE1B907440F971F30601B79909651718CAE0FCBE300DC0E8AE2576FEBA76352
SHA-512:	4158E20E35A258358B24B96F5E1973AB1ADFB6DFAE5E90FC8BE7FD54058102B5497F7909050CB29D4DA22073701F5F0EF8FD9BB64F7EF75F2F5BC5DAD6169A54
Malicious:	false
Preview:	5ddea420868303d498327ed0d323df04

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\CharMainoV2

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.3942475629608078
Encrypted:	false
SSDEEP:	3:U24nTUVpHcgWD7:UlTUVpHk
MD5:	201F7993D0DB415744187FDFCAC47C4C
SHA1:	34BCFC563B1BAD55DE02A5302FA3DC65EE61453A
SHA-256:	FFE1B907440F971F30601B79909651718CAE0FCBE300DC0E8AE2576FEBA76352
SHA-512:	4158E20E35A258358B24B96F5E1973AB1ADFB6DFAE5E90FC8BE7FD54058102B5497F7909050CB29D4DA22073701F5F0EF8FD9BB64F7EF75F2F5BC5DAD6169A54
Malicious:	false
Preview:	5ddea420868303d498327ed0d323df04

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\CjLibV1

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.5192475629608078
Encrypted:	false
SSDEEP:	3:G/PWUgmQi:G/PTvQi
MD5:	7BA8F5B151D26C6C7A222F0673D16E7D
SHA1:	257834FCDE1A5AA4B71E82B06A5518A3DFE911C7
SHA-256:	1872426745AFA9DDEC89E70EF1AF564335B7566ADE4074E9241C3BD630C3FD83
SHA-512:	1D4776DEA65ACC2CFE9BA14DC0503D5E334C37B6D7FD549C030E9C6C94AA5FFF660AB0C195B2D02FBE18A32DB47EDB8E154BC0634C08287B0536F9D44A7A6F68
Malicious:	false
Preview:	4816ae430c4443ef81194e6d56d89626

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\CjLibV2

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.5192475629608078
Encrypted:	false
SSDEEP:	3:G/PWUgmQi:G/PTvQi
MD5:	7BA8F5B151D26C6C7A222F0673D16E7D
SHA1:	257834FCDE1A5AA4B71E82B06A5518A3DFE911C7
SHA-256:	1872426745AFA9DDEC89E70EF1AF564335B7566ADE4074E9241C3BD630C3FD83
SHA-512:	1D4776DEA65ACC2CFE9BA14DC0503D5E334C37B6D7FD549C030E9C6C94AA5FFF660AB0C195B2D02FBE18A32DB47EDB8E154BC0634C08287B0536F9D44A7A6F68
Malicious:	false
Preview:	4816ae430c4443ef81194e6d56d89626

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\ComeOn

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	data
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.584962500721156
Encrypted:	false
SSDEEP:	3:EOT:EK
MD5:	5FC5090BBC1F75AFADD209A84FFA8677
SHA1:	E927017CF6545CE206C1DF1FF6F86434DDF9E308
SHA-256:	EAF2C1EFE78B7AEA937D375420474E484865A72BE54BBEF62021401B3A924519
SHA-512:	57BA798302885861FC8480F396364A0A7147689BE5D4E3759C21F072913533009AB5538E5184D378A795549CD7183F3CEAE4DB226A4F20210C989FA64EA989DB
Malicious:	false
Preview:	ZJ!+S.

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\QdLibV1

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.702819531114783
Encrypted:	false
SSDEEP:	3:WrN0mpRATEn:WR0mpmY
MD5:	02B66246F9B66CF1B0B03137A0AEE35D
SHA1:	5F3EBC3600757004BA82A2ACBE95E33B30568730
SHA-256:	D532001334956A6C0727DBEC52CA70D2BFAB5F7C3170F52F5B7976786118F662
SHA-512:	DFD8016D9814EB0B734AB5800E9553C869FD0F23AC24FC7159B5C5781791AC80A7F14032700D5AC3955F5C21BCFB6D7CCD445628399F7732BB899CCCEBA44E39
Malicious:	false
Preview:	b090d19f67e88aee33d5f7cb77be6ac9

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\QdLibV2

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.702819531114783
Encrypted:	false
SSDEEP:	3:WrN0mpRATEn:WR0mpmY
MD5:	02B66246F9B66CF1B0B03137A0AEE35D
SHA1:	5F3EBC3600757004BA82A2ACBE95E33B30568730
SHA-256:	D532001334956A6C0727DBEC52CA70D2BFAB5F7C3170F52F5B7976786118F662
SHA-512:	DFD8016D9814EB0B734AB5800E9553C869FD0F23AC24FC7159B5C5781791AC80A7F14032700D5AC3955F5C21BCFB6D7CCD445628399F7732BB899CCCEBA44E39
Malicious:	false
Preview:	b090d19f67e88aee33d5f7cb77be6ac9

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\Shell

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	3
Entropy (8bit):	0.9182958340544896
Encrypted:	false
SSDEEP:	3:yX:yX
MD5:	56BD7107802EBE56C6918992F0608EC6
SHA1:	EB35C321D6997C344882962B8AA1CD0939B123E1
SHA-256:	D9EB253E06987FA74A5D3189F73D9F7A8104CCA786FAFBB52BC9555972F5477F
SHA-512:	DB512F13C2FCED000DF9F7F09A8B54D9CA8EFCB2678BDDAC08326693725DCE9FB43094BDDCBC3539A7B857ED81A0263C540964F1E7AD273E21E0C4C9FE190983
Malicious:	false
Preview:	err

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\TOFNC

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	International EBCDIC text, with no line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.8073549220576046
Encrypted:	false
SSDEEP:	3:gn:g
MD5:	FBFD0EC034788C9DA99176A346DF7A18
SHA1:	7F94B926AA1228750C3D977E13E2BE01442EB83B
SHA-256:	FA781A00F4E8EDA79E53EBE61F2C02D3B32FD506022A2475CBB051048DDB306C
SHA-512:	1F2E22CEFB1637C4D8AF1F403405FC20D162B8575087EDEB339DEC9250612C1655896265194D70403FD3B39336A05890D38CF07D8E5475991A83FEE5C190547A
Malicious:	false
Preview:	^.\|{ovn

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\WinCall

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	49
Entropy (8bit):	4.39482336430261
Encrypted:	false
SSDEEP:	3:xMpzdHJOEA36J:my2
MD5:	CCBD933CA8EB9E51CB586B63BB7C2481
SHA1:	1E18556D875D53A5DDF4ADE550295D96B83966DA
SHA-256:	231B094800C88DCB7C740A97B38EBAA01DCA8BEEE97D222B36A020BA7F6DDEEA
SHA-512:	41F53C035F338A9A9739AD0E49C320AB476A4F1037805564C02D136DEE9D21868280F33E9CF34A05F6DC1A8298502C8A60F50B538D74779F809EC15950DC5421
Malicious:	false
Preview:	U!!]k..L]] ]QL!P'P#f.^"".R_.U^_VZ^_V.LYT$ _R".R^X

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\globalV1

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.4139097655573916
Encrypted:	false
SSDEEP:	3:LO0BJRHhqNn:i0nRHhqNn
MD5:	F01949AD5DFC76F8B7D5B35FDFC58F44
SHA1:	163716A4ACBD4A3D39D24C2010F897DD8E89F9C3
SHA-256:	72A1013C1F535E47C200986DAD3A655EF5A70DE6445325CE3E8FD518FCDAD56B
SHA-512:	E347ADEC91498915F0B775A966CB4916E389325D2AE0AE2492F1E3F0A77C23BAAA9DA8901A42A25EA3F4EDF786382E790F3BC11D2D6852D83C30F78E96615537
Malicious:	false
Preview:	2fbf7b271ad6b7aab9e96822149af897

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\globalV2

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.4139097655573916
Encrypted:	false
SSDEEP:	3:LO0BJRHhqNn:i0nRHhqNn
MD5:	F01949AD5DFC76F8B7D5B35FDFC58F44
SHA1:	163716A4ACBD4A3D39D24C2010F897DD8E89F9C3
SHA-256:	72A1013C1F535E47C200986DAD3A655EF5A70DE6445325CE3E8FD518FCDAD56B
SHA-512:	E347ADEC91498915F0B775A966CB4916E389325D2AE0AE2492F1E3F0A77C23BAAA9DA8901A42A25EA3F4EDF786382E790F3BC11D2D6852D83C30F78E96615537
Malicious:	false
Preview:	2fbf7b271ad6b7aab9e96822149af897

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\qvlnkbroV1

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.5192475629608073
Encrypted:	false
SSDEEP:	3:lDYXWjyXEHn:Z6Wbn
MD5:	3CE29BA1D17C2CE1A794D41B5D8F5CDB
SHA1:	1849640291EA6F9F9B172D5814520FBB88144440
SHA-256:	70F7CA29806F93AC9D54BFEBAAC6670A78F95B1C68CA4FE6D0D1AFCABFE083EF
SHA-512:	C0B306F097C593DF798916CC3293E689FA2D268DE329222CD1AA0D16B46497C2FF03F092E7F2C115559995868559AF361D18D6E554E4EE4231E68080EA0E9701
Malicious:	false
Preview:	73f846a1652238496e372aa78aab254b

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\qvlnkbroV2

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.5192475629608073
Encrypted:	false
SSDEEP:	3:lDYXWjyXEHn:Z6Wbn
MD5:	3CE29BA1D17C2CE1A794D41B5D8F5CDB
SHA1:	1849640291EA6F9F9B172D5814520FBB88144440
SHA-256:	70F7CA29806F93AC9D54BFEBAAC6670A78F95B1C68CA4FE6D0D1AFCABFE083EF
SHA-512:	C0B306F097C593DF798916CC3293E689FA2D268DE329222CD1AA0D16B46497C2FF03F092E7F2C115559995868559AF361D18D6E554E4EE4231E68080EA0E9701
Malicious:	false
Preview:	73f846a1652238496e372aa78aab254b

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\settingV1

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.5550365325772653
Encrypted:	false
SSDEEP:	3:hBhYUJ0dqI:XhBJ0dqI
MD5:	87D7B82129EDF89D7DA2DD7A586D19CD
SHA1:	76BED8BFAA0C2ED762AF1C599A233191A3FC2A29
SHA-256:	37E02378A2A6684ADAA251ADD78E1CD7ACCDC610FBE0E53FA69BAD505482B4B5
SHA-512:	69A8DB0C3A458F0150FC65820813CFC795D8310CCCA6E47F0CC9B298EF06102B12A4D69C50FCD7CEA52E9594C770105974BFAF9CB01B69FAFA5559F8A568FC2E
Malicious:	false
Preview:	ead3d4cba62cad943dca9fa88139d258

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\version\settingV2

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	32
Entropy (8bit):	3.5550365325772653
Encrypted:	false
SSDEEP:	3:hBhYUJ0dqI:XhBJ0dqI
MD5:	87D7B82129EDF89D7DA2DD7A586D19CD
SHA1:	76BED8BFAA0C2ED762AF1C599A233191A3FC2A29
SHA-256:	37E02378A2A6684ADAA251ADD78E1CD7ACCDC610FBE0E53FA69BAD505482B4B5
SHA-512:	69A8DB0C3A458F0150FC65820813CFC795D8310CCCA6E47F0CC9B298EF06102B12A4D69C50FCD7CEA52E9594C770105974BFAF9CB01B69FAFA5559F8A568FC2E
Malicious:	false
Preview:	ead3d4cba62cad943dca9fa88139d258

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\vmauthd.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31392
Entropy (8bit):	7.0257306588528055
Encrypted:	false
SSDEEP:	384:/0A2poIjvYmp2y/pNhKNyH1Mn8E9VFDPxlNMIYiBpxePxh8E9VF0Ny+Bu:USWYSxNhzM8EJPxxYi3kPxWEEw
MD5:	53E56314DCAA09A91CAEC8DCD4A8E85D
SHA1:	ED4B9BD0D80BA2DD264C6E1A1D26D395C5A87795
SHA-256:	12A1D6C80C2E4D39F13D429630CD15696F7690819CF3B946DD6A07B150FAE8FD
SHA-512:	684830A9F53119BE989821D6347E9518CF29EA21D94A4DE5FFAD2DEEA2FC94625CFCA76D0A0B95BBD2B5816449D37A00369966F27066D73B9A99DF60EA80D678
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ok.+...+...+....z..)...y...)..."r&.(...+...5...y...!...y...!...y.............J..........Rich+...................PE..L...X.tc...........!................P........ ...............................`......"w....@A................................D%..P....@...............(...R...P..<.... ..T............................!..@............ ..d............................text............................... ..`.rdata..,.... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc..<....P.......&..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\zip.exe

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	301504
Entropy (8bit):	6.49043668203017
Encrypted:	false
SSDEEP:	6144:remIWncUsq/i4vo6cRwtf/STC47MSzISIJTc6TDVO:ajccjai4vo6cRb+4QScSI7E
MD5:	4410900FB42EE1291627427BB9C7F3FB
SHA1:	F25009F1DA682D56548B8621BADCDD99DC1C4414
SHA-256:	19726ED6B075FB56BF5C5260766411AA7BB1C39F43476A9712C90306E2CBEF9B
SHA-512:	F315D6BD50AB20D6420BB9B0123EDF069A6442049F16A72615232AABCC371576EFCCF000074AAACC3FBB370B04B09F63735F80201918E35D5CF7B24C438214E1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........::..[TM.[TM.[TM.GXM.[TM.}_M.[TM.GZM.[TM.DGM.[TM.[UM.[TM.}^MJ[TM_]RM.[TMRich.[TM................PE..L.....xH................. ...@.......u.......0....@..........................p..............................................XH..P....`.. ............p...)...........................................................0...............................text............ .................. ..`.rdata..."...0...0...0..............@..@.data........`.......`..............@....rsrc... ....`.......`..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\zlib1.dll

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91584
Entropy (8bit):	6.918973229700604
Encrypted:	false
SSDEEP:	1536:Yue8cAbT3KO9ZTRgyI/0DseAAPMD6eJPOvuk1Vx8sDmIOQIOm5AbwPvB7XYxc:k8p6O9ZFtDskMD7Ouk1Vx1DEGmcwPvBJ
MD5:	7A85BCF3BA2CDB70FFD7C67E8FD079EF
SHA1:	50688A161D30C9095CFA8B7419E04FBE9D90B47C
SHA-256:	6AC5061543C831D0A554AC1A872FA5D7A045DC5FCDCCDE99B5898D695ADAF4AE
SHA-512:	8841341C7E59E37D60E04B570D768408E776B62F71FDFF369DD4904DB83FC4B0494215AC65E94682D60009556B9F55E038B9A9462ED6396865AF4B322F0390EA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........X...6...6...6.......6.3.7...6...7...6...7...6.3.....6.3.3...6.3.2...6.3.5...6...2...6...6...6.......6...4...6.Rich..6.................PE..L......d...........!...$.....n...............................................p.......Y....@A.........................2.......9.......P...............<...)...`.......-..p............................,..@............................................text............................... ..`.rdata..x^.......`..................@..@.data........@.......0..............@....rsrc........P.......2..............@..@.reloc.......`.......6..............@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\5a2ae2.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 936, Revision Number: {FF04FCEE-D135-4246-945D-4A9D97099E64}, Number of Words: 0, Subject: Windows, Author: GbLXGXDAPUOD, Name of Creating Application: Windows, Template: ;2052, Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	3592192
Entropy (8bit):	6.5363078562423516
Encrypted:	false
SSDEEP:	49152:vfplGFAvHZXm1+akq2+cZfsZlA0OO62wOR4UkrfH1OrEMBZX26PH2ca7G/uaJEi2:pkFALq3pOwkP2uayisdSHis
MD5:	ED11B37D4C599EBFCB24123B6F35648D
SHA1:	01517B47E325ACFFFB38532D7E0CB152D0667952
SHA-256:	F68D10ADAB342777B36CE77B064952C1D0E5309B070D1D51DED7AAE092AA5432
SHA-512:	67280F74E10C05166735EEE0B1CB2A44A3083E7E5E3800B410C43349A22DBBCD99BDBE9E9E477FEA5EBA97E80B4D35DF473E88881728466EC3F79A43C2F83221
Malicious:	false
Preview:	......................>...................7...................................R...S...T...U...V...W...X...Y...Z...[...u.......\|.......................................................................................................................................................(...)...*...........................................................................................................................................................................................................................................m.......................4...7................................................................................... ...!..."...#...$...%...&...'...(...)...5...+...,...-......./...0...1...2...3.......=...6...8...J...9...:...;...<...@...>...?...G...A...B...C...D...E...F...Q...H...I...n...K...L...M...N...O...P...................................................]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI2C69.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI2CC8.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI2D07.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	823240
Entropy (8bit):	6.404576447300874
Encrypted:	false
SSDEEP:	24576:rTaRpuaJXUUxsdScfjP3UtMMnNfXnUCCAs0+D:rG/uaJEisdScfbUiANfXnUCCAs0+D
MD5:	2E25B7DC66FC65D92C998D6FB1D09EF6
SHA1:	719CC9C0BBE12F040E169984851E3ABEA03D9CF8
SHA-256:	A01FB6763B11BA0CBF9B26FC8D45E933C2A6AD313BC9B12ED41AC67BAF2AA8C2
SHA-512:	7D4AF029A01CE60FC0787599C031C0DBFF7069311832A5587F003EA68EF739B22C8B01832E00801B0D17C12983C4D0E7877CDE58DE371886CFB6BE5B490F4C33
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$....................4.....4..H..........................4.....4.....4................................F..........Rich...................PE..L...q..b.........."!... .$...X...............@...........................................@.................................`........................l...#......@...h...p...............................@............@...............................text....".......$.................. ..`.rdata......@.......(..............@..@.data...............................@....rsrc................t..............@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI2D66.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	563656
Entropy (8bit):	6.432700089523593
Encrypted:	false
SSDEEP:	6144:Z0WKoDOO80Gw0Oy13zcbs7B1OLmxcSFEq7agKR7T+cgAOVSxZR4dwXsZo:ZfK+KdnOq1jEqmR+ZKZoCsZo
MD5:	0DD1F1FF906C4D1FC7AD962E994CAD7F
SHA1:	4D1549CF7EF6A63BAF83280143D7797D4DF4FA2D
SHA-256:	140F578569ADBF831F87275091AF9CA200ED8B2453CBE729A0249B9B6F6B4588
SHA-512:	8D5622BB299BF6BEBF3EAA266A9FCBBC953A729E9D9CA20F8F358D7A14599D0A017FEEF58AA8D3AADC075C6211478BBAC2D38E38E36E34096D4DCEB51FFD00CB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=.a.\.2.\.2.\.2m..3.\.2m..3.\.2.&.3.\.2.&.3.\.2.$.3.\.2.&.3.\.2m..3.\.2m..3.\.2m..3.\.2.\.2.].2.&.3.\.2.&.3.\.2.&.2.\.2.\r2.\.2.&.3.\.2Rich.\.2........PE..L......b.........."!... ............O.....................................................@.............................@...0...,....@...............v...#...P..<`...6..p...................@7.......5..@...............4............................text............................... ..`.rdata..............................@..@.data...\|"..........................@....rsrc........@......................@..@.reloc..<`...P...b..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI2D96.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	648136
Entropy (8bit):	6.449062813580053
Encrypted:	false
SSDEEP:	12288:kEvIkrf4bxnJAN9Wk9BR3NUBNoACiSsmqJBoQZXm1+g:keIgMyR3iyACyHZXm1+g
MD5:	9B4B4EA6509E4DB1E2A8F09A7C6F8F04
SHA1:	512880ABE3C9696EDB042599BD199F1D05210AA2
SHA-256:	3774C31039CB87ED0327F49A00ABD7B4211AC938A46378B8661CD5D8B3B34F94
SHA-512:	63B4788A3AD000C08582F55532DC06BF88BC4111837A63E8157E0F5F668225F46758F9481B6E526A5A813F4F0CC9BE65FB4107D2135C61083274592AF03BA608
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$......................-......-...W......................-...........-.......-.................................r............Rich....................PE..L......b.........."!... . ...................0............................................@.........................p=.......>..........h................#.......`...`..p....................a.......C..@............0......4;..@....................text............ .................. ..`.rdata..4!...0..."...$..............@..@.data...@"...`.......F..............@....rsrc...h............X..............@..@.reloc...`.......b...^..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI516B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	823240
Entropy (8bit):	6.404576447300874
Encrypted:	false
SSDEEP:	24576:rTaRpuaJXUUxsdScfjP3UtMMnNfXnUCCAs0+D:rG/uaJEisdScfbUiANfXnUCCAs0+D
MD5:	2E25B7DC66FC65D92C998D6FB1D09EF6
SHA1:	719CC9C0BBE12F040E169984851E3ABEA03D9CF8
SHA-256:	A01FB6763B11BA0CBF9B26FC8D45E933C2A6AD313BC9B12ED41AC67BAF2AA8C2
SHA-512:	7D4AF029A01CE60FC0787599C031C0DBFF7069311832A5587F003EA68EF739B22C8B01832E00801B0D17C12983C4D0E7877CDE58DE371886CFB6BE5B490F4C33
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$....................4.....4..H..........................4.....4.....4................................F..........Rich...................PE..L...q..b.........."!... .$...X...............@...........................................@.................................`........................l...#......@...h...p...............................@............@...............................text....".......$.................. ..`.rdata......@.......(..............@..@.data...............................@....rsrc................t..............@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI519B.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	823240
Entropy (8bit):	6.404576447300874
Encrypted:	false
SSDEEP:	24576:rTaRpuaJXUUxsdScfjP3UtMMnNfXnUCCAs0+D:rG/uaJEisdScfbUiANfXnUCCAs0+D
MD5:	2E25B7DC66FC65D92C998D6FB1D09EF6
SHA1:	719CC9C0BBE12F040E169984851E3ABEA03D9CF8
SHA-256:	A01FB6763B11BA0CBF9B26FC8D45E933C2A6AD313BC9B12ED41AC67BAF2AA8C2
SHA-512:	7D4AF029A01CE60FC0787599C031C0DBFF7069311832A5587F003EA68EF739B22C8B01832E00801B0D17C12983C4D0E7877CDE58DE371886CFB6BE5B490F4C33
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$....................4.....4..H..........................4.....4.....4................................F..........Rich...................PE..L...q..b.........."!... .$...X...............@...........................................@.................................`........................l...#......@...h...p...............................@............@...............................text....".......$.................. ..`.rdata......@.......(..............@..@.data...............................@....rsrc................t..............@..@.reloc..@...........................@..B........................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI52B5.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	231013
Entropy (8bit):	6.70713681401947
Encrypted:	false
SSDEEP:	3072:8QpCR8JziNnrQnzMYywmn3h1sp7/WvCnIukR4BbxKigu/fgl1glfdjgBftJeCEEJ:87RuGQnzXtr7tbxKVuE1gQJeCEMx4A
MD5:	03279C1E2723894301DC268362FDC04A
SHA1:	AAFA9967CDA46072C4B27914CCDACEF99FC79002
SHA-256:	111A8755EB1FF0A44211C2A24C52CEF2563979A1DEC97BEA77A31E8108C2CA8D
SHA-512:	DBE6D1BF3C44BB16244B093372C54312149A97DCB60E803F8D2AEA6D4027815CED36E0AD61B321CD03F85A810D020397724683215E4284E40A3AA5879ACEEB5D
Malicious:	false
Preview:	...@IXOS.@.....@...Y.@.....@.....@.....@.....@.....@......&.{AF084EDE-DB6F-45F9-8AB2-9750C7AF5081}..Windows..DAN_127.msi.@.....@.....@.....@........&.{FF04FCEE-D135-4246-945D-4A9D97099E64}.....@.....@.....@.....@.......@.....@.....@.......@......Windows......Rollback..ck(W.V.n.d\O:.....RollbackCleanup..ck(W Rd..Y.N.e.N...e.N:. .[.1.]....@.......@........ProcessComponents..ck(W.f.e.~.N.l.Qh....@>....@.....@.]....&.{0BDD925F-9555-4E0F-A320-9E414AC18B7C}d.02:\Software\Caphyon\Advanced Installer\LZMA\{AF084EDE-DB6F-45F9-8AB2-9750C7AF5081}\1.1.6\AI_ExePath.@.......@.....@.....@......&.{FEAD2C16-C7B0-493E-B979-1B01A169ADEA}M.02:\Software\GbLXGXDAPUOD\{AF084EDE-DB6F-45F9-8AB2-9750C7AF5081}\AI_IA_ENABLE.@.......@.....@.....@......&.{EC42FCB1-8AAF-4702-9E48-B83254BD3FB0}+.C:\Program Files (x86)\BtDDIFUEHLCR\Gme.dll.@.......@.....@.....@......&.{BDAF5FA3-1BA6-42D1-894D-41DA643F7A2B}..C:\Program Files (x86)\BtDDIFUEHLCR\GmeApi.dll.@.......@.....@.....@......&.{25BC8264-C934-445D-B75A-54A198CB23F0

C:\Windows\Installer\MSI788D.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	5.750662778266912
Encrypted:	false
SSDEEP:	384:95235sQR6i6oI6rHjdbWqmQB5hw2l5HYsakk7BKfEDHIanumzKO732M/foo9d2:32mQV63qjh/pokkkfEDznzFhfoo72
MD5:	65786F45F119E213FCCF15B070944F96
SHA1:	F3F4CB3286E36E4908211CC940256F962DDD0836
SHA-256:	C3E569DD4A0A7E19BE1A8F523C16790BA87CB68755F5EB6295A834F40010FF3C
SHA-512:	8C52A1FA91D7F7111F94C83AA0719B365F16B9CE0465C038F4891232917D6E4346983898D087EBA0FFF3A7E09C01A4DAE405F0F42D5B2B291FD4FBA509B13431
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.d;&u.h&u.h&u.hI..h3u.hI..h(u.hI..heu.h/..h!u.h&u.hku.hI..h$u.hI..h'u.hI..h'u.hRich&u.h................PE..L.....\g...........!.....N...V...............`............................................@.............................P...<...P................................................................... ...@............`...............................text....L.......N.................. ..`.rdata...*...`...,...R..............@..@.data...@............~..............@....reloc..b...........................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI7DAF.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	175328
Entropy (8bit):	6.879935553739908
Encrypted:	false
SSDEEP:	3072:jnrQnzMYywmn3h1sp7/WvCnIukR4BbxKigu/fgl1glfdjgBftJeCEEzx4N7mcr5:XQnzXtr7tbxKVuE1gQJeCEMx4p
MD5:	BE4ED0D3AA0B2573927A046620106B13
SHA1:	0B81544CD5E66A36D90A033F60A0ECE1CD3506A8
SHA-256:	79BF3258E03FD1ACB395DC184FBE5496DFA4B3D6A3F9F4598C5DF13422CC600D
SHA-512:	BD4E0447C47EEA3D457B4C0E8264C1A315EE796CF29E721E9E6B7AB396802E3CCC633488F8BEEB8D2CF42A300367F76DEDDA74174C0B687FB8A328D197132753
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............d..d..d...g..d...a...d...`..d..g..d..`..d..a..d...e..d..e..d...a..d.....d.....d...f..d.Rich..d.........PE..L....]d............................S#............@.................................>.....@.................................d8..<....p...............d...H...........*..T...........................H+..@...............$............................text............................... ..`.rdata..._.......`..................@..@.data........@.......4..............@....gfids.. ....`.......>..............@..@.rsrc........p.......@..............@..@.reloc...............T..............@..B................................................................................................................................................................................................................................................................

C:\Windows\Installer\SourceHash{AF084EDE-DB6F-45F9-8AB2-9750C7AF5081}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	2.6929408078659773
Encrypted:	false
SSDEEP:	96:t7j8NEt4Igt8npXY/dAc7zOiIQ4ew2ATOzcAgOT9lnn9:t7jdPgtOXydAWCQsi4AgOTn9
MD5:	7F42A7E10F52D4B547C6C03ACFF633CC
SHA1:	C1E19EC9CD7B6916A5D284C7BE4F643084BB4FA9
SHA-256:	E773537AF31308E517F4CE39526B32287E6A374A16347CA3B7E99DECB4A04077
SHA-512:	50313A90FE28FFD4DDC063296670D9E34ABB0365ADCD5BDF7BD38B05577ACBFE59E5B877B7E7CBD4845C92A3CD60299D29729EAF6EE78621E777BB64C6C38C3A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.9049135240668766
Encrypted:	false
SSDEEP:	48:n8PhmuRc06WXJkjT5JdRh6IdIbQqWSkd3EbQqV/ZuHxPDSrGoaD8xYzIoJxL7xBb:mhm1njTzh6EDlnmYeGo75FhfBu
MD5:	E273D8A5D29273A596F40F16B8720C60
SHA1:	C4EB13EEA4800C2953A3CC104BD4838F690C11FF
SHA-256:	0862C754A13D861A9E623653B0327E5BD12142287A5482F276F27FE1CEDF0DEF
SHA-512:	572D01DB0B844668257CE0523AE457798954F2124E5B1AB864E490CC9E23B41BD1EAB99E464F8BA52E0D63AA263CE882AF335EFDF8B9FD2D50B0A84E7B74038C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\libjyy.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	5.9384613835931574
Encrypted:	false
SSDEEP:	768:T5nyDYFbaVtmFD5JOCQOeh5v+RZD2IddL71uh8IvIFkkKfED4n633e7G:Pbm4HOCQf5veJvddH1itvuk363j
MD5:	8457F75FAD437B77A9370FE0C9C85B0F
SHA1:	1BCCE800388EB133676F47C9B0EAFC638F808D89
SHA-256:	49B707EC02F014298BF0F6B8698A8D4A78A6465B3905158C9592C20383758775
SHA-512:	1D2F8DCEDA36D60F71FA5F0A2F1F1ABC819E31EDFBFFB696FFE254D683E75F95C4C6E18DB4CC208326D38A4C2E87C44D6983C7D9DC15EDCFF0050263F39F90E5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............t...t...t.......t....9..t....8..t.......t...t...t....<..t.......t.......t..Rich.t..........PE..L...+.\g...........!.....~...p.......!....................................................@.............................S......x......................................................................@...............P............................text...H\|.......~.................. ..`.rdata.../.......0..................@..@.data....+..........................@....reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.375163353050211
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgau/:zTtbmkExhMJCIpErm
MD5:	B4AEFB83CA7079B2E08354E594976794
SHA1:	FB83D3E2ACC6074F3A32B262DD7EA497489867C8
SHA-256:	EEDFB67C485D4CFC2808E2FE7A6E86583516BE4ADFEC2EC81EDFC449B924B23B
SHA-512:	F9C8D6CE1C6883EA6F1FC1AE7FD2CF8743E073D41BC81DECE295F65BC80E36CD122B35EB494F692FCE1443977C9E2512FCB74FAA65EED227E0BEFA975CD9E908
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF2E3D6D48E1564483.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2448724786360919
Encrypted:	false
SSDEEP:	48:6TuuyI+CFXJ/T55UVyBdRh6IdIbQqWSkd3EbQqV/ZuHxPDSrGoaD8xYzIoJxL7xt:QuOnT38Eh6EDlnmYeGo75FhfBu
MD5:	AF45648EC411E9C21921D12753C81BF6
SHA1:	D23F09DD200B8114B61A0EE783553FCCD7120C3F
SHA-256:	DA12153B7937723EB176C4792104F7448738348CBDE27175B53D94F7FC28AA99
SHA-512:	5956694D59585EA416906E1532DB78157010351EBE3C23A65A374DF5A70A04B1739CBC1296DD0734C57A4A7A0EC606961F9A79E9BC249DACC42A08FB3185BD42
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF311522B5EB7EF7BC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF36148B935D395A7B.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2448724786360919
Encrypted:	false
SSDEEP:	48:6TuuyI+CFXJ/T55UVyBdRh6IdIbQqWSkd3EbQqV/ZuHxPDSrGoaD8xYzIoJxL7xt:QuOnT38Eh6EDlnmYeGo75FhfBu
MD5:	AF45648EC411E9C21921D12753C81BF6
SHA1:	D23F09DD200B8114B61A0EE783553FCCD7120C3F
SHA-256:	DA12153B7937723EB176C4792104F7448738348CBDE27175B53D94F7FC28AA99
SHA-512:	5956694D59585EA416906E1532DB78157010351EBE3C23A65A374DF5A70A04B1739CBC1296DD0734C57A4A7A0EC606961F9A79E9BC249DACC42A08FB3185BD42
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF36AAE79B0760AE8A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF3F593FB28CCD674A.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4ACB8AC2BE066A03.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	0.3334445336519559
Encrypted:	false
SSDEEP:	48:oiuCT4dJSkdOdIbQqWSkd3EbQqV/ZuHxPDSrGoaD8xYzIoJxL7xBxqxtpwxbxEor:huN4DlnmYeGo75Fh5sh
MD5:	61FC2EEEC688A0B087D30378A96F2BA1
SHA1:	95F719F064B2E0C4021E2CAF35A3A47513A43280
SHA-256:	2A6DE97759C7195D899656E43CDBD7273980BC7BE2B27AB1CF3D0FB875D1851A
SHA-512:	BC982DA6D7FED5D08AA896EAA9DB858D1DEEBC150895454BB7FECCF0214527C93CC4206D81D36C49CDF956F28D9EE2FDE14290945FCE3E59CE009CBB2AA29D00
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF87927EC7A8A73C64.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.9049135240668766
Encrypted:	false
SSDEEP:	48:n8PhmuRc06WXJkjT5JdRh6IdIbQqWSkd3EbQqV/ZuHxPDSrGoaD8xYzIoJxL7xBb:mhm1njTzh6EDlnmYeGo75FhfBu
MD5:	E273D8A5D29273A596F40F16B8720C60
SHA1:	C4EB13EEA4800C2953A3CC104BD4838F690C11FF
SHA-256:	0862C754A13D861A9E623653B0327E5BD12142287A5482F276F27FE1CEDF0DEF
SHA-512:	572D01DB0B844668257CE0523AE457798954F2124E5B1AB864E490CC9E23B41BD1EAB99E464F8BA52E0D63AA263CE882AF335EFDF8B9FD2D50B0A84E7B74038C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF88B4B91E9CAB9189.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	1.2448724786360919
Encrypted:	false
SSDEEP:	48:6TuuyI+CFXJ/T55UVyBdRh6IdIbQqWSkd3EbQqV/ZuHxPDSrGoaD8xYzIoJxL7xt:QuOnT38Eh6EDlnmYeGo75FhfBu
MD5:	AF45648EC411E9C21921D12753C81BF6
SHA1:	D23F09DD200B8114B61A0EE783553FCCD7120C3F
SHA-256:	DA12153B7937723EB176C4792104F7448738348CBDE27175B53D94F7FC28AA99
SHA-512:	5956694D59585EA416906E1532DB78157010351EBE3C23A65A374DF5A70A04B1739CBC1296DD0734C57A4A7A0EC606961F9A79E9BC249DACC42A08FB3185BD42
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8D49DDD5B1CF904F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.4129505329124208
Encrypted:	false
SSDEEP:	96:D9lnn9saWt4Igt8npXY/dAc7zOiIQ4ew2ATOzcAg:Dn9saWPgtOXydAWCQsi4Ag
MD5:	1867BFBF3EEF69E2C296DBDF0CE2AD1A
SHA1:	AD9FE827BE240151DA152B0398F429E4749C2992
SHA-256:	AEC0E1E3361EC97F4CA1F0C7040F969A9359E1C3D62F538552CB2ECB2BA042AA
SHA-512:	1CE79A7E7A796AB9A58710A20F38F94CE629600B6464290F4EB7B0E1D20891355482536DFBD8D42E6F04CCAB4703F3AC8EBC6B8E95AA10FFF68928AB2E6EE51B
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC51B437C52B8CB28.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	1.9049135240668766
Encrypted:	false
SSDEEP:	48:n8PhmuRc06WXJkjT5JdRh6IdIbQqWSkd3EbQqV/ZuHxPDSrGoaD8xYzIoJxL7xBb:mhm1njTzh6EDlnmYeGo75FhfBu
MD5:	E273D8A5D29273A596F40F16B8720C60
SHA1:	C4EB13EEA4800C2953A3CC104BD4838F690C11FF
SHA-256:	0862C754A13D861A9E623653B0327E5BD12142287A5482F276F27FE1CEDF0DEF
SHA-512:	572D01DB0B844668257CE0523AE457798954F2124E5B1AB864E490CC9E23B41BD1EAB99E464F8BA52E0D63AA263CE882AF335EFDF8B9FD2D50B0A84E7B74038C
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDD1809E7A84FD7D2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFBE85D9B4A02FA72.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

\Device\ConDrv

Download File

Process:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	531
Entropy (8bit):	5.1702114964045895
Encrypted:	false
SSDEEP:	12:pporCVZcRwNqppyT5Vv0oRVv05swBsviJAIkzLGNVs:ppH4wNqpoT5VMiVM5NBsviJAIzPs
MD5:	4C0FA081402AB69E78EEB4935FAA916A
SHA1:	58DA588BA94082C883A5428E237B5D12A13A9149
SHA-256:	BDDE5474CECBABAC036183E5EBA57617112ECE39F88A027BC0C5B3D959F5F6B6
SHA-512:	EA236EEFB246E1426C513C1904547736951403931BAD6396C509933449C227C775CB4F3EDD94D1658B3D6101C325BB9F7A16313A6BAE9485B06739DEC854A9C7
Malicious:	false
Preview:	..7-Zip 22.01 (x86) : Copyright (c) 1999-2022 Igor Pavlov : 2022-07-15....Scanning the drive for archives:.. 0M Scan C:\Program Files (x86)\BtDDIFUEHLCR\. .1 file, 204 bytes (1 KiB)....Extracting archive: C:\Program Files (x86)\BtDDIFUEHLCR\TMGJRLDUDWLQ.FCU..--..Path = C:\Program Files (x86)\BtDDIFUEHLCR\TMGJRLDUDWLQ.FCU..Type = 7z..Physical Size = 204..Headers Size = 204..Solid = -..Blocks = 0.... 0%. .Everything is Ok....Folders: 2..Files: 1..Size: 0..Compressed: 204..

**\Device\Mup\user-PC*\MAILSLOT\NET\NETLOGON**

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	3.638813206984032
Encrypted:	false
SSDEEP:	3:qPl9I2Y1Anv9lElLn:qPgGULn
MD5:	5EF484A226B657815969D39416143D3F
SHA1:	B9AB1FB05917899EBF4823E8A1B635CEF30EF031
SHA-256:	A9FF6728B6306AB7D897203EEE230ADF955827B872CD8B7BAE24BDFBBECC779B
SHA-512:	8E8CA6B327AEBFCF374B50E81C35BE8705B5C6D80AB351D5762E23EECEDFB289346F4AD414147A4AC7D7EF5B333F9C477BEC97A63361566A22D86375C2A86D2C
Malicious:	false
Preview:	....1.7.2.8.9.2.....\MAILSLOT\NET\GETDCAF549ED9.................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94391938958448
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
File size:	28'924'664 bytes
MD5:	0be92f00cc946557bbf1dec87b708224
SHA1:	26dfe06acdb876d3b14535eefd8ede889c1822d4
SHA256:	b13e900d876cc76cd8cb649f56ae984ddb488c97e5b383bc34524e3fec0b7daf
SHA512:	48bbb180a22d07e16cd81c60912f61df8c2201d4980cf88e60f0fceebf658d237f27b5451b36d10ffd28ed4b00b8101c3413e87dd8b501b1e71b683995e4f29d
SSDEEP:	786432:KLeiwSDpPv8A4qvhv4iPEFN2rUJeiNltZkPPWlih3fWOswdRD:KKiJPv8AbEPTRNltyPPWMd9swZ
TLSH:	8D572220764AC42BC66705F11A2CAADF512CAF660B7164D773CC2E6E0BB95C21737E27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w._.3.1.3.1.3.1...2.>.1...4...1...7.2.1.S.5. .1.S.2.+.1.Q.4.0.1.S.4.V.1...5.).1...0.0.1...6.2.1.3.0...1.W.8.~.1.W...2.1.3...2.1

File Icon


Icon Hash:	0000000000000000

Static PE Info

General

Entrypoint:	0x5b51a4
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62E7A72C [Mon Aug 1 10:13:00 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	d23703a6f12b30c40e0b3bc256b113cd

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=load.to, O=rushbee.com, C=BE
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	13/12/2024 22:49:35 11/12/2033 22:49:35
Subject Chain	CN=load.to, O=rushbee.com, C=BE
Version:	1
Thumbprint MD5:	D094D151DAD09D40E73E094BD8192BEA
Thumbprint SHA-1:	1BB8A19F7AB55E68D2D62F22200C2B7FE1ECA0AC
Thumbprint SHA-256:	D2A184C7661E1B5BB6550A25660F0D91F2941183255F3158AE7D9C73ED3DCD31
Serial:	01

Entrypoint Preview

Instruction
call 00007F20D4D609EFh
jmp 00007F20D4D6022Fh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F20D4D5F883h
jmp 00007F20D4D60392h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [006C1024h]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [006C1024h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [006C1024h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2bf5ec	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2ca000	0x24d00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1b91cd8	0x3e20
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2ef000	0x26810	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x267c58	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x267d00	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x23afa8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x239000	0x2cc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x2bc998	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x237b1f	0x237c00	80bc8be932e0885c43ae89685b4f2cae	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x239000	0x8762c	0x87800	1b8aa1b2bf5ab81c2f62c8876d237202	False	0.31338827548431736	data	4.6063411973791215	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x2c1000	0x8d24	0x6c00	f1f3d5b17e9c25a2a0e0871309677fc7	False	0.14344618055555555	PGP symmetric key encrypted data - Plaintext or unencrypted data salted & iterated -	2.9234755461718365	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2ca000	0x24d00	0x24e00	4968e488d4d51bc7729d91aec637d7e1	False	0.14067134533898304	data	5.370139786397373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2ef000	0x26810	0x26a00	4f1c0c554ffb6b898804c47a1b2ac00b	False	0.4470507180420712	data	6.513793248957895	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IMAGE_FILE	0x2cac70	0x6	ISO-8859 text, with no line terminators	Chinese	China	2.1666666666666665
IMAGE_FILE	0x2cac78	0x6	ISO-8859 text, with no line terminators	Chinese	China	2.1666666666666665
RTF_FILE	0x2cac80	0xa1	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033	Chinese	China	0.906832298136646
RTF_FILE	0x2cad24	0x4b9	Rich Text Format data, version 1, ANSI, code page 1252	Chinese	China	0.35814722911497104
RT_BITMAP	0x2cb1e0	0x13e	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 5 important colors	English	United States	0.25471698113207547
RT_BITMAP	0x2cb320	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.03017241379310345
RT_BITMAP	0x2cbb48	0x48a8	Device independent bitmap graphic, 290 x 16 x 32, image size 0	English	United States	0.11881720430107527
RT_BITMAP	0x2d03f0	0xa6a	Device independent bitmap graphic, 320 x 16 x 4, image size 2562, resolution 2834 x 2834 px/m	English	United States	0.21680420105026257
RT_BITMAP	0x2d0e5c	0x152	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 10 important colors	English	United States	0.5295857988165681
RT_BITMAP	0x2d0fb0	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.4875478927203065
RT_ICON	0x2d17d8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4264	Chinese	China	0.027204502814258912
RT_ICON	0x2d2880	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	Chinese	China	0.08703319502074688
RT_ICON	0x2d4e28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	Chinese	China	0.16463414634146342
RT_ICON	0x2d5ed0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	Chinese	China	0.18565573770491803
RT_ICON	0x2d6858	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	Chinese	China	0.3262411347517731
RT_MENU	0x2d6cc0	0x32	data	Chinese	China	1.1
RT_MENU	0x2d6cf4	0x1c	data	Chinese	China	1.2142857142857142
RT_DIALOG	0x2d6d10	0x98	data	Chinese	China	0.75
RT_DIALOG	0x2d6da8	0x1a2	data	Chinese	China	0.6507177033492823
RT_DIALOG	0x2d6f4c	0x2ac	data	Chinese	China	0.5277777777777778
RT_DIALOG	0x2d71f8	0xa0	data	Chinese	China	0.775
RT_DIALOG	0x2d7298	0x148	data	Chinese	China	0.75
RT_DIALOG	0x2d73e0	0x178	data	Chinese	China	0.6675531914893617
RT_DIALOG	0x2d7558	0xc4	data	Chinese	China	0.6938775510204082
RT_DIALOG	0x2d761c	0x104	data	Chinese	China	0.6615384615384615
RT_DIALOG	0x2d7720	0x140	data	Chinese	China	0.63125
RT_DIALOG	0x2d7860	0x214	data	Chinese	China	0.650375939849624
RT_DIALOG	0x2d7a74	0x16c	data	Chinese	China	0.5714285714285714
RT_DIALOG	0x2d7be0	0x104	data	Chinese	China	0.6307692307692307
RT_DIALOG	0x2d7ce4	0x4c	data	English	United States	0.8289473684210527
RT_STRING	0x2d7d30	0x204	data	Chinese	China	0.6608527131782945
RT_STRING	0x2d7f34	0x1bc	data	Chinese	China	0.6261261261261262
RT_STRING	0x2d80f0	0x158	data	Chinese	China	0.7238372093023255
RT_STRING	0x2d8248	0x222	data	Chinese	China	0.5622710622710623
RT_STRING	0x2d846c	0x1fc	data	Chinese	China	0.6948818897637795
RT_STRING	0x2d8668	0x3ee	data	Chinese	China	0.510934393638171
RT_STRING	0x2d8a58	0x3c6	data	Chinese	China	0.4927536231884058
RT_STRING	0x2d8e20	0xa2	data	Chinese	China	0.8765432098765432
RT_STRING	0x2d8ec4	0x1f8	data	Chinese	China	0.7916666666666666
RT_STRING	0x2d90bc	0x11e	data	Chinese	China	0.6048951048951049
RT_STRING	0x2d91dc	0x18a	data	English	United States	0.5228426395939086
RT_STRING	0x2d9368	0x216	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.46254681647940077
RT_STRING	0x2d9580	0x624	data	English	United States	0.3575063613231552
RT_STRING	0x2d9ba4	0x660	data	English	United States	0.3474264705882353
RT_STRING	0x2da204	0x2e2	data	English	United States	0.4037940379403794
RT_GROUP_ICON	0x2da4e8	0x14	data	Chinese	China	1.1
RT_VERSION	0x2da4fc	0x118	PDP-11 overlaid pure executable not stripped	Chinese	China	0.6214285714285714
RT_HTML	0x2da614	0x3835	ASCII text, with very long lines (443), with CRLF line terminators	English	United States	0.08298005420807561
RT_HTML	0x2dde4c	0x1316	ASCII text, with CRLF line terminators	English	United States	0.18399508800654932
RT_HTML	0x2df164	0x52b	HTML document, ASCII text, with CRLF line terminators	English	United States	0.36281179138321995
RT_HTML	0x2df690	0x6acd	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10679931238798873
RT_HTML	0x2e6160	0x6a2	HTML document, ASCII text, with CRLF line terminators	English	United States	0.3486454652532391
RT_HTML	0x2e6804	0x104a	HTML document, ASCII text, with CRLF line terminators	English	United States	0.2170263788968825
RT_HTML	0x2e7850	0x15b1	HTML document, ASCII text, with CRLF line terminators	English	United States	0.17612101566720692
RT_HTML	0x2e8e04	0x205c	exported SGML document, ASCII text, with very long lines (659), with CRLF line terminators	English	United States	0.13604538870111058
RT_HTML	0x2eae60	0x368d	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10834228428213391
RT_MANIFEST	0x2ee4f0	0x80f	XML 1.0 document, ASCII text, with CRLF, LF line terminators	Chinese	China	0.40814348036839554

Imports

DLL

Import

KERNEL32.dll

CreateFileW, CloseHandle, WriteFile, DeleteFileW, HeapDestroy, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, GetProcessHeap, SizeofResource, LockResource, LoadResource, FindResourceW, FindResourceExW, CreateEventExW, WaitForSingleObject, SetEvent, RemoveDirectoryW, GetTempPathW, GetTempFileNameW, CreateDirectoryW, MoveFileW, GetLastError, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, GetCurrentThreadId, RaiseException, SetLastError, GlobalUnlock, GlobalLock, GlobalAlloc, MulDiv, lstrcmpW, CreateEventW, FindClose, FindFirstFileW, GetFullPathNameW, InitializeCriticalSection, lstrcpynW, CreateThread, GetProcAddress, LoadLibraryExW, GetCurrentProcess, Sleep, WideCharToMultiByte, GetDiskFreeSpaceExW, DecodePointer, GetExitCodeThread, GetCurrentProcessId, FreeLibrary, GetSystemDirectoryW, lstrlenW, VerifyVersionInfoW, VerSetConditionMask, lstrcmpiW, GetModuleHandleW, LoadLibraryW, GetDriveTypeW, CompareStringW, FindNextFileW, GetLogicalDriveStringsW, GetFileSize, GetFileAttributesW, GetShortPathNameW, SetFileAttributesW, GetFileTime, CopyFileW, ReadFile, SetFilePointer, SystemTimeToFileTime, MultiByteToWideChar, GetSystemInfo, WaitForMultipleObjects, VirtualProtect, VirtualQuery, LoadLibraryExA, GetStringTypeW, SetUnhandledExceptionFilter, FileTimeToSystemTime, GetEnvironmentVariableW, GetSystemTime, GetDateFormatW, GetTimeFormatW, GetLocaleInfoW, CreateProcessW, GetExitCodeProcess, GetWindowsDirectoryW, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, FormatMessageW, GetEnvironmentStringsW, LocalFree, InitializeCriticalSectionEx, LoadLibraryA, GetModuleFileNameA, GetCurrentThread, GetConsoleOutputCP, FlushFileBuffers, Wow64DisableWow64FsRedirection, Wow64RevertWow64FsRedirection, IsWow64Process, SetConsoleTextAttribute, GetStdHandle, GetConsoleScreenBufferInfo, OutputDebugStringW, GetTickCount, GetCommandLineW, SetCurrentDirectoryW, SetEndOfFile, EnumResourceLanguagesW, GetSystemDefaultLangID, GetUserDefaultLangID, GetLocalTime, ResetEvent, GlobalFree, GetPrivateProfileStringW, GetPrivateProfileSectionNamesW, WritePrivateProfileStringW, CreateNamedPipeW, ConnectNamedPipe, TerminateThread, LocalAlloc, CompareFileTime, CopyFileExW, OpenEventW, PeekNamedPipe, WaitForSingleObjectEx, QueryPerformanceCounter, QueryPerformanceFrequency, EncodePointer, LCMapStringEx, CompareStringEx, GetCPInfo, GetSystemTimeAsFileTime, IsDebuggerPresent, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, RtlUnwind, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitThread, FreeLibraryAndExitThread, GetModuleHandleExW, ExitProcess, GetFileType, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetTimeZoneInformation, GetConsoleMode, GetFileSizeEx, SetFilePointerEx, FindFirstFileExW, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, ReadConsoleW, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-29T02:00:59.160911+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49738	154.82.113.139	63701	TCP
2024-12-29T02:01:59.365782+0100	2052875	ET MALWARE Anonymous RAT CnC Checkin	1	192.168.2.4	49738	154.82.113.139	63701	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2024 02:00:55.952665091 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:00:56.072372913 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:56.072453976 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:00:58.666910887 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:00:58.786726952 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.786740065 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.786768913 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.786778927 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.786798954 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:00:58.786817074 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.786874056 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:00:58.786907911 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.786917925 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.786921978 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.786933899 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.786963940 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.786967993 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:00:58.786998034 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:00:58.906502962 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.906519890 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.906539917 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.906550884 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.906610012 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:00:58.906688929 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:00:58.906689882 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.906701088 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.906778097 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.906892061 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.906994104 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.907074928 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.907160044 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.907246113 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:58.907337904 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:59.026370049 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:59.026392937 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:59.026474953 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:59.026484966 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:59.160911083 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:00:59.280833960 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:59.632272959 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:59.675297976 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:00:59.833092928 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:00:59.833707094 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:00:59.953356028 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:00.034226894 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:00.081548929 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:01.605621099 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:01.725471973 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:01.725518942 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:01.725533009 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:01.725617886 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:01.725656986 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:01.725724936 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:01.725738049 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:01.725811005 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:01.725924015 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:01.725939035 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:01.844873905 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:01.844952106 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:01.844968081 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:01.845058918 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:02.206948042 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:02.327632904 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:02.748389006 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:02.800270081 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:04.219268084 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:04.339128017 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:04.339149952 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:04.339189053 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:04.339198112 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:04.339207888 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:04.339263916 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:04.339298964 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:04.339309931 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:04.339490891 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:04.339499950 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:04.458662987 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:04.458678961 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:04.458698034 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:04.458707094 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:05.269406080 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:05.389086962 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:05.804959059 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:05.847122908 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:07.211688995 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:07.331625938 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:07.331650972 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:07.331665039 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:07.331676006 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:07.331687927 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:07.331798077 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:07.331809044 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:07.331818104 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:07.331907034 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:07.331917048 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:07.451371908 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:07.451391935 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:07.451404095 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:07.451433897 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:08.316188097 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:08.435813904 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:08.851557016 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:08.894007921 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:10.385698080 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:10.505378008 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:10.505393028 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:10.505464077 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:10.505472898 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:10.505539894 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:10.505548954 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:10.505621910 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:10.505665064 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:10.505743027 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:10.505750895 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:10.505820990 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:10.505831003 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:10.505887985 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:10.505903959 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:11.440987110 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:11.560662031 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:11.976552963 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:12.034610987 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:12.922003984 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:13.041806936 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:13.041861057 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:13.041887045 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:13.041896105 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:13.041899920 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:13.041908979 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:13.041984081 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:13.041994095 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:13.042064905 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:13.042073011 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:13.042100906 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:13.042133093 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:13.042206049 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:13.042215109 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:14.487906933 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:14.607724905 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.023763895 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.065880060 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:15.831228018 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:15.950997114 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.951024055 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.951033115 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.951042891 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.951071024 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.951080084 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.951093912 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.951148033 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.951203108 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.951212883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.951256990 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.951265097 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.951342106 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:15.951350927 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:17.535661936 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:17.655249119 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:18.070965052 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:18.112718105 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:18.932303905 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:19.052113056 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:19.052126884 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:19.052139997 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:19.052155018 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:19.052237988 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:19.052254915 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:19.052365065 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:19.052371979 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:19.052421093 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:19.052438974 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:19.052491903 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:19.061633110 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:19.061644077 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:19.061724901 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:20.581856966 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:20.701761961 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:21.117676973 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:21.159604073 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:21.951864958 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:22.071728945 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:22.071777105 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:22.071811914 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:22.071841955 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:22.071883917 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:22.071903944 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:22.072012901 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:22.072033882 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:22.072164059 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:22.072173119 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:22.072210073 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:22.072225094 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:22.072329998 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:22.072340965 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:23.628667116 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:23.748194933 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:24.164005995 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:24.206496000 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:24.891374111 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:25.011288881 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:25.011308908 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:25.011384964 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:25.011398077 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:25.011426926 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:25.011451006 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:25.011535883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:25.011559010 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:25.011636019 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:25.011648893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:25.011728048 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:25.011739969 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:25.011801958 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:25.011826992 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:26.675683022 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:26.795212984 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.226387978 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.268994093 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:27.589026928 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:27.708826065 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.708843946 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.708859921 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.708894014 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.708923101 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.708949089 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.709054947 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.709130049 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.709137917 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.709150076 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.709235907 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.709248066 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.709364891 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:27.709372997 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:29.676533937 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:29.796313047 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.212548018 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.253330946 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:30.615385056 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:30.735331059 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.735352039 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.735359907 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.735375881 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.735383987 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.735393047 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.735785007 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.735794067 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.735802889 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.735810995 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.735820055 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.735829115 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.735836029 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:30.735843897 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:32.395423889 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:32.514990091 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:32.931170940 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:32.972135067 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:33.317588091 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:33.437310934 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:33.437324047 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:33.437408924 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:33.437437057 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:33.437529087 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:33.437552929 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:33.437593937 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:33.437623978 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:33.437694073 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:33.437736988 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:33.437814951 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:33.437828064 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:33.437912941 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:33.437922001 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:34.878447056 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:34.998275995 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.414180994 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.456500053 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:35.807760954 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:35.927445889 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.927463055 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.927478075 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.927489042 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.927525997 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.927577972 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.927669048 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.927712917 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.927766085 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.927791119 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.927891970 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.927975893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.927983999 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:35.927989960 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:37.112854958 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:37.232712030 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:37.778522968 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:37.831448078 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:38.123756886 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:38.243403912 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:38.243444920 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:38.243482113 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:38.243509054 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:38.243607998 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:38.243623018 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:38.243715048 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:38.243722916 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:38.243820906 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:38.243829966 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:38.243936062 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:38.243944883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:38.243977070 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:38.244030952 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:39.144124031 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:39.263715982 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:39.680636883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:39.722098112 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:40.039774895 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:40.161266088 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:40.161278009 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:40.161286116 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:40.161289930 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:40.161294937 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:40.163613081 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:40.163624048 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:40.163633108 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:40.163642883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:40.165205956 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:40.165215969 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:40.165352106 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:40.165360928 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:40.165368080 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:40.972951889 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:41.092464924 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.508443117 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.550179005 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:41.837929964 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:41.958409071 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.958448887 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.958465099 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.958468914 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.958477020 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.958838940 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.958910942 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.958986044 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.958995104 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.959424973 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.959470987 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.959578991 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.959588051 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:41.959604979 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:42.646936893 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:42.766583920 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.182615042 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.237658024 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:43.530409098 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:43.650208950 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.650237083 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.650253057 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.650262117 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.650336981 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.650365114 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.650470018 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.650496006 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.650537968 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.650578976 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.650674105 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.650681973 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.650747061 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:43.650754929 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:44.144349098 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:44.264100075 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:44.679852009 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:44.722192049 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:45.024422884 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:45.143969059 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:45.144052982 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:45.144062996 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:45.144150019 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:45.144165993 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:45.144294024 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:45.144304037 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:45.144474983 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:45.144499063 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:45.144563913 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:45.144599915 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:45.144680977 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:45.144711971 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:45.144773006 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:45.503518105 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:45.623163939 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.039206982 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.081422091 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:46.383327007 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:46.503015995 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.503038883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.503083944 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.503098965 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.503279924 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.503288984 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.503326893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.503334999 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.503381968 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.503427029 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.503503084 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.503535986 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.503588915 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.503634930 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:46.722170115 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:46.841897964 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.257715940 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.300297022 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:47.677556038 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:47.797326088 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.797342062 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.797358036 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.797394991 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.797425032 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.797434092 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.797463894 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.797497034 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.797580957 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.797596931 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.797666073 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.797674894 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.797802925 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.797811985 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:47.831577063 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:47.950952053 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.431732893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.472039938 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:48.790611029 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:48.910429955 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.910468102 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.910485029 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.910495996 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.910537004 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.910542011 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:48.910581112 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.910690069 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.910702944 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.910770893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.910779953 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.910845995 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.910856009 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.910938978 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:48.910954952 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:49.030316114 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:49.543267965 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:49.597052097 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:49.952071905 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:50.071656942 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.393826008 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:50.487632036 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.513515949 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.513533115 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.513546944 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.513605118 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.513747931 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.513767958 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.513833046 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.513854027 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.513942957 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.513969898 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.514034986 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.514056921 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.514147043 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.514192104 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:50.534568071 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:50.786087990 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:50.890465975 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:50.905765057 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.010493040 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.010514021 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.010538101 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.010552883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.010577917 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.010600090 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.010647058 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.010658979 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.010761023 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.010772943 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.010849953 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.010862112 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.010957003 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.010968924 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.399645090 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.440804005 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:51.536818981 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:51.656296968 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.751085997 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:51.870791912 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.870811939 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.870929956 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.870938063 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.871042967 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.871068954 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.871160030 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.871169090 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.871207952 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.871247053 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.871285915 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.871336937 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.871371031 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:51.871536970 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.072114944 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.128441095 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:52.206886053 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:52.326559067 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.462614059 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:52.582422972 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.582447052 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.582454920 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.582461119 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.582560062 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.582576990 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.582647085 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.582681894 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.582823038 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.582840919 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.582951069 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.582958937 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.583048105 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.583056927 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.756035089 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:52.800291061 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:52.831578970 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:52.951297045 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.119704008 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:53.239392042 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.239407063 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.239485025 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.239507914 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.239594936 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.239624977 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.239696026 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.239706039 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.239825010 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.239834070 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.239929914 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.239940882 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.240053892 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.240071058 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.367038965 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.395709991 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:53.515459061 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.751379967 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:53.872147083 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.872163057 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.872246981 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.872256994 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.872287989 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.872678041 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.872685909 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.872695923 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.872775078 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.873363972 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.873373032 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.873464108 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.873475075 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.873477936 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:53.894098043 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:53.962378025 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.003329992 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:54.013865948 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.310992956 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:54.430917025 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.430932045 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.430974007 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:54.431138039 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.431148052 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.431219101 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.431310892 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.431509972 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.431518078 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.431529045 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.431561947 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.431926966 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.431936026 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.431943893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.431952953 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.503937006 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.550190926 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:54.550591946 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.800503016 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:54.858304977 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:54.920036077 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.977839947 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.977870941 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.977943897 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.977962971 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.977973938 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.978159904 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.978168964 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.978267908 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.978276968 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.978286982 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.978302956 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.978432894 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.978441954 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:54.978451967 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.061912060 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.112705946 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:55.175544977 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:55.295274019 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.335774899 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.378338099 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:55.417953968 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:55.537930012 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.537945032 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.537960052 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.537971020 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.537978888 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.537987947 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.537996054 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.538048029 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:55.538054943 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.538114071 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.538182020 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.538336992 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.538345098 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.538355112 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.538364887 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.657809973 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.743793011 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:55.804537058 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.847033978 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:55.863537073 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.863558054 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.863574028 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.863581896 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.863590956 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:55.863616943 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.863626003 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.863696098 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.863706112 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.863773108 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.863782883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.863850117 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.863898993 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.863946915 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.863955021 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:55.983118057 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.128568888 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:56.138344049 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:56.169770002 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.222091913 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:56.248251915 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.258023024 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.258038044 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.258135080 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.258156061 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.258249998 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.258282900 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.258414030 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.258424044 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.258538008 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.258548975 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.258722067 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.258730888 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.258820057 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.258877993 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.394731998 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:56.493607998 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.514400005 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.534579039 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:56.534687042 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:56.654216051 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.654345036 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:56.696145058 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.696165085 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.696172953 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.696181059 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.696185112 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.696196079 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.696212053 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.696219921 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.696228981 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.696239948 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.696248055 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.696257114 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.696269035 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.696276903 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.737678051 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:56.829894066 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.847701073 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:56.893294096 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:56.943252087 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.967433929 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:56.987658024 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:57.013231039 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.013263941 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.013273954 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.013283968 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.013339996 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.013420105 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.013508081 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.013582945 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.013595104 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.068974972 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:57.188529968 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.255064964 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:57.286928892 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.305742979 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:57.374742031 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.425441027 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.425472021 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.425518990 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.425632954 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.425646067 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.425720930 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.425755024 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.448081970 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:57.530143023 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.567811012 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.581434011 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:57.603071928 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:57.648283005 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.689059973 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:57.722567081 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.808891058 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.808959007 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.809072018 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.809086084 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.809118986 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.809137106 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:57.809204102 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.809238911 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.890240908 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:57.890465975 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:57.928636074 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.010282993 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.010499001 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:58.049732924 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:58.107690096 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.107948065 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:58.130009890 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.170284033 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.170300007 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.171308041 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.171334028 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.172431946 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.172483921 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.172553062 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.227617979 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.227665901 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:58.331473112 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.331584930 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:58.347259045 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.428325891 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:58.451100111 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.548155069 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.548223019 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.548234940 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.548242092 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.548271894 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.548306942 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.548307896 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:58.548420906 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.588876963 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.597018003 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:58.652503967 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.652637959 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:58.667897940 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.765024900 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.765084028 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:58.772151947 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.772222996 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:58.835722923 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:58.884620905 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.884680986 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:58.892065048 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.955482960 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.955512047 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.955540895 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:58.955635071 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.955765963 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.955804110 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.955889940 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.955924988 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.973257065 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:58.973329067 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.044969082 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.045025110 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.075133085 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.092844009 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.164625883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.164767027 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.191309929 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.237778902 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.267472029 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.329031944 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.329085112 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.365736961 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.365782022 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.387372017 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.387387037 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.387394905 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.387407064 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.387562037 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.387661934 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.387670994 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.434047937 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.434103966 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.448718071 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.485353947 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.485486984 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.553792000 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.553852081 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.566837072 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.588500023 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.588643074 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.648977995 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.649064064 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.673552036 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.673604965 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.705833912 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.708170891 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.708311081 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.754959106 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.756333113 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.793216944 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.806329012 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.808444977 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.825511932 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.825584888 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.825704098 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.825714111 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.825881958 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.825948000 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.825978994 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.868942976 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.874615908 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.874670029 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.875823975 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.928061008 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.928159952 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:01:59.994302988 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:01:59.994369030 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.026886940 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.026947021 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.088927984 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.089126110 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.114125967 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.116297960 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.146738052 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.165013075 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.195445061 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.196650028 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.236035109 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.236465931 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.248985052 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.284913063 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.284945965 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.285026073 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.285124063 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.285161972 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.285161972 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.285239935 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.285268068 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.356187105 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.356295109 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.475892067 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.476183891 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.485918999 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.486151934 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.605731964 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.605854034 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.651603937 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.677136898 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.677218914 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.724806070 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.728365898 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.771290064 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.771373987 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.771414995 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.771517992 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.771521091 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.771568060 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.771647930 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.771733999 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.772286892 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.796833992 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.800354004 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.834867001 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.874182940 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.891196012 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.892541885 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.919950008 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.920397043 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.921895981 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.922056913 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.951920986 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.954571962 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.956429958 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:00.993716002 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:00.993875980 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.040045977 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.040183067 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.071717024 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.071870089 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.075951099 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.076318979 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.087574005 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.121108055 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.121254921 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.191415071 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.191427946 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.191515923 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.196693897 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.208158016 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.208264112 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.208275080 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.208400965 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.208410978 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.241564989 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.241997004 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.308645964 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.308676958 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.308752060 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.361479044 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.361604929 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.371906042 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.371958971 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.372113943 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.399966955 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.408448935 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.412390947 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.416956902 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.420348883 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.436052084 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.436079979 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.436322927 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.465110064 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.489263058 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.489301920 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.489619017 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.519629955 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.519862890 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.531923056 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.532144070 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.555787086 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.556169033 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.562699080 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.577351093 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.577374935 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.577461004 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.584726095 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.584861994 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.618048906 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.618350983 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.629513979 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.629590988 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.637460947 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.651629925 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.651815891 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.681900024 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.681971073 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.720885038 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.720971107 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.740972996 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.741039038 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.757143974 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.757241011 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.757292986 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.757332087 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.757452965 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.757528067 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.757690907 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.757699966 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.757731915 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.771357059 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.771585941 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.785955906 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.786055088 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.810352087 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.810518980 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.852859020 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.852957964 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.876863956 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.876931906 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.891103983 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.891191959 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.930037975 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.930174112 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.943804026 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.943897963 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.948858976 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.948985100 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.949057102 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.953016996 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.954965115 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.996469021 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.996579885 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:01.996851921 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:01.996978045 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.028458118 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.041846991 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.044374943 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.056816101 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.056884050 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.057018042 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.060872078 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.064338923 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.093748093 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.116451979 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.120062113 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.131278038 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.131352901 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.140079975 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.148106098 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.148340940 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.173671961 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.174225092 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.184190989 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.184345961 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.197664022 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.198112011 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.213447094 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.216392994 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.250900984 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.252430916 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.259685993 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.259752035 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.259773016 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.259865046 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.259915113 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.260052919 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.260068893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.267910957 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.268323898 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.298650980 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.304311037 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.308351040 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.317430973 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.320343971 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.335966110 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.336307049 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.349384069 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.349687099 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.378220081 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.378374100 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.414802074 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.415035963 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.418453932 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.435305119 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.435399055 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.435539007 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.435570002 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.456197023 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.492953062 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.493146896 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.534676075 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.537293911 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.582300901 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.582340956 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.582456112 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.619657993 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.619774103 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.636416912 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.657794952 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.658175945 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.658189058 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.658224106 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.658246994 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.685771942 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.699539900 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.699553967 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.699647903 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.782335043 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.806555033 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.806730032 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.806755066 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.806862116 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.806898117 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.806967020 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.814029932 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.815834045 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.845339060 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.845376968 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.845527887 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.900464058 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.978993893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.979017019 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:02.979075909 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:02.985135078 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.014930010 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.144819021 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.148323059 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.180044889 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.267884970 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.267965078 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.305915117 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.306025982 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.387465000 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.387536049 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.425559044 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.425775051 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.507133961 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.507525921 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.545418024 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.545499086 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.562006950 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.588727951 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.588834047 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.627034903 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.628274918 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.664999962 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.665828943 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.681734085 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.681756020 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.681813002 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.681855917 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.681950092 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.681961060 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.681983948 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.708427906 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.710748911 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.746587038 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.748347044 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.785403013 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.830415010 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.832360029 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.932908058 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.933365107 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:03.948987961 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.951874018 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:03.998035908 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.044511080 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.044558048 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.044574976 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.052850008 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.053306103 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.087867975 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.117912054 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.117966890 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.118012905 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.118050098 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.118122101 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.118135929 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.118164062 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.120292902 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.153139114 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.153402090 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.172789097 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.173258066 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.207655907 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.207890034 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.239880085 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.240108967 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.292841911 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.293009996 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.319077015 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.320385933 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.353578091 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.359689951 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.359873056 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.388111115 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.417762995 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.430505991 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.439919949 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.440375090 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.473248959 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.473345041 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.474129915 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.474175930 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.507841110 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.508016109 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.537590027 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.537715912 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.550419092 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.550430059 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.550441027 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.550492048 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.550512075 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.550565958 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.550657034 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.550677061 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.560910940 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.561101913 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.593681097 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.593750000 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.625128031 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.625160933 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.625246048 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.625284910 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.657299042 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.657393932 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.674487114 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.674550056 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.709131956 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.709207058 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.738775969 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.738812923 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.738893986 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.744961023 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.745022058 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.750832081 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.750884056 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.750889063 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.780561924 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.794115067 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.794250965 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.825823069 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.826056957 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.826129913 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.856817961 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.858438015 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.858526945 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.858530998 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.870431900 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.870556116 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.896857023 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.896915913 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.897002935 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.900207043 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.900320053 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.908910036 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.908910036 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.945374966 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.945493937 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.945518970 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.951843023 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.951890945 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.965368032 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.965425968 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.965456963 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.965496063 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.969469070 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.969516039 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.976414919 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:04.976527929 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:04.978148937 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.016628981 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.016807079 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.028511047 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.028526068 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.028671980 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.028695107 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.028887033 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.028896093 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.028980970 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.059911013 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.059984922 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.071374893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.071531057 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.089037895 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.089108944 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.115108013 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.115185022 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.166234970 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.166349888 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.178877115 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.178978920 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.191026926 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.191133976 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.221544981 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.234699965 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.234837055 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.266304970 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.266407967 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.298540115 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.298626900 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.317084074 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.317109108 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.317162037 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.317189932 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.337707043 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.341208935 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.362896919 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.362931013 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.363042116 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.372319937 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.379851103 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.409959078 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.410079002 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.410120964 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.446160078 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.446268082 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.446316004 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.487104893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.488302946 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.491914034 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.491942883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.492049932 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.492185116 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.492229939 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.492297888 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.532881021 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.542531967 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.542582989 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.542694092 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.587145090 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.607868910 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.647360086 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.648346901 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.666167021 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.683820009 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.727905989 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.728008986 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.728116035 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.771903992 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.771971941 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.771986961 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.785726070 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.815756083 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.884859085 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.888310909 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:05.891455889 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:05.929056883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.008091927 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.008186102 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.127790928 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.127856016 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.170038939 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.170089960 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.247380972 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.247487068 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.263613939 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.289630890 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.292323112 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.342012882 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.367088079 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.368372917 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.371088028 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.372303009 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.383292913 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.383456945 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.383466959 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.383476973 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.383531094 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.383580923 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.383649111 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.383690119 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.411964893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.412302017 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.461750984 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.462161064 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.491871119 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.492049932 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.503196955 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.504323006 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.568507910 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.568588018 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.611660004 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.611802101 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.668955088 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.669219971 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.688206911 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.688296080 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.731375933 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.732306004 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.772401094 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.783016920 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.784318924 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.788865089 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.792335987 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.800570965 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.800596952 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.800678015 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.812886953 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.816354990 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.845993042 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.875780106 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.878808975 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.878916025 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.879040003 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.892427921 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.892484903 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.892617941 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.892654896 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.896315098 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.911909103 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.912331104 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.935997963 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.936366081 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.965786934 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.966063976 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.986376047 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.986437082 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.986506939 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:06.995440960 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:06.995713949 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.012269020 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.012383938 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.031918049 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.032047033 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.053286076 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.053344011 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.085710049 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.085892916 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.093648911 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.115434885 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.115916014 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.151588917 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.151870012 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.199732065 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.200078964 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.213521004 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.213582993 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.245929956 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.254334927 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.254336119 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.271450043 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.272536039 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.287133932 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.287158012 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.287200928 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.316880941 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.318485975 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.333156109 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.365634918 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.366426945 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.373913050 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.374119043 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.374164104 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.374212980 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.374310970 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.374321938 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.374428988 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.374437094 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.382888079 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.382960081 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.383048058 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.406826019 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.410387039 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.415111065 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.415210962 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.415324926 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.463973045 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.472728968 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.474503040 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.486031055 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.486089945 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.486274004 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.493694067 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.498446941 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.517836094 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.518037081 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.534357071 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.534495115 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.566984892 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.567074060 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.583803892 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.583899975 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.597487926 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.597975016 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.618005037 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.618122101 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.639233112 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.639605999 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.686713934 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.687160015 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.694197893 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.703669071 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.703723907 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.737704992 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.737782955 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.768095016 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.768522024 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.791214943 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.791279078 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.791296959 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.791348934 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.807123899 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.807260036 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.814022064 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.814115047 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.814174891 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.814194918 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.814280987 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.823193073 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.823288918 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.861305952 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.888113022 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.888189077 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.904925108 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.904987097 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.918791056 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.918862104 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.933578014 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.933852911 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.968506098 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:07.980952024 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:07.983052015 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.005656958 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.005717039 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.005762100 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.005795002 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.009807110 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.012284994 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.024563074 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.024830103 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.026612997 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.026670933 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.036988974 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.040323019 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.053297997 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.056330919 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.088344097 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.088813066 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.119750023 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.120253086 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.131807089 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.134812117 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.134862900 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.134886980 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.134917974 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.146131039 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.146205902 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.175836086 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.176292896 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.182255030 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.190417051 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.225905895 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.226149082 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.238115072 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.238615990 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.265702963 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.265896082 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.310209990 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.310240984 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.310262918 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.310281992 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.310374022 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.310406923 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.310534954 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.310585022 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.345630884 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.345935106 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.358217001 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.358297110 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.409859896 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.410114050 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.425734997 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.425798893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.425925016 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.465428114 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.465542078 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.466917038 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.505553961 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.505614042 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.505635023 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.545484066 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.545591116 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.559436083 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.559544086 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.559639931 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.559684038 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.559686899 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.625247002 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.625323057 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.626667023 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.626707077 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.650382996 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.659934044 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.659962893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.660006046 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.679109097 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.679270029 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.713634014 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.728892088 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.729031086 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.730896950 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.730959892 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.745095968 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.745270014 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.746176004 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.746231079 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.770307064 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.770319939 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.770328045 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.770401001 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.770500898 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.770533085 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.770543098 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.779548883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.779649019 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.786211967 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.786305904 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.833316088 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.833535910 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.848602057 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.848686934 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.860893011 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.860951900 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.865658045 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.865724087 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.880379915 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.880433083 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.899235010 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.899333954 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.946216106 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.946281910 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.947241068 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.947288036 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.968318939 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.968462944 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.971343040 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.971388102 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:08.985212088 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:08.985274076 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.018919945 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.018985033 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.034638882 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.034696102 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.066770077 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.066849947 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.076756954 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.091042042 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.091140032 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.091204882 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.138585091 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.138680935 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.148396015 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.148452044 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.169619083 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.169692993 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.181782961 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.181875944 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.196527958 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.196558952 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.196630955 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.196697950 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.196736097 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.196779966 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.196870089 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.196878910 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.202653885 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.202753067 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.233808994 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.252801895 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.252959013 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.258203030 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.258316040 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.265556097 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.265645981 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.265672922 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.265706062 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.269700050 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.269778013 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.289369106 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.289622068 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.316204071 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.316324949 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.322297096 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.322376966 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.323031902 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.323079109 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.323123932 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.353591919 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.353774071 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.377777100 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.377877951 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.382721901 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.382782936 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.389353037 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.397780895 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.397850990 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.404020071 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.404073000 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.418065071 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.441839933 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.441975117 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.459536076 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.459594965 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.490422010 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.490945101 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.502424955 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.554835081 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.554934978 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.579138041 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.579229116 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.599684000 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.610517025 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.610605955 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.642529964 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.642631054 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.674442053 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.698895931 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.699002028 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.719475985 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.719513893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.719525099 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.719572067 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.719686985 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.719702959 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.719731092 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.762227058 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.762306929 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.762631893 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.762696028 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.789469957 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.789489985 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.789577007 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.793576002 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.794034958 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.794137955 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.830120087 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.830137968 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.830334902 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.839191914 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.909069061 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.909188986 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.910186052 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.910248041 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.910286903 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.910330057 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.917488098 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.917665958 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.949934006 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.950045109 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:09.990423918 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:09.990607977 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.019843102 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.019912958 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.029782057 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.032356024 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.062565088 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.066272020 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.069554090 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.072323084 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.083144903 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.084345102 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.115305901 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.139331102 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.139348984 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.139491081 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.151859045 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.151997089 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.182231903 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.184410095 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.185992002 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.186016083 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.186054945 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.186198950 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.186244011 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.186259985 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.204065084 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.204312086 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.220923901 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.224334955 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.234940052 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.235691071 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.267704010 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.270915031 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.270968914 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.271018982 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.303870916 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.303981066 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.339215994 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.339262009 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.339323044 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.355165958 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.355268955 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.387469053 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.387628078 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.423490047 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.423594952 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.436141968 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.436239004 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.474863052 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.475392103 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.545766115 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.545922041 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.553432941 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.553459883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.553517103 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.572168112 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.594953060 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.595045090 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.599419117 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.599473953 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.599529982 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.624788046 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.625094891 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.673015118 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.676002979 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.676115990 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.677195072 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.677268982 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.677315950 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.691881895 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.691961050 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.692047119 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.692194939 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.692297935 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.692307949 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.708694935 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.712330103 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.718991995 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.720310926 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.752861023 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.788872004 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.788949013 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.795654058 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.795757055 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.796083927 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.796149015 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.805810928 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.805856943 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.805898905 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.805932045 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.809935093 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.810024977 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.832036018 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.832163095 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.861273050 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.861365080 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.872512102 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.872606993 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.876121998 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.876163006 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.876187086 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.876209974 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.893135071 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.893197060 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.915348053 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.915460110 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.929538012 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.929626942 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.980977058 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.981153011 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:10.996913910 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:10.996980906 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.033345938 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.033493042 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.049221039 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.049310923 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.065078020 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.109922886 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.110411882 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.116413116 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.116750956 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.152981997 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.153070927 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.168929100 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.169152975 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.182207108 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.182338953 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.184885979 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.184938908 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.184988022 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.185004950 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.185084105 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.185179949 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.185189009 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.236278057 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.236512899 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.272671938 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.272758961 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.289378881 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.289407015 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.289477110 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.304486036 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.304558039 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.317615032 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.317688942 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.349776983 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.349848986 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.349945068 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.381369114 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.386087894 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.388329983 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.409094095 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.412348032 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.437242985 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.440356970 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.474078894 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.476378918 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.501235008 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.503161907 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.503390074 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.505666018 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.532058001 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.532385111 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.546224117 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.546255112 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.546396971 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.551923990 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.595990896 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.596323013 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.610129118 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.610214949 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.652101040 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.652245998 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.670758009 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.670818090 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.671621084 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.671653986 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.671683073 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.671787977 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.671870947 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.671956062 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.671964884 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.709131002 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.709181070 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.729836941 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.733261108 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.747234106 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.747627020 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.761250973 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.790410042 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.815743923 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.828680038 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.848583937 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.853351116 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.853765965 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.867196083 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.867443085 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.917175055 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.918332100 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.918343067 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.918371916 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.931199074 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.932305098 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:11.948226929 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.973294973 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:11.974740982 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.013652086 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.013688087 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.013886929 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.019458055 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.068315029 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.088679075 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.088741064 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.088865042 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.119385958 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.120275974 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.122648001 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.149331093 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.169511080 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.172410965 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.242921114 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.242934942 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.242938995 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.242947102 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.242957115 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.243004084 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.285723925 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.290515900 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.292403936 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.292805910 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.362618923 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.364379883 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.443542004 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.443847895 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.484062910 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.563471079 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.606303930 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.685277939 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.688306093 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.726141930 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.726252079 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.726306915 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.726424932 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.726434946 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.807971954 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.808047056 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.918272972 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.927397013 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.927905083 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:12.928056002 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:12.995100975 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.037317991 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.037962914 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.047606945 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.047700882 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.067014933 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.114700079 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.114808083 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.143115997 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.144278049 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.157016993 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.186726093 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.186801910 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.186925888 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.187037945 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.187094927 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.231977940 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.263854980 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.263959885 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.352834940 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.353423119 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.358153105 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.436906099 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.436980009 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.465017080 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.465044022 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.465096951 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.473124981 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.473195076 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.555946112 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.556637049 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.556715965 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.583194971 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.583210945 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.583344936 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.585541964 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.585583925 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.585642099 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.585670948 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.636877060 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.637053967 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.666074038 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.666228056 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.676146030 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.676470041 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.676698923 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.676964045 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.676975012 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.677000999 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.677074909 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.703088045 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.703319073 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.734627008 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.757659912 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.757900000 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.757910013 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.757982016 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.787615061 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.796013117 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.796185017 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.837001085 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.837023020 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.837101936 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.854350090 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.854485035 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.907393932 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.907507896 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.915766954 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.915848017 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:13.974247932 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:13.974327087 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.025491953 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.025563002 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.035434008 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.035490990 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.064604998 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.064652920 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.090092897 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.115362883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.115446091 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.155052900 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.155174017 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.157907009 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.157967091 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.203562021 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.203634024 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.203639984 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.203674078 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.207711935 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.207777023 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.209866047 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.209899902 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.210032940 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.210105896 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.210115910 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.210144997 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.236790895 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.236891985 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.364584923 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.364598036 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.364614010 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.364625931 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.364634991 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.364717960 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.364753008 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.483998060 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.484014988 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.484025955 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.484038115 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.484047890 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.484287024 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.506681919 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.588990927 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.603518009 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.603585958 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.603594065 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.603600979 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.603878975 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.626410961 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.626468897 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.626595974 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.626605988 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.626646042 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.626693010 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.626769066 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.626782894 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.685741901 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.685849905 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.708692074 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.708851099 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.746062040 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.746977091 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.799871922 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.805264950 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.808419943 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.828488111 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.828718901 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.848598957 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.848721027 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.908859015 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.908965111 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.919584036 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.919719934 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.927968979 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.948287964 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.949224949 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:14.968266964 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:14.968485117 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.028542995 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.028868914 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.039163113 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.039235115 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.067883015 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.068254948 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.069025040 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.069036007 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.069212914 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.069222927 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.069251060 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.069309950 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.087980986 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.088079929 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.158864021 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.160295010 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.169573069 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.169609070 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.169703960 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.207515001 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.208313942 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.222532034 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.222610950 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.222732067 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.257740974 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.270257950 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.272341967 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.289235115 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.289380074 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.336858988 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.336874962 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.336972952 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.351798058 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.378612995 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.380178928 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.388969898 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.390520096 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.410655022 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.412331104 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.445985079 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.458462000 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.481630087 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.481815100 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.490561008 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.490906000 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.510211945 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.510299921 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.565642118 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.565886021 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.578394890 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.578447104 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.578530073 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.578540087 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.578596115 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.578777075 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.578794956 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.601530075 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.629987001 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.630060911 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.657902002 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.657980919 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.711384058 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.711503983 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.758476019 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.759994984 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.760025024 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.760113955 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.792094946 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.808089018 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.809050083 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.809088945 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.809299946 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.845873117 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.878151894 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.879563093 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.879729033 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.886745930 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.888432026 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.911900997 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.912000895 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.950972080 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.951083899 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.965614080 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.965698957 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.977266073 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:15.978805065 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:15.980268002 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.000510931 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.000598907 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.000845909 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.031619072 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.031747103 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.079637051 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.079722881 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.096972942 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.097002029 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.097038031 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.097070932 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.097131014 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.097173929 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.097400904 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.097409964 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.099771976 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.130098104 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.132344007 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.199407101 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.199832916 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.200618982 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.201069117 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.209258080 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.209587097 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.232924938 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.233292103 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.316888094 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.317435980 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.320658922 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.320806026 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.321528912 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.321580887 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.329662085 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.329880953 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.331384897 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.331448078 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.331468105 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.352668047 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.352680922 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.352735996 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.382822990 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.382957935 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.383073092 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.400832891 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.401046991 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.440476894 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.440574884 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.449399948 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.452276945 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.453224897 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.453283072 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.485239983 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.502645969 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.502716064 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.514173031 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.514188051 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.514256001 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.521853924 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.521935940 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.554075956 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.554150105 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.571779013 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.571897030 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.604970932 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.605040073 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.605072975 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.605146885 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.605245113 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.605309010 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.605336905 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.622272015 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.624420881 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.638343096 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.640467882 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.669734955 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.673806906 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.676311016 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.704027891 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.704134941 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.744029045 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.744178057 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.750238895 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.750262976 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.750329971 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.762269974 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.762356043 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.789546013 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.789885998 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.823740005 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.823832989 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.869868994 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.869986057 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.902045012 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.902112007 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.902121067 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.943485022 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.943592072 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.951190948 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:16.951548100 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.975380898 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:16.975380898 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.010052919 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.021771908 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.021855116 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.022150993 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.022171021 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.022200108 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.022227049 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.036346912 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.040297031 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.071110964 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.072336912 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.095007896 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.095096111 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.095192909 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.095230103 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.095232964 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.095347881 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.095427990 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.095510960 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.129729033 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.129839897 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.141469955 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.141575098 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.191924095 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.192328930 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.198045969 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.198074102 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.198163033 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.214658976 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.214768887 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.252690077 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.252717972 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.252966881 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.292036057 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.292258978 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.292455912 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.317868948 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.320346117 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.322061062 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.322137117 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.331052065 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.331964016 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.372520924 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.372772932 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.439874887 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.440316916 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.451421022 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.452275038 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.484086037 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.490257025 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.493024111 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.493094921 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.493180037 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.513231993 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.516439915 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.518771887 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.518878937 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.558249950 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.571858883 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.572287083 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.572921991 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.572979927 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.573010921 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.573055983 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.603954077 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.604331017 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.609914064 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.609957933 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.610042095 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.610054016 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.610083103 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.610137939 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.610255957 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.610285997 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.610354900 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.636166096 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.636346102 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.666678905 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.666695118 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.666798115 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.677826881 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.677936077 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.693547964 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.693615913 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.729756117 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.729840040 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.756110907 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.756171942 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.761136055 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.761565924 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.797446012 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.797523022 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.805006981 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.838171959 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.838186026 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.838253021 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.865514040 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.875762939 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.876302004 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.880013943 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.880194902 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.880666018 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.880709887 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.880757093 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.884231091 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.893081903 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.896414995 CET	49738	63701	192.168.2.4	154.82.113.139
Dec 29, 2024 02:02:17.957138062 CET	63701	49738	154.82.113.139	192.168.2.4
Dec 29, 2024 02:02:17.957441092 CET	49738	63701	192.168.2.4	154.82.113.139

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Type
Dec 29, 2024 02:00:56.957552910 CET	192.168.2.4	154.82.113.139	88eb	Echo
Dec 29, 2024 02:00:57.364434004 CET	154.82.113.139	192.168.2.4	90eb	Echo Reply
Dec 29, 2024 02:00:58.378586054 CET	192.168.2.4	154.82.113.139	a4b9	Echo
Dec 29, 2024 02:00:58.785665989 CET	154.82.113.139	192.168.2.4	acb9	Echo Reply
Dec 29, 2024 02:00:59.800452948 CET	192.168.2.4	154.82.113.139	c8dc	Echo
Dec 29, 2024 02:01:00.207279921 CET	154.82.113.139	192.168.2.4	d0dc	Echo Reply
Dec 29, 2024 02:01:01.222392082 CET	192.168.2.4	154.82.113.139	6280	Echo
Dec 29, 2024 02:01:01.629421949 CET	154.82.113.139	192.168.2.4	6a80	Echo Reply
Dec 29, 2024 02:01:03.782358885 CET	192.168.2.4	154.82.113.139	4931	Echo
Dec 29, 2024 02:01:04.189347982 CET	154.82.113.139	192.168.2.4	5131	Echo Reply
Dec 29, 2024 02:01:05.191122055 CET	192.168.2.4	154.82.113.139	6d54	Echo
Dec 29, 2024 02:01:05.598052979 CET	154.82.113.139	192.168.2.4	7554	Echo Reply
Dec 29, 2024 02:01:06.623397112 CET	192.168.2.4	154.82.113.139	8a22	Echo
Dec 29, 2024 02:01:07.030411005 CET	154.82.113.139	192.168.2.4	9222	Echo Reply
Dec 29, 2024 02:01:08.034931898 CET	192.168.2.4	154.82.113.139	2b1b	Echo
Dec 29, 2024 02:01:08.441766977 CET	154.82.113.139	192.168.2.4	331b	Echo Reply
Dec 29, 2024 02:01:10.613754988 CET	192.168.2.4	154.82.113.139	674c	Echo
Dec 29, 2024 02:01:11.020396948 CET	154.82.113.139	192.168.2.4	6f4c	Echo Reply
Dec 29, 2024 02:01:12.037487030 CET	192.168.2.4	154.82.113.139	8b6f	Echo
Dec 29, 2024 02:01:12.444174051 CET	154.82.113.139	192.168.2.4	936f	Echo Reply
Dec 29, 2024 02:01:13.457170010 CET	192.168.2.4	154.82.113.139	b092	Echo
Dec 29, 2024 02:01:13.863895893 CET	154.82.113.139	192.168.2.4	b892	Echo Reply
Dec 29, 2024 02:01:14.878698111 CET	192.168.2.4	154.82.113.139	d4b5	Echo
Dec 29, 2024 02:01:15.285557032 CET	154.82.113.139	192.168.2.4	dcb5	Echo Reply
Dec 29, 2024 02:01:17.426426888 CET	192.168.2.4	154.82.113.139	bb66	Echo
Dec 29, 2024 02:01:17.833129883 CET	154.82.113.139	192.168.2.4	c366	Echo Reply
Dec 29, 2024 02:01:18.847214937 CET	192.168.2.4	154.82.113.139	5d5f	Echo
Dec 29, 2024 02:01:19.254050970 CET	154.82.113.139	192.168.2.4	655f	Echo Reply
Dec 29, 2024 02:01:20.269265890 CET	192.168.2.4	154.82.113.139	8082	Echo
Dec 29, 2024 02:01:20.676250935 CET	154.82.113.139	192.168.2.4	8882	Echo Reply
Dec 29, 2024 02:01:21.690999985 CET	192.168.2.4	154.82.113.139	a4a5	Echo
Dec 29, 2024 02:01:22.097901106 CET	154.82.113.139	192.168.2.4	aca5	Echo Reply
Dec 29, 2024 02:01:24.238899946 CET	192.168.2.4	154.82.113.139	d3f5	Echo
Dec 29, 2024 02:01:24.645752907 CET	154.82.113.139	192.168.2.4	dbf5	Echo Reply
Dec 29, 2024 02:01:25.659802914 CET	192.168.2.4	154.82.113.139	f818	Echo
Dec 29, 2024 02:01:26.066713095 CET	154.82.113.139	192.168.2.4	19	Echo Reply
Dec 29, 2024 02:01:27.081815004 CET	192.168.2.4	154.82.113.139	1c3c	Echo
Dec 29, 2024 02:01:27.488529921 CET	154.82.113.139	192.168.2.4	243c	Echo Reply
Dec 29, 2024 02:01:28.503828049 CET	192.168.2.4	154.82.113.139	e25e	Echo
Dec 29, 2024 02:01:28.910722971 CET	154.82.113.139	192.168.2.4	ea5e	Echo Reply
Dec 29, 2024 02:01:31.051595926 CET	192.168.2.4	154.82.113.139	5e97	Echo
Dec 29, 2024 02:01:31.458307028 CET	154.82.113.139	192.168.2.4	6697	Echo Reply
Dec 29, 2024 02:01:32.472263098 CET	192.168.2.4	154.82.113.139	9355	Echo
Dec 29, 2024 02:01:32.879054070 CET	154.82.113.139	192.168.2.4	9b55	Echo Reply
Dec 29, 2024 02:01:33.894130945 CET	192.168.2.4	154.82.113.139	a4c7	Echo
Dec 29, 2024 02:01:34.300923109 CET	154.82.113.139	192.168.2.4	acc7	Echo Reply
Dec 29, 2024 02:01:35.316063881 CET	192.168.2.4	154.82.113.139	d836	Echo
Dec 29, 2024 02:01:35.722778082 CET	154.82.113.139	192.168.2.4	e036	Echo Reply
Dec 29, 2024 02:01:37.863634109 CET	192.168.2.4	154.82.113.139	9cce	Echo
Dec 29, 2024 02:01:38.304557085 CET	154.82.113.139	192.168.2.4	a4ce	Echo Reply
Dec 29, 2024 02:01:39.316241980 CET	192.168.2.4	154.82.113.139	5f55	Echo
Dec 29, 2024 02:01:39.722922087 CET	154.82.113.139	192.168.2.4	6755	Echo Reply
Dec 29, 2024 02:01:40.737885952 CET	192.168.2.4	154.82.113.139	8236	Echo
Dec 29, 2024 02:01:41.144577980 CET	154.82.113.139	192.168.2.4	8a36	Echo Reply
Dec 29, 2024 02:01:42.159704924 CET	192.168.2.4	154.82.113.139	7215	Echo
Dec 29, 2024 02:01:42.566524982 CET	154.82.113.139	192.168.2.4	7a15	Echo Reply
Dec 29, 2024 02:01:44.728135109 CET	192.168.2.4	154.82.113.139	53d1	Echo
Dec 29, 2024 02:01:45.134763956 CET	154.82.113.139	192.168.2.4	5bd1	Echo Reply
Dec 29, 2024 02:01:46.144294977 CET	192.168.2.4	154.82.113.139	2e74	Echo
Dec 29, 2024 02:01:46.550993919 CET	154.82.113.139	192.168.2.4	3674	Echo Reply
Dec 29, 2024 02:01:47.566034079 CET	192.168.2.4	154.82.113.139	39bb	Echo
Dec 29, 2024 02:01:47.972734928 CET	154.82.113.139	192.168.2.4	41bb	Echo Reply
Dec 29, 2024 02:01:48.987982988 CET	192.168.2.4	154.82.113.139	20f1	Echo
Dec 29, 2024 02:01:49.394803047 CET	154.82.113.139	192.168.2.4	28f1	Echo Reply
Dec 29, 2024 02:01:51.535393953 CET	192.168.2.4	154.82.113.139	c92	Echo
Dec 29, 2024 02:01:51.942145109 CET	154.82.113.139	192.168.2.4	1492	Echo Reply
Dec 29, 2024 02:01:52.956828117 CET	192.168.2.4	154.82.113.139	fa0e	Echo
Dec 29, 2024 02:01:53.363671064 CET	154.82.113.139	192.168.2.4	20f	Echo Reply
Dec 29, 2024 02:01:54.378531933 CET	192.168.2.4	154.82.113.139	d5d7	Echo
Dec 29, 2024 02:01:54.785335064 CET	154.82.113.139	192.168.2.4	ddd7	Echo Reply
Dec 29, 2024 02:01:55.800553083 CET	192.168.2.4	154.82.113.139	eaac	Echo
Dec 29, 2024 02:01:56.207243919 CET	154.82.113.139	192.168.2.4	f2ac	Echo Reply
Dec 29, 2024 02:01:58.347886086 CET	192.168.2.4	154.82.113.139	1b48	Echo
Dec 29, 2024 02:01:58.754622936 CET	154.82.113.139	192.168.2.4	2348	Echo Reply
Dec 29, 2024 02:01:59.769018888 CET	192.168.2.4	154.82.113.139	c9da	Echo
Dec 29, 2024 02:02:00.175765038 CET	154.82.113.139	192.168.2.4	d1da	Echo Reply
Dec 29, 2024 02:02:01.191059113 CET	192.168.2.4	154.82.113.139	e375	Echo
Dec 29, 2024 02:02:01.597625971 CET	154.82.113.139	192.168.2.4	eb75	Echo Reply
Dec 29, 2024 02:02:02.612807989 CET	192.168.2.4	154.82.113.139	66b6	Echo
Dec 29, 2024 02:02:03.020001888 CET	154.82.113.139	192.168.2.4	6eb6	Echo Reply
Dec 29, 2024 02:02:05.160717964 CET	192.168.2.4	154.82.113.139	ed3a	Echo
Dec 29, 2024 02:02:05.567195892 CET	154.82.113.139	192.168.2.4	f53a	Echo Reply
Dec 29, 2024 02:02:06.581804991 CET	192.168.2.4	154.82.113.139	5041	Echo
Dec 29, 2024 02:02:06.988586903 CET	154.82.113.139	192.168.2.4	5841	Echo Reply
Dec 29, 2024 02:02:08.003483057 CET	192.168.2.4	154.82.113.139	9067	Echo
Dec 29, 2024 02:02:08.409996033 CET	154.82.113.139	192.168.2.4	9867	Echo Reply
Dec 29, 2024 02:02:09.425544977 CET	192.168.2.4	154.82.113.139	a40c	Echo
Dec 29, 2024 02:02:09.832170010 CET	154.82.113.139	192.168.2.4	ac0c	Echo Reply
Dec 29, 2024 02:02:11.974695921 CET	192.168.2.4	154.82.113.139	42ed	Echo
Dec 29, 2024 02:02:12.381398916 CET	154.82.113.139	192.168.2.4	4aed	Echo Reply
Dec 29, 2024 02:02:13.394355059 CET	192.168.2.4	154.82.113.139	219c	Echo
Dec 29, 2024 02:02:13.800992012 CET	154.82.113.139	192.168.2.4	299c	Echo Reply
Dec 29, 2024 02:02:14.815938950 CET	192.168.2.4	154.82.113.139	55cd	Echo
Dec 29, 2024 02:02:15.222623110 CET	154.82.113.139	192.168.2.4	5dcd	Echo Reply
Dec 29, 2024 02:02:16.238204002 CET	192.168.2.4	154.82.113.139	20b1	Echo
Dec 29, 2024 02:02:16.644814014 CET	154.82.113.139	192.168.2.4	28b1	Echo Reply
Dec 29, 2024 02:02:18.785749912 CET	192.168.2.4	154.82.113.139	cb6d	Echo
Dec 29, 2024 02:02:19.192464113 CET	154.82.113.139	192.168.2.4	d36d	Echo Reply
Dec 29, 2024 02:02:20.206568956 CET	192.168.2.4	154.82.113.139	88ab	Echo
Dec 29, 2024 02:02:20.613919973 CET	154.82.113.139	192.168.2.4	90ab	Echo Reply
Dec 29, 2024 02:02:21.628752947 CET	192.168.2.4	154.82.113.139	7b57	Echo
Dec 29, 2024 02:02:22.035378933 CET	154.82.113.139	192.168.2.4	8357	Echo Reply
Dec 29, 2024 02:02:23.050412893 CET	192.168.2.4	154.82.113.139	d0b	Echo
Dec 29, 2024 02:02:23.457073927 CET	154.82.113.139	192.168.2.4	150b	Echo Reply
Dec 29, 2024 02:02:25.598577976 CET	192.168.2.4	154.82.113.139	38d7	Echo
Dec 29, 2024 02:02:26.006064892 CET	154.82.113.139	192.168.2.4	40d7	Echo Reply
Dec 29, 2024 02:02:27.019247055 CET	192.168.2.4	154.82.113.139	6d42	Echo
Dec 29, 2024 02:02:27.426439047 CET	154.82.113.139	192.168.2.4	7542	Echo Reply
Dec 29, 2024 02:02:28.440888882 CET	192.168.2.4	154.82.113.139	7109	Echo
Dec 29, 2024 02:02:28.847551107 CET	154.82.113.139	192.168.2.4	7909	Echo Reply
Dec 29, 2024 02:02:29.862750053 CET	192.168.2.4	154.82.113.139	3e33	Echo
Dec 29, 2024 02:02:30.269563913 CET	154.82.113.139	192.168.2.4	4633	Echo Reply
Dec 29, 2024 02:02:32.496124983 CET	192.168.2.4	154.82.113.139	8a1e	Echo
Dec 29, 2024 02:02:32.902885914 CET	154.82.113.139	192.168.2.4	921e	Echo Reply
Dec 29, 2024 02:02:33.909638882 CET	192.168.2.4	154.82.113.139	b70	Echo
Dec 29, 2024 02:02:34.316487074 CET	154.82.113.139	192.168.2.4	1370	Echo Reply
Dec 29, 2024 02:02:35.331581116 CET	192.168.2.4	154.82.113.139	e766	Echo
Dec 29, 2024 02:02:35.738210917 CET	154.82.113.139	192.168.2.4	ef66	Echo Reply
Dec 29, 2024 02:02:36.753498077 CET	192.168.2.4	154.82.113.139	ac1c	Echo
Dec 29, 2024 02:02:37.160214901 CET	154.82.113.139	192.168.2.4	b41c	Echo Reply
Dec 29, 2024 02:02:39.306931973 CET	192.168.2.4	154.82.113.139	3d85	Echo
Dec 29, 2024 02:02:39.713581085 CET	154.82.113.139	192.168.2.4	4585	Echo Reply
Dec 29, 2024 02:02:40.722264051 CET	192.168.2.4	154.82.113.139	9f91	Echo
Dec 29, 2024 02:02:41.129004002 CET	154.82.113.139	192.168.2.4	a791	Echo Reply
Dec 29, 2024 02:02:42.144248009 CET	192.168.2.4	154.82.113.139	55ae	Echo
Dec 29, 2024 02:02:42.550965071 CET	154.82.113.139	192.168.2.4	5dae	Echo Reply
Dec 29, 2024 02:02:43.565850019 CET	192.168.2.4	154.82.113.139	c2ee	Echo
Dec 29, 2024 02:02:43.973033905 CET	154.82.113.139	192.168.2.4	caee	Echo Reply
Dec 29, 2024 02:02:46.115029097 CET	192.168.2.4	154.82.113.139	dd63	Echo
Dec 29, 2024 02:02:46.521681070 CET	154.82.113.139	192.168.2.4	e563	Echo Reply
Dec 29, 2024 02:02:47.534614086 CET	192.168.2.4	154.82.113.139	1e7	Echo
Dec 29, 2024 02:02:47.941162109 CET	154.82.113.139	192.168.2.4	9e7	Echo Reply
Dec 29, 2024 02:02:48.956826925 CET	192.168.2.4	154.82.113.139	2c2c	Echo
Dec 29, 2024 02:02:49.363498926 CET	154.82.113.139	192.168.2.4	342c	Echo Reply
Dec 29, 2024 02:02:50.378561974 CET	192.168.2.4	154.82.113.139	a750	Echo
Dec 29, 2024 02:02:50.785284042 CET	154.82.113.139	192.168.2.4	af50	Echo Reply
Dec 29, 2024 02:02:52.942997932 CET	192.168.2.4	154.82.113.139	4417	Echo
Dec 29, 2024 02:02:53.349790096 CET	154.82.113.139	192.168.2.4	4c17	Echo Reply
Dec 29, 2024 02:02:54.362696886 CET	192.168.2.4	154.82.113.139	474a	Echo
Dec 29, 2024 02:02:54.769371986 CET	154.82.113.139	192.168.2.4	4f4a	Echo Reply
Dec 29, 2024 02:02:55.784554005 CET	192.168.2.4	154.82.113.139	48da	Echo
Dec 29, 2024 02:02:56.191427946 CET	154.82.113.139	192.168.2.4	50da	Echo Reply
Dec 29, 2024 02:02:57.206501007 CET	192.168.2.4	154.82.113.139	be5b	Echo
Dec 29, 2024 02:02:57.613244057 CET	154.82.113.139	192.168.2.4	c65b	Echo Reply
Dec 29, 2024 02:02:59.783627033 CET	192.168.2.4	154.82.113.139	41ec	Echo
Dec 29, 2024 02:03:00.190504074 CET	154.82.113.139	192.168.2.4	49ec	Echo Reply
Dec 29, 2024 02:03:01.248507977 CET	192.168.2.4	154.82.113.139	cd7e	Echo
Dec 29, 2024 02:03:01.655164957 CET	154.82.113.139	192.168.2.4	d57e	Echo Reply
Dec 29, 2024 02:03:02.659652948 CET	192.168.2.4	154.82.113.139	e559	Echo
Dec 29, 2024 02:03:03.066445112 CET	154.82.113.139	192.168.2.4	ed59	Echo Reply
Dec 29, 2024 02:03:04.089540005 CET	192.168.2.4	154.82.113.139	d309	Echo
Dec 29, 2024 02:03:04.496630907 CET	154.82.113.139	192.168.2.4	db09	Echo Reply
Dec 29, 2024 02:03:06.650535107 CET	192.168.2.4	154.82.113.139	da79	Echo
Dec 29, 2024 02:03:07.057358027 CET	154.82.113.139	192.168.2.4	e279	Echo Reply
Dec 29, 2024 02:03:08.066004992 CET	192.168.2.4	154.82.113.139	53a0	Echo
Dec 29, 2024 02:03:08.472750902 CET	154.82.113.139	192.168.2.4	5ba0	Echo Reply
Dec 29, 2024 02:03:09.487633944 CET	192.168.2.4	154.82.113.139	47b2	Echo
Dec 29, 2024 02:03:09.894256115 CET	154.82.113.139	192.168.2.4	4fb2	Echo Reply
Dec 29, 2024 02:03:10.909537077 CET	192.168.2.4	154.82.113.139	e5fe	Echo
Dec 29, 2024 02:03:11.316090107 CET	154.82.113.139	192.168.2.4	edfe	Echo Reply
Dec 29, 2024 02:03:13.661187887 CET	192.168.2.4	154.82.113.139	b5a4	Echo
Dec 29, 2024 02:03:14.067754030 CET	154.82.113.139	192.168.2.4	bda4	Echo Reply
Dec 29, 2024 02:03:15.081522942 CET	192.168.2.4	154.82.113.139	ab35	Echo
Dec 29, 2024 02:03:15.488117933 CET	154.82.113.139	192.168.2.4	b335	Echo Reply
Dec 29, 2024 02:03:16.503426075 CET	192.168.2.4	154.82.113.139	ffb7	Echo
Dec 29, 2024 02:03:16.910147905 CET	154.82.113.139	192.168.2.4	7b8	Echo Reply
Dec 29, 2024 02:03:17.925158024 CET	192.168.2.4	154.82.113.139	7f0c	Echo
Dec 29, 2024 02:03:18.332356930 CET	154.82.113.139	192.168.2.4	870c	Echo Reply
Dec 29, 2024 02:03:20.473660946 CET	192.168.2.4	154.82.113.139	9606	Echo
Dec 29, 2024 02:03:20.880312920 CET	154.82.113.139	192.168.2.4	9e06	Echo Reply
Dec 29, 2024 02:03:21.893919945 CET	192.168.2.4	154.82.113.139	dd34	Echo
Dec 29, 2024 02:03:22.300626993 CET	154.82.113.139	192.168.2.4	e534	Echo Reply
Dec 29, 2024 02:03:23.315805912 CET	192.168.2.4	154.82.113.139	c634	Echo
Dec 29, 2024 02:03:23.722924948 CET	154.82.113.139	192.168.2.4	ce34	Echo Reply
Dec 29, 2024 02:03:24.737754107 CET	192.168.2.4	154.82.113.139	645e	Echo
Dec 29, 2024 02:03:25.144723892 CET	154.82.113.139	192.168.2.4	6c5e	Echo Reply
Dec 29, 2024 02:03:27.292990923 CET	192.168.2.4	154.82.113.139	fbb7	Echo
Dec 29, 2024 02:03:27.700159073 CET	154.82.113.139	192.168.2.4	3b8	Echo Reply
Dec 29, 2024 02:03:28.706917048 CET	192.168.2.4	154.82.113.139	19c3	Echo
Dec 29, 2024 02:03:29.114105940 CET	154.82.113.139	192.168.2.4	21c3	Echo Reply
Dec 29, 2024 02:03:30.128855944 CET	192.168.2.4	154.82.113.139	510f	Echo
Dec 29, 2024 02:03:30.535536051 CET	154.82.113.139	192.168.2.4	590f	Echo Reply
Dec 29, 2024 02:03:31.550153017 CET	192.168.2.4	154.82.113.139	cdb2	Echo
Dec 29, 2024 02:03:31.956891060 CET	154.82.113.139	192.168.2.4	d5b2	Echo Reply
Dec 29, 2024 02:03:34.099184036 CET	192.168.2.4	154.82.113.139	7ce2	Echo
Dec 29, 2024 02:03:34.505877972 CET	154.82.113.139	192.168.2.4	84e2	Echo Reply
Dec 29, 2024 02:03:35.518887997 CET	192.168.2.4	154.82.113.139	a5f5	Echo
Dec 29, 2024 02:03:35.925672054 CET	154.82.113.139	192.168.2.4	adf5	Echo Reply
Dec 29, 2024 02:03:36.940747976 CET	192.168.2.4	154.82.113.139	2a6f	Echo
Dec 29, 2024 02:03:37.347527981 CET	154.82.113.139	192.168.2.4	326f	Echo Reply
Dec 29, 2024 02:03:38.362859011 CET	192.168.2.4	154.82.113.139	306a	Echo
Dec 29, 2024 02:03:38.769547939 CET	154.82.113.139	192.168.2.4	386a	Echo Reply
Dec 29, 2024 02:03:40.913639069 CET	192.168.2.4	154.82.113.139	434d	Echo
Dec 29, 2024 02:03:41.320539951 CET	154.82.113.139	192.168.2.4	4b4d	Echo Reply
Dec 29, 2024 02:03:42.331475973 CET	192.168.2.4	154.82.113.139	c72e	Echo
Dec 29, 2024 02:03:42.738394022 CET	154.82.113.139	192.168.2.4	cf2e	Echo Reply
Dec 29, 2024 02:03:43.753268957 CET	192.168.2.4	154.82.113.139	2036	Echo
Dec 29, 2024 02:03:44.160319090 CET	154.82.113.139	192.168.2.4	2836	Echo Reply
Dec 29, 2024 02:03:45.175337076 CET	192.168.2.4	154.82.113.139	10ca	Echo
Dec 29, 2024 02:03:45.582075119 CET	154.82.113.139	192.168.2.4	18ca	Echo Reply
Dec 29, 2024 02:03:47.723417997 CET	192.168.2.4	154.82.113.139	e8e3	Echo
Dec 29, 2024 02:03:48.130100012 CET	154.82.113.139	192.168.2.4	f0e3	Echo Reply
Dec 29, 2024 02:03:49.143996954 CET	192.168.2.4	154.82.113.139	e5c5	Echo
Dec 29, 2024 02:03:49.550848007 CET	154.82.113.139	192.168.2.4	edc5	Echo Reply
Dec 29, 2024 02:03:50.565746069 CET	192.168.2.4	154.82.113.139	3fc0	Echo
Dec 29, 2024 02:03:50.972306013 CET	154.82.113.139	192.168.2.4	47c0	Echo Reply
Dec 29, 2024 02:03:51.987710953 CET	192.168.2.4	154.82.113.139	fc4c	Echo
Dec 29, 2024 02:03:52.394418001 CET	154.82.113.139	192.168.2.4	44d	Echo Reply
Dec 29, 2024 02:03:54.535717010 CET	192.168.2.4	154.82.113.139	dc6d	Echo
Dec 29, 2024 02:03:54.942456007 CET	154.82.113.139	192.168.2.4	e46d	Echo Reply
Dec 29, 2024 02:03:55.956374884 CET	192.168.2.4	154.82.113.139	f9b2	Echo
Dec 29, 2024 02:03:56.363183022 CET	154.82.113.139	192.168.2.4	1b3	Echo Reply
Dec 29, 2024 02:03:57.378217936 CET	192.168.2.4	154.82.113.139	ae63	Echo
Dec 29, 2024 02:03:57.785000086 CET	154.82.113.139	192.168.2.4	b663	Echo Reply
Dec 29, 2024 02:03:58.800177097 CET	192.168.2.4	154.82.113.139	d6a5	Echo
Dec 29, 2024 02:03:59.207134008 CET	154.82.113.139	192.168.2.4	dea5	Echo Reply
Dec 29, 2024 02:04:01.352720022 CET	192.168.2.4	154.82.113.139	2b60	Echo
Dec 29, 2024 02:04:01.759602070 CET	154.82.113.139	192.168.2.4	3360	Echo Reply
Dec 29, 2024 02:04:02.768872976 CET	192.168.2.4	154.82.113.139	db3c	Echo
Dec 29, 2024 02:04:03.175667048 CET	154.82.113.139	192.168.2.4	e33c	Echo Reply
Dec 29, 2024 02:04:04.191055059 CET	192.168.2.4	154.82.113.139	7d44	Echo
Dec 29, 2024 02:04:04.597738028 CET	154.82.113.139	192.168.2.4	8544	Echo Reply
Dec 29, 2024 02:04:05.612597942 CET	192.168.2.4	154.82.113.139	cd85	Echo
Dec 29, 2024 02:04:06.019968987 CET	154.82.113.139	192.168.2.4	d585	Echo Reply
Dec 29, 2024 02:04:08.161664963 CET	192.168.2.4	154.82.113.139	27e0	Echo
Dec 29, 2024 02:04:08.568572044 CET	154.82.113.139	192.168.2.4	2fe0	Echo Reply
Dec 29, 2024 02:04:09.581315041 CET	192.168.2.4	154.82.113.139	83bc	Echo
Dec 29, 2024 02:04:09.988229036 CET	154.82.113.139	192.168.2.4	8bbc	Echo Reply
Dec 29, 2024 02:04:11.030226946 CET	192.168.2.4	154.82.113.139	470a	Echo
Dec 29, 2024 02:04:11.437030077 CET	154.82.113.139	192.168.2.4	4f0a	Echo Reply
Dec 29, 2024 02:04:12.440788031 CET	192.168.2.4	154.82.113.139	fdc4	Echo
Dec 29, 2024 02:04:12.847565889 CET	154.82.113.139	192.168.2.4	5c5	Echo Reply
Dec 29, 2024 02:04:15.348198891 CET	192.168.2.4	154.82.113.139	5f11	Echo
Dec 29, 2024 02:04:15.755069971 CET	154.82.113.139	192.168.2.4	6711	Echo Reply
Dec 29, 2024 02:04:16.784604073 CET	192.168.2.4	154.82.113.139	a380	Echo
Dec 29, 2024 02:04:17.192975044 CET	154.82.113.139	192.168.2.4	ab80	Echo Reply

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 29, 2024 02:00:27.589443922 CET	1.1.1.1	192.168.2.4	0xd3d9	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 29, 2024 02:00:27.589443922 CET	1.1.1.1	192.168.2.4	0xd3d9	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	20:00:08
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe"
Imagebase:	0xc00000
File size:	28'924'664 bytes
MD5 hash:	0BE92F00CC946557BBF1DEC87B708224
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	20:00:13
Start date:	28/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6f6f20000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	20:00:13
Start date:	28/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 1D35FE1868B50914AC73C4C1E92E866C C
Imagebase:	0xb20000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	20:00:20
Start date:	28/12/2024
Path:	C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Installer eSPT Masa PPh versi 2.0#U007e26022009.exe" /i "C:\Program Files (x86)\WindowsInstallerFB\7AF5081\DAN_127.msi" AI_EUIMSI=1 APPDIR="C:\Program Files (x86)\BtDDIFUEHLCR" SECONDSEQUENCE="1" CLIENTPROCESSID="5324" AI_MORE_CMD_LINE=1
Imagebase:	0xc00000
File size:	28'924'664 bytes
MD5 hash:	0BE92F00CC946557BBF1DEC87B708224
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	20:00:21
Start date:	28/12/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding D34C0DB36F96DC933127EB55CBA7C9C2
Imagebase:	0xb20000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	20:00:42
Start date:	28/12/2024
Path:	C:\Windows\Installer\MSI7DAF.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSI7DAF.tmp"
Imagebase:	0x230000
File size:	175'328 bytes
MD5 hash:	BE4ED0D3AA0B2573927A046620106B13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	20:00:42
Start date:	28/12/2024
Path:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\TLGCBXAGVFLQ.KBI" -o"C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1" -pJHKQFETWJKTIHLLBOKO -aos -y
Imagebase:	0x6a0000
File size:	710'888 bytes
MD5 hash:	FAE7D0A530279838C8A5731B086A081B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000009.00000003.2021130019.0000000002EE6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	20:00:42
Start date:	28/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	20:00:47
Start date:	28/12/2024
Path:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\SUGIPFIMNRQE.TMA" -o"C:\Program Files (x86)\BtDDIFUEHLCR" -pMNHWOTMLOHTPVRFXPCH -aos -y
Imagebase:	0x6a0000
File size:	710'888 bytes
MD5 hash:	FAE7D0A530279838C8A5731B086A081B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	20:00:47
Start date:	28/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	20:00:49
Start date:	28/12/2024
Path:	C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\BtDDIFUEHLCR\e8a0d5af432b7e64DBD.exe" x "C:\Program Files (x86)\BtDDIFUEHLCR\TMGJRLDUDWLQ.FCU" -o"C:\Users\user\AppData\Roaming" -pPXOEWCVFPIJPLHQSQSX -aos -y
Imagebase:	0x6a0000
File size:	710'888 bytes
MD5 hash:	FAE7D0A530279838C8A5731B086A081B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	20:00:49
Start date:	28/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	20:00:50
Start date:	28/12/2024
Path:	C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe"
Imagebase:	0x400000
File size:	691'760 bytes
MD5 hash:	938C33C54819D6CE8D731B68D9C37E38
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 0000000F.00000000.2077543981.0000000000401000.00000020.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	20:00:50
Start date:	28/12/2024
Path:	C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\BtDDIFUEHLCR\yybob\Bor32-update-flase.exe"
Imagebase:	0x400000
File size:	691'760 bytes
MD5 hash:	938C33C54819D6CE8D731B68D9C37E38
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_blackmoon, Description: Yara detected BlackMoon Ransomware, Source: 00000012.00000002.2134669600.00000000030AC000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	20:00:54
Start date:	28/12/2024
Path:	C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\B35542DB6BED445A8478ECE738C8E8C1\VGX\Haloonoroff.exe"
Imagebase:	0xb90000
File size:	174'304 bytes
MD5 hash:	0D318144BD23BA1A72CC06FE19CB3F0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17%
Total number of Nodes:	2000
Total number of Limit Nodes:	84

Executed Functions

Function 00D581C0 Relevance: 30.3, APIs: 14, Strings: 3, Instructions: 526
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 00D5824E
GetLastError.KERNEL32 ref: 00D58254
GetUserNameW.ADVAPI32(00000000,?), ref: 00D5829C
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 00D582D2
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 00D5831C
RegDeleteValueW.KERNEL32(?,?,00000000,80000001,00000001,00000000,6C34C19C,00000000,?), ref: 00D58515
RegCloseKey.ADVAPI32(?,?,00000000,80000001,00000001,00000000,6C34C19C,00000000,?), ref: 00D5854B
RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00D586A0
RegCloseKey.ADVAPI32(?,?,00000000,80000001,00000001,00000000,6C34C19C,00000000), ref: 00D586E2
RegCloseKey.ADVAPI32(?,?,00000000,80000001,00000001,00000000,6C34C19C,00000000), ref: 00D58727
RegDeleteKeyW.ADVAPI32(?,00000000), ref: 00D58749
RegCloseKey.ADVAPI32(?,?,00000000,80000001,00000001,00000000,6C34C19C,00000000), ref: 00D58785
RegDeleteValueW.KERNEL32(?,?,00000000,80000001,00000001,00000000,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000031,?,00000000,80000001,00000001,00000000,6C34C19C,00000000), ref: 00D5888A
RegCloseKey.ADVAPI32(?,?,?,00000000,80000001,00000001,00000000,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000031,?,00000000,80000001,00000001,00000000,6C34C19C,00000000), ref: 00D588CC

Strings

UserDomain, xrefs: 00D582CD, 00D58317
Software, xrefs: 00D5857E
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00D587AA

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Close$Delete$EnvironmentNameUserValueVariable$ErrorInfoLastQuery
String ID: Software$Software\Microsoft\Windows\CurrentVersion\RunOnce$UserDomain
API String ID: 1615433478-4079418357
Opcode ID: a528ef3623f6810e103f6d54ca9290d28b1b60d6fc57b4259b9cd2a59b1d27fb
Instruction ID: 047ddcb353cff5477c6d498b1f70f82185673d196b1f368a64cfc9f51f779d7d
Opcode Fuzzy Hash: a528ef3623f6810e103f6d54ca9290d28b1b60d6fc57b4259b9cd2a59b1d27fb
Instruction Fuzzy Hash: B1224970900248DBEF14DFA4CC99BEEBBB4FF14305F244158E845B7291DB746A89DBA1

Function 00D34CA0 Relevance: 27.5, APIs: 11, Strings: 4, Instructions: 1259COMMON

Download Yara Rule

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

GetTickCount.KERNEL32 ref: 00D34D24
__Xtime_get_ticks.LIBCPMT ref: 00D34D2C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D34D76
__Init_thread_footer.LIBCMT ref: 00D34F64
GetCurrentProcess.KERNEL32(?,?,?), ref: 00D3517A
OpenProcessToken.ADVAPI32(00000000,00000008,00000000,?,?,?), ref: 00D35187
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?), ref: 00D351A7
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00D351D2

Strings

\/:*?"<>|, xrefs: 00D34F26
/uninstall, xrefs: 00D35383
\\?\, xrefs: 00D35A9D
VersionString, xrefs: 00D35454, 00D354A5

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Init_thread_footerProcess$Token$CloseCountCurrentHandleHeapInformationOpenTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: /uninstall$VersionString$\/:*?"<>|$\\?\
API String ID: 3363527671-654522458
Opcode ID: b5d36918d3cad0a73efa67856ff86e4846f403c071d00014ba94555310a05230
Instruction ID: 3d1b39cdb72a47e58e870e9fb1e5b211a7891f3fc8c01bab2ee92fc347f12c18
Opcode Fuzzy Hash: b5d36918d3cad0a73efa67856ff86e4846f403c071d00014ba94555310a05230
Instruction Fuzzy Hash: 5BB2C271A01609DFDB14DFA8D848BAEFBB4FF44314F188259E415AB2D1DB74AD05CBA0

Function 00C20880 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 694fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000), ref: 00C209BF
PathIsUNCW.SHLWAPI(?,*.*,00000000), ref: 00C20A77
FindFirstFileW.KERNEL32(?,?,*.*,00000000), ref: 00C20BCC
GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000), ref: 00C20BE6
GetFullPathNameW.KERNEL32(?,00000000,?,00000000), ref: 00C20C19
FindClose.KERNEL32(00000000), ref: 00C20C88
SetLastError.KERNEL32(0000007B), ref: 00C20C96
_wcsrchr.LIBVCRUNTIME ref: 00C20CEC
_wcsrchr.LIBVCRUNTIME ref: 00C20D0C
PathIsUNCW.SHLWAPI(?,?,6C34C19C), ref: 00C20EE3

Strings

*.*, xrefs: 00C209EA, 00C20A47, 00C20A48, 00C20DD4
\\?\UNC\, xrefs: 00C20A97, 00C20B4E, 00C20F03, 00C20FB9
\\?\, xrefs: 00C20B61, 00C20BB6, 00C20FCC, 00C21020

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Path$Find$CloseFullName_wcsrchr$ErrorFileFirstLast
String ID: *.*$\\?\$\\?\UNC\
API String ID: 1241272779-1700010636
Opcode ID: 389681c140e30c92f3108e266b46813f6fccde132b6e2ea42e43dbd2183e8105
Instruction ID: b9fc50a812fce18ba02f7faa32781866041f065931a5bd4b0c377d1851f84f2d
Opcode Fuzzy Hash: 389681c140e30c92f3108e266b46813f6fccde132b6e2ea42e43dbd2183e8105
Instruction Fuzzy Hash: 90423370600615DFDB14DF68D889BAEF7B5FF50314F24422EE825DB292EB71AA44CB90

Function 6C61D070 Relevance: 21.4, APIs: 9, Strings: 3, Instructions: 400
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindClose.KERNEL32(00000000,?,?,6C698D6C,?), ref: 6C61D0CF
PathIsUNCW.SHLWAPI(?,*.*,?,6C698D6C), ref: 6C61D17F
FindFirstFileW.KERNEL32(?,?,*.*,?,6C698D6C), ref: 6C61D323
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,?,6C698D6C), ref: 6C61D33D
GetFullPathNameW.KERNEL32(00000000,00000000,?,00000000,?,6C698D6C), ref: 6C61D370
FindClose.KERNEL32(00000000,?,?,?,?,?,6C698D6C), ref: 6C61D3E1
SetLastError.KERNEL32(0000007B,?,?,?,?,?,6C698D6C), ref: 6C61D3EB
_wcsrchr.LIBVCRUNTIME ref: 6C61D441
_wcsrchr.LIBVCRUNTIME ref: 6C61D461

Strings

\\?\, xrefs: 6C61D2B3, 6C61D30E, 6C61D313
\\?\UNC\, xrefs: 6C61D19F, 6C61D2A0
*.*, xrefs: 6C61D0FA, 6C61D128, 6C61D14F, 6C61D150

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: FindPath$CloseFullName_wcsrchr$ErrorFileFirstLast
String ID: *.*$\\?\$\\?\UNC\
API String ID: 726989864-1700010636
Opcode ID: e08339c3a32f3768fb0bbb620b2bfdf7f3a7e1825a0f0f85b969e3e523c939df
Instruction ID: 8af6134b7d148b696a97425420d1e9d0d04abe5aef76fb91e9d348ceda1fb962
Opcode Fuzzy Hash: e08339c3a32f3768fb0bbb620b2bfdf7f3a7e1825a0f0f85b969e3e523c939df
Instruction Fuzzy Hash: 28E1F530609601DFDB06CF6DC844BAEB7B1FF4232AF144668E9259BB90DB35E905CB58

Function 6C60DB00 Relevance: 17.5, Strings: 13, Instructions: 1250COMMON

Download Yara Rule

Strings

Action ended, xrefs: 6C60E2D6
fatal error, xrefs: 6C60DC1C
Error: , xrefs: 6C60E1D7
Track screen: [, xrefs: 6C60E8A0
W, xrefs: 6C60E776
user abort, xrefs: 6C60DBE1, 6C60DC31
Crash >> , xrefs: 6C60E367
Warning: , xrefs: 6C60DFB2
Lifecycle: , xrefs: 6C60DD64
-> , xrefs: 6C60DD9B
Exception >> , xrefs: 6C60E5BC
Info 1720, xrefs: 6C60E568
success, xrefs: 6C60DBA6

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: #118#125#171Heap$#103AllocProcess
String ID: -> $Action ended$Crash >> $Error: $Exception >> $Info 1720$Lifecycle: $Track screen: [$W$Warning: $fatal error$success$user abort
API String ID: 196527699-1454030630
Opcode ID: b1efef516590cf5d8407c27dbb676179738259fbf49c8662289a4d2f8ace4153
Instruction ID: 2ef5307574c68f705b077e578dd797882201782168b3a63740c1304ff747c976
Opcode Fuzzy Hash: b1efef516590cf5d8407c27dbb676179738259fbf49c8662289a4d2f8ace4153
Instruction Fuzzy Hash: 9AB2F370F01244DFDB08CFA8CA44BDEBBB1AF4A318F148259D411BB791DB759A09CB99

Function 00D40640 Relevance: 15.8, APIs: 10, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: 382fbfa871dd5416712c69c2d8d55c77682ea3c1b0ab678fad8093ae7da44624
Instruction ID: 81538cdd2c2a9ca4a3598d17e1e8bfc7a5993c858667f06825426ceccbd22e2e
Opcode Fuzzy Hash: 382fbfa871dd5416712c69c2d8d55c77682ea3c1b0ab678fad8093ae7da44624
Instruction Fuzzy Hash: FA72A170901649DFDB14DFA8C884B9EBBF0FF45314F188299E515AB292DB74AD48CFA0

Function 00D1E740 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ComCtl32.dll,6C34C19C,?,?,00000000), ref: 00D1E77E
GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00D1E7A1
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,?), ref: 00D1E801
FreeLibrary.KERNEL32(00000000), ref: 00D1E81F

Strings

ComCtl32.dll, xrefs: 00D1E772
LoadIconMetric, xrefs: 00D1E79B

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: LibraryLoad$AddressFreeImageProc
String ID: ComCtl32.dll$LoadIconMetric
API String ID: 1597520822-764666640
Opcode ID: 0cbcf39c2f857d8a5991b717a80d9cbf1d5243057c290079edb0cf7a6b81eb6c
Instruction ID: 46392af0026aa5024cb750765a12df0ba261ae3d00b1eaa09b74f17e01ce10f9
Opcode Fuzzy Hash: 0cbcf39c2f857d8a5991b717a80d9cbf1d5243057c290079edb0cf7a6b81eb6c
Instruction Fuzzy Hash: 573180B1A00259ABDF148F95DC48BAEBFF8EB48750F00022AF915A3280D7B58944CBA0

Function 00D4B860 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00D4B93A

Strings

\, xrefs: 00D4B8B4
\, xrefs: 00D4B8DE
\, xrefs: 00D4B8BC

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: DiskFreeSpace
String ID: \$\$\
API String ID: 1705453755-3791832595
Opcode ID: 2d8aee8d7cd569ff03a60fecb5e71b89e8e0e23bb1768eb16926b0f2afe677cc
Instruction ID: da6b3452e96001e6ce2be2e37506c4ec1faa012aeb37678b4d7a880525bf57bb
Opcode Fuzzy Hash: 2d8aee8d7cd569ff03a60fecb5e71b89e8e0e23bb1768eb16926b0f2afe677cc
Instruction Fuzzy Hash: 5941D462D14355CBCB30DF2484416ABB7F4FFA9364F194A2FE9C897040E360CD858BA6

Function 6C627870 Relevance: 6.1, APIs: 4, Instructions: 84fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,F1829F80), ref: 6C627906
FindClose.KERNEL32(00000000,?,?), ref: 6C62793E

Part of subcall function 6C607F30: HeapAlloc.KERNEL32(00000000,00000000,?,F1829F80,00000000,6C64ED80,000000FF,?,?,6C68D24C,?,6C6281AD,80004005), ref: 6C607F7A

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Find$AllocCloseFileFirstHeap
String ID:
API String ID: 2507753907-0
Opcode ID: f95b242dfc8c0dd84cc7467abb1715adff23f2fd88837840b3a7540ba6e7b255
Instruction ID: 3acdf572e9b36fe236726a3fc4f547eb2afe28b7bbf562dcdca6e6aa8eee6ca8
Opcode Fuzzy Hash: f95b242dfc8c0dd84cc7467abb1715adff23f2fd88837840b3a7540ba6e7b255
Instruction Fuzzy Hash: CA31F371C05318CADF24DF65C849BA9B7B4EF02324F10479AD829A3AD0D7385944CF8A

Function 00CD7A10 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 228libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00CD7A51

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

Part of subcall function 00C092A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00C21134,00000000,?,00000010,?,*.*,?,80070057), ref: 00C092C3

LoadLibraryExW.KERNEL32(?,00000000,00000000,00E10D6D,000000FF), ref: 00CD7B24

Strings

UxTheme.dll, xrefs: 00CD7A2C, 00CD7AFF, 00CD7B00, 00CD7B94

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Init_thread_footer$DirectoryFindHeapLibraryLoadProcessResourceSystem
String ID: UxTheme.dll
API String ID: 2586271605-352951104
Opcode ID: 4ef5b595bd012b0cc6185b1401549b170d9a883f239d0ab0fd32cb68312b48ee
Instruction ID: 8fe6b3b900fbc88747903efb6a431a156964f858fc293600a4876c89e7ea5c19
Opcode Fuzzy Hash: 4ef5b595bd012b0cc6185b1401549b170d9a883f239d0ab0fd32cb68312b48ee
Instruction Fuzzy Hash: 10A17AB0504645EFE714CF24C858B9ABBF0FF04318F14865ED9299B781E7B6A618DF90

Function 00DB4245 Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,00000000,00D435FE,?,?,?,?,?,?), ref: 00DB424A
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?), ref: 00DB4251
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?), ref: 00DB4297
HeapFree.KERNEL32(00000000,?,?,?,?,?,?), ref: 00DB429E

Part of subcall function 00DB40E3: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB4107
Part of subcall function 00DB40E3: HeapAlloc.KERNEL32(00000000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB410E

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: 00dec2014157ef44680e7d89770a1b761ba25b24244e66b9e016bab30ebd3247
Instruction ID: eefb7dacd29b8a1b50d220758d2b1a36b8e29e07124765657be898c05289cbb9
Opcode Fuzzy Hash: 00dec2014157ef44680e7d89770a1b761ba25b24244e66b9e016bab30ebd3247
Instruction Fuzzy Hash: B1F0BB32A44712DBCB64ABB97C0DAAF3E649F85751B154018F597D6142DF70C8059F70

Function 00D1B1B0 Relevance: 4.6, APIs: 3, Instructions: 93fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?), ref: 00D1B24D
FindClose.KERNEL32(00000000), ref: 00D1B2AC

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Find$AllocateCloseFileFirstHeap
String ID:
API String ID: 1673784098-0
Opcode ID: d0058df562a716862a631637cf3464224c049273c337c6fd37f2e5e3cffbe2e7
Instruction ID: 0b549afe84f6797f08362206b496853d984c0e2b175460a7f833aa25954c8d01
Opcode Fuzzy Hash: d0058df562a716862a631637cf3464224c049273c337c6fd37f2e5e3cffbe2e7
Instruction Fuzzy Hash: C331B270904618EFDB24DF55E849BEEB7B4EB45324F20416EE819A3380DB715988CBA4

Function 00D598C0 Relevance: 3.1, APIs: 2, Instructions: 86filepipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32(?,00000003,00000006,000000FF,00007F90,00007F90,00001388,00000000,?,6C34C19C,6C34C19C,?,?,?,?,00000000), ref: 00D59949
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000,?,6C34C19C,6C34C19C,?,?,?,?,00000000,00E283A5), ref: 00D5996A

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Create$FileNamedPipe
String ID:
API String ID: 1328467360-0
Opcode ID: 41ba8da915f466a7455b25c881df75a6c4d9be7f77e139f51bde0e7bb5f63813
Instruction ID: ebfc07ef428535f5a90bc70718bc39f55ba15d6aac8f0a3678fb1ac4aa1ed7b9
Opcode Fuzzy Hash: 41ba8da915f466a7455b25c881df75a6c4d9be7f77e139f51bde0e7bb5f63813
Instruction Fuzzy Hash: 66312531A88745AFE720CF24CC05B99FFA4EB01720F10826EFDA5A76D0CB71A944CB50

Function 00C3AEA0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 00C3AEB8
SetUnhandledExceptionFilter.KERNEL32(00D1A060), ref: 00C3AECE

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ExceptionFilterUnhandled__set_se_translator
String ID:
API String ID: 2480343447-0
Opcode ID: b47763b365776090f883adafad9028d1fe50d378897bbfb82ab481a1648acc30
Instruction ID: b33ec9586e2fed049dbc15cddadbc399e6f9704c1002824de71724deeb6d0b43
Opcode Fuzzy Hash: b47763b365776090f883adafad9028d1fe50d378897bbfb82ab481a1648acc30
Instruction Fuzzy Hash: 89E02622941200BECB109751AC0EF8A3FA0FB96721F094054F10533152C770844ED372

Function 6C605B60 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetAdaptersInfo.IPHLPAPI(00000000,6C605C87), ref: 6C605BCB

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AdaptersInfo
String ID:
API String ID: 3177971545-0
Opcode ID: e1eb2aa8d37208113c55f46761ee24c5e6963d44d847c11455c7aa5b069b853d
Instruction ID: 630513bd76c3ea0269529534c44c762f6413629125b69ca7911a338cd2e58455
Opcode Fuzzy Hash: e1eb2aa8d37208113c55f46761ee24c5e6963d44d847c11455c7aa5b069b853d
Instruction Fuzzy Hash: 0C21D7713052015FD71CCE28CAA496AB7E9FB85304F448A3EE046A7A80EFB0F904875C

Function 00D63E80 Relevance: 1.5, APIs: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

Part of subcall function 00D20100: __Init_thread_footer.LIBCMT ref: 00D201E0

CoCreateInstance.COMBASE(00E442C8,00000000,00000001,00E60CEC,000000B0), ref: 00D63EFE

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CreateInit_thread_footerInstance
String ID:
API String ID: 3436645735-0
Opcode ID: 63f37ba85131630e7c3d2625a04a89057b55f07ee540b3951b937019ee7b43da
Instruction ID: dac43fb91a9e74aa394db4c50118ebfe73abebbe506e10130319ac6db02ebec6
Opcode Fuzzy Hash: 63f37ba85131630e7c3d2625a04a89057b55f07ee540b3951b937019ee7b43da
Instruction Fuzzy Hash: C111ADB1604740AFD720CF59E805B8AFBF8EB05B10F10465EF861AB7C0C7B66504CBA0

Function 00D5F0D0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Init_thread_footer$CreateHeapInstanceProcess
String ID:
API String ID: 3807588171-0
Opcode ID: e0f160ab5497799ccd260401e97c4f7e258cdf4f8acb0bef14e34457a1bea241
Instruction ID: 16d6038e0ea78d578b51995b46af445c5f9b0183c2cca13aed32c9f1ec376d25
Opcode Fuzzy Hash: e0f160ab5497799ccd260401e97c4f7e258cdf4f8acb0bef14e34457a1bea241
Instruction Fuzzy Hash: 896147B0501744CFEB10CF69C54838ABFE0FF45318F148A9DD98A9B782D7B9A609DB91

Function 00D02DF0 Relevance: 112.3, APIs: 8, Strings: 56, Instructions: 327
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

MoveFileW.KERNEL32(?,?), ref: 00D02F6A
GetModuleHandleW.KERNEL32(kernel32,?), ref: 00D02FAC
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00D02FF4
GetProcAddress.KERNEL32(00000000,SetDllDirectory), ref: 00D0304C
__Init_thread_footer.LIBCMT ref: 00D0305C
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00D030A4
__Init_thread_footer.LIBCMT ref: 00D03004

Part of subcall function 00DB4B58: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B62
Part of subcall function 00DB4B58: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B95
Part of subcall function 00DB4B58: RtlWakeAllConditionVariable.NTDLL ref: 00DB4C0C

__Init_thread_footer.LIBCMT ref: 00D030B4

Part of subcall function 00CD7A10: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00CD7A51

Strings

usp10.dll, xrefs: 00D03213
comctl32.dll, xrefs: 00D0313F
uxtheme.dll, xrefs: 00D03107, 00D03193
WindowsCodecs.dll, xrefs: 00D030D6
gdi32.dll, xrefs: 00D03154
propsys.dll, xrefs: 00D031B9
psapi.dll, xrefs: 00D030CC
msimg32.dll, xrefs: 00D03169
netutils.dll, xrefs: 00D03263
msi.dll, xrefs: 00D030E4, 00D0319A
wkscli.dll, xrefs: 00D03277
samcli.dll, xrefs: 00D03245
SetSearchPathMode, xrefs: 00D02FEE
dwmapi.dll, xrefs: 00D03123
msihnd.dll, xrefs: 00D0321D
cabinet.dll, xrefs: 00D031A8
apphelp.dll, xrefs: 00D031CD
ole32.dll, xrefs: 00D03131
shell32.dll, xrefs: 00D03146
gdiplus.dll, xrefs: 00D03115, 00D031A1
dbghelp.dll, xrefs: 00D03170
rsaenh.dll, xrefs: 00D031C3
SetDllDirectory, xrefs: 00D03046
srvcli.dll, xrefs: 00D0326D
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 00D02E80, 00D02E8F
wininet.dll, xrefs: 00D0317E
profapi.dll, xrefs: 00D0310E
mpr.dll, xrefs: 00D03100, 00D0318C
shcore.dll, xrefs: 00D03227
shlwapi.dll, xrefs: 00D031F5
SetDefaultDllDirectories, xrefs: 00D0309E
urlmon.dll, xrefs: 00D03185
cryptsp.dll, xrefs: 00D03231
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 00D02E67, 00D02E6F
USP10.dll, xrefs: 00D030EB
bcrypt.dll, xrefs: 00D030DD
msasn1.dll, xrefs: 00D031D7
kernel32.dll, xrefs: 00D031AF
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 00D02E87
oleaut32.dll, xrefs: 00D03138
netapi32.dll, xrefs: 00D03259
msls31.dll, xrefs: 00D030F2
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 00D02E62
ws2_32.dll, xrefs: 00D0324F
kernel32, xrefs: 00D02FA7
lpk.dll, xrefs: 00D031FF
userenv.dll, xrefs: 00D0311C
secur32.dll, xrefs: 00D0323B
version.dll, xrefs: 00D030F9, 00D03177
davhlpr.dll, xrefs: 00D0312A
user32.dll, xrefs: 00D0315B
advapi32.dll, xrefs: 00D0314D
crypt32.dll, xrefs: 00D031E1
setupapi.dll, xrefs: 00D03209
comdlg32.dll, xrefs: 00D03162
wintrust.dll, xrefs: 00D031EB

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Init_thread_footer$AddressProc$CriticalSection$ConditionDirectoryEnterFileHandleHeapLeaveModuleMoveProcessSystemVariableWake
String ID: @echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$SetDefaultDllDirectories$SetDllDirectory$SetSearchPathMode$USP10.dll$WindowsCodecs.dll$advapi32.dll$apphelp.dll$bcrypt.dll$cabinet.dll$comctl32.dll$comdlg32.dll$crypt32.dll$cryptsp.dll$davhlpr.dll$dbghelp.dll$dwmapi.dll$gdi32.dll$gdiplus.dll$kernel32$kernel32.dll$lpk.dll$mpr.dll$msasn1.dll$msi.dll$msihnd.dll$msimg32.dll$msls31.dll$netapi32.dll$netutils.dll$ole32.dll$oleaut32.dll$profapi.dll$propsys.dll$psapi.dll$rsaenh.dll$samcli.dll$secur32.dll$setupapi.dll$shcore.dll$shell32.dll$shlwapi.dll$srvcli.dll$urlmon.dll$user32.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wininet.dll$wintrust.dll$wkscli.dll$ws2_32.dll
API String ID: 3437638698-2006426916
Opcode ID: 73d4026b611562fb791050880bfdd2b9f38cfcf9efe1713d7416cba5db724c51
Instruction ID: 35288005faed0a7d6043293dac09aef0bfefae5e8508f46a8c9b1078fc33f998
Opcode Fuzzy Hash: 73d4026b611562fb791050880bfdd2b9f38cfcf9efe1713d7416cba5db724c51
Instruction Fuzzy Hash: ADE18DB0900249DFDF24CF64C84ABDEBBA4FF85315F045519EC18AB282D7B19A0DCB61

Function 00D20410 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 247
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00D2047E
RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 00D204C5
RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 00D204E4
RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 00D20513
RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 00D20588
RegQueryValueExW.ADVAPI32(00000000,BuildBranch,00000000,00000000,?,?), ref: 00D205F1
RegQueryValueExW.KERNEL32(00000000,ReleaseId,00000000,00000000,?,?), ref: 00D20654
RegQueryValueExW.KERNEL32(00000000,CSDVersion,00000000,00000000,?,?), ref: 00D206A6
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00D20743
GetProcAddress.KERNEL32(00000000), ref: 00D2074A
__Init_thread_footer.LIBCMT ref: 00D2075E
GetCurrentProcess.KERNEL32(?), ref: 00D20781
IsWow64Process.KERNEL32(00000000), ref: 00D20788
RegCloseKey.ADVAPI32(00000000), ref: 00D207C2

Strings

BuildBranch, xrefs: 00D205E6
kernel32, xrefs: 00D2073E
CurrentBuildNumber, xrefs: 00D2057D
co_release, xrefs: 00D205F9
CurrentMinorVersionNumber, xrefs: 00D204D9
CurrentVersion, xrefs: 00D20508
rs_prerelease, xrefs: 00D20611
CSDVersion, xrefs: 00D2069B
CurrentMajorVersionNumber, xrefs: 00D204BA
IsWow64Process, xrefs: 00D20739
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00D20474
ReleaseId, xrefs: 00D20649

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: QueryValue$Process$AddressCloseCurrentHandleInit_thread_footerModuleOpenProcWow64
String ID: BuildBranch$CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$co_release$kernel32$rs_prerelease
API String ID: 1906320730-525127412
Opcode ID: a309090be6aeef7ed8818e4d9b843db6b921bce37c6fdbee635c1066e3ec10e4
Instruction ID: bd3886f5af30d3f5f87a37933908251db1335c32e5d24ac45debdf401e51f3b9
Opcode Fuzzy Hash: a309090be6aeef7ed8818e4d9b843db6b921bce37c6fdbee635c1066e3ec10e4
Instruction Fuzzy Hash: EAA17E71900328DEDB20CF21DD45F99BBF4FB14705F0441AAE849B7291EB759A89CFA0

Function 6C626320 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 247
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,?,?,?,?,?,?,?,00000000,6C661349,000000FF), ref: 6C62638A
RegQueryValueExW.KERNEL32(?,CurrentMajorVersionNumber,00000000,00000000,?,?,?,?,?,?,?,?,00000000,6C661349,000000FF), ref: 6C6263BF
RegQueryValueExW.KERNEL32(?,CurrentMinorVersionNumber,00000000,00000000,?,?,?,?,?,?,?,?,00000000,6C661349,000000FF), ref: 6C6263D5
RegQueryValueExW.ADVAPI32(?,CurrentVersion,00000000,00000000,?,?,?,?,?,?,?,?,00000000,6C661349,000000FF), ref: 6C6263FB
RegQueryValueExW.KERNEL32(?,CurrentBuildNumber,00000000,00000000,?,?,?,?,?,?,?,?,00000000,6C661349,000000FF), ref: 6C626464
RegQueryValueExW.ADVAPI32(?,BuildBranch,00000000,00000000,?,?,?,?,?,?,?,?,00000000,6C661349,000000FF), ref: 6C6264BD
RegQueryValueExW.KERNEL32(?,ReleaseId,00000000,00000000,?,?,?,?,?,?,?,?,00000000,6C661349,000000FF), ref: 6C626514
RegQueryValueExW.KERNEL32(?,CSDVersion,00000000,00000000,?,?,?,?,?,?,?,?,00000000,6C661349,000000FF), ref: 6C626553
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,?,?,?,?,00000000,6C661349,000000FF), ref: 6C6265EE
GetProcAddress.KERNEL32(00000000), ref: 6C6265F5
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,00000000,6C661349,000000FF), ref: 6C626626
IsWow64Process.KERNEL32(00000000,?,?,?,?,?,?,00000000,6C661349,000000FF), ref: 6C62662D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,00000000,6C661349,000000FF), ref: 6C62665E

Strings

CurrentVersion, xrefs: 6C6263F3
CurrentMajorVersionNumber, xrefs: 6C6263B7
co_release, xrefs: 6C6264C5
CSDVersion, xrefs: 6C62654B
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 6C626380
CurrentBuildNumber, xrefs: 6C62645C
CurrentMinorVersionNumber, xrefs: 6C6263CD
ReleaseId, xrefs: 6C62650C
rs_prerelease, xrefs: 6C6264DD
BuildBranch, xrefs: 6C6264B5
kernel32, xrefs: 6C6265E9
IsWow64Process, xrefs: 6C6265E4

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: QueryValue$Process$AddressCloseCurrentHandleModuleOpenProcWow64
String ID: BuildBranch$CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$co_release$kernel32$rs_prerelease
API String ID: 2654979339-525127412
Opcode ID: 4a066ae2e29e1f9ee8472ea8e21f637efd1832bd6f8f91d08034e31fbb9d625f
Instruction ID: b2d4970c4c229fc35ab325289673a6fcb12f874ec337454d8832900b1c22cf07
Opcode Fuzzy Hash: 4a066ae2e29e1f9ee8472ea8e21f637efd1832bd6f8f91d08034e31fbb9d625f
Instruction Fuzzy Hash: D6A17CB190021A9EDF20CF61CD45BEE77F8FB05704F10462AE911E7681E778A6458FA9

Function 6C626690 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 221
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\ProductOptions,00000000,00020119,?,?,?,00000000,6C66138D,000000FF), ref: 6C6266FC
RegQueryValueExW.KERNEL32(?,ProductType,00000000,00000000,?,?,?,?,00000000,6C66138D,000000FF), ref: 6C62672E
RegQueryValueExW.KERNEL32(?,ProductSuite,00000000,00000000,?,?,?,?,00000000,6C66138D,000000FF), ref: 6C62679D
RegCloseKey.ADVAPI32(?,?,?,00000000,6C66138D,000000FF), ref: 6C626968

Strings

CommunicationServer, xrefs: 6C62681B
Terminal Server, xrefs: 6C626834
Embedded(Restricted), xrefs: 6C6268C7
Enterprise, xrefs: 6C6267E9
SYSTEM\CurrentControlSet\Control\ProductOptions, xrefs: 6C6266F2
DataCenter, xrefs: 6C62687F
Compute Server, xrefs: 6C62690C
ServerNT, xrefs: 6C626757
EmbeddedNT, xrefs: 6C626866
Storage Server, xrefs: 6C6268F5
ProductType, xrefs: 6C626726
BackOffice, xrefs: 6C626802
Small Business, xrefs: 6C6267D0
ProductSuite, xrefs: 6C626795
Security Appliance, xrefs: 6C6268DE
Personal, xrefs: 6C626899
WinNT, xrefs: 6C626734
Small Business(Restricted), xrefs: 6C62684D
Blade, xrefs: 6C6268B0

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: BackOffice$Blade$CommunicationServer$Compute Server$DataCenter$Embedded(Restricted)$EmbeddedNT$Enterprise$Personal$ProductSuite$ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$Security Appliance$ServerNT$Small Business$Small Business(Restricted)$Storage Server$Terminal Server$WinNT
API String ID: 1586453840-3149529848
Opcode ID: 313b60c66a9bacd38627c7292601bca2555311fc32faac105f902d078a3cb5cf
Instruction ID: d13183658a56b8927364577d50515ae8ca15dd94aacecb298f150c5bb6406f83
Opcode Fuzzy Hash: 313b60c66a9bacd38627c7292601bca2555311fc32faac105f902d078a3cb5cf
Instruction Fuzzy Hash: 7471D274B042578ADB108F35CD817EA7AB6EB42309F1055399955DBE81EB3CC90A8F6C

Function 00D207F0 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\ProductOptions,00000000,00020119,00000000), ref: 00D20860
RegQueryValueExW.KERNEL32(00000000,ProductType,00000000,00000000,?), ref: 00D2089B
RegQueryValueExW.KERNEL32(00000000,ProductSuite,00000000,00000000,?,?), ref: 00D20916
RegCloseKey.KERNEL32(00000000), ref: 00D20AEE

Strings

BackOffice, xrefs: 00D20982
Small Business(Restricted), xrefs: 00D209CD
Terminal Server, xrefs: 00D209B4
DataCenter, xrefs: 00D209FF
CommunicationServer, xrefs: 00D2099B
Embedded(Restricted), xrefs: 00D20A47
Enterprise, xrefs: 00D20969
Security Appliance, xrefs: 00D20A5E
WinNT, xrefs: 00D208A1
EmbeddedNT, xrefs: 00D209E6
Compute Server, xrefs: 00D20A8C
SYSTEM\CurrentControlSet\Control\ProductOptions, xrefs: 00D20856
Blade, xrefs: 00D20A30
ServerNT, xrefs: 00D208C4
Storage Server, xrefs: 00D20A75
ProductType, xrefs: 00D20890
Small Business, xrefs: 00D20950
Personal, xrefs: 00D20A19
ProductSuite, xrefs: 00D2090B

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: BackOffice$Blade$CommunicationServer$Compute Server$DataCenter$Embedded(Restricted)$EmbeddedNT$Enterprise$Personal$ProductSuite$ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$Security Appliance$ServerNT$Small Business$Small Business(Restricted)$Storage Server$Terminal Server$WinNT
API String ID: 1586453840-3149529848
Opcode ID: 5097f3d8a3c09ef55a1032de9cb12e2b9d00d750c8a28d1a7d6b3f2b23f27ba4
Instruction ID: c07e0b43c0d92c88b39eb6745cd003b9281f45d6c61af0d40d5d2f865b3bddc8
Opcode Fuzzy Hash: 5097f3d8a3c09ef55a1032de9cb12e2b9d00d750c8a28d1a7d6b3f2b23f27ba4
Instruction Fuzzy Hash: FA71D8307003288BDB109B21FD41BBA7B79EBA4308F5454B5AD56BB287EB74CD498B71

Function 00D2FE70 Relevance: 39.1, APIs: 12, Strings: 10, Instructions: 599libraryloaderCOMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?,SystemFolder,0000000C,?,?,?), ref: 00D30075
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00D30170
GetWindowsDirectoryW.KERNEL32(?,00000104,WindowsFolder,0000000D,?,?,?), ref: 00D30270
GetWindowsDirectoryW.KERNEL32(?,00000104,WindowsVolume,0000000D,?,?,?), ref: 00D30355
GetTempPathW.KERNEL32(00000104,?,WindowsVolume,0000000D,?,?,?), ref: 00D303CB
GetModuleFileNameW.KERNEL32(00000000,?,00000104,WindowsVolume,0000000D,?,?,?), ref: 00D30454
SHGetSpecialFolderLocation.SHELL32(00000000,?,WindowsVolume,0000000D,?,?,?), ref: 00D30532
__Init_thread_footer.LIBCMT ref: 00D305A6
LoadLibraryW.KERNEL32(shfolder.dll,?,?,?), ref: 00D305BC
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00D305EE
SHGetPathFromIDListW.SHELL32(?,?), ref: 00D3065C
SHGetMalloc.SHELL32(00000000), ref: 00D30675

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Strings

SETUPEXEDIR, xrefs: 00D30401
SHGetFolderPathW, xrefs: 00D305E8
System32Folder, xrefs: 00D300FD, 00D30112, 00D3011C
WindowsVolume, xrefs: 00D302E4, 00D302F9, 00D30303
ProgramW6432, xrefs: 00D2FF05
WindowsFolder, xrefs: 00D301FD, 00D30212, 00D3021C
TempFolder, xrefs: 00D30382
ProgramFiles64Folder, xrefs: 00D2FEAA
shfolder.dll, xrefs: 00D305B7
SystemFolder, xrefs: 00D2FFE9, 00D2FFFE, 00D30008

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: DirectoryPath$FolderWindows$AddressAllocateFileFromHeapInit_thread_footerLibraryListLoadLocationMallocModuleNameProcSpecialSystemTemp
String ID: ProgramFiles64Folder$ProgramW6432$SETUPEXEDIR$SHGetFolderPathW$System32Folder$SystemFolder$TempFolder$WindowsFolder$WindowsVolume$shfolder.dll
API String ID: 3671250-2142986682
Opcode ID: 1630eb66557eb1d8123524d384c6ec12780bcd9b79c272fbb2b3effa05dbfc26
Instruction ID: 5ea3440a0f4b2c80451d09ae07be459cb77d4fd5e45592492639e6cac92dc7c7
Opcode Fuzzy Hash: 1630eb66557eb1d8123524d384c6ec12780bcd9b79c272fbb2b3effa05dbfc26
Instruction Fuzzy Hash: 422215706002198BDB24DF28CC55BAEB7B1EF54314F5846A8E506E72A1EB71DE85CFA0

Function 00D36470 Relevance: 25.3, APIs: 3, Strings: 11, Instructions: 773COMMON

Download Yara Rule

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00D3652E
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00D36558

Part of subcall function 00C092A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00C21134,00000000,?,00000010,?,*.*,?,80070057), ref: 00C092C3

Strings

Language of a related product is:, xrefs: 00D36CAC
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 00D36C44
Code returned to Windows by setup:, xrefs: 00D368B1
Language used for UI:, xrefs: 00D36DDE
%hu, xrefs: 00D36AD8
Languages of setup:, xrefs: 00D378BB
Software\Caphyon\Advanced Installer\, xrefs: 00D36C30
Advinst_Extract_, xrefs: 00D364C5, 00D364D7, 00D364E1
AI_BOOTSTRAPPERLANGS, xrefs: 00D37660, 00D37672, 00D3767C
A valid language was received from commnad line. This is:, xrefs: 00D36AAA
Language selected programatically for UI:, xrefs: 00D36D62

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ByteCharInit_thread_footerMultiWide$FindHeapProcessResource
String ID: %hu$A valid language was received from commnad line. This is:$AI_BOOTSTRAPPERLANGS$Advinst_Extract_$Code returned to Windows by setup:$Language of a related product is:$Language selected programatically for UI:$Language used for UI:$Languages of setup:$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$Software\Caphyon\Advanced Installer\
API String ID: 1419962739-297406034
Opcode ID: 8f5d889e027a06b8c7d30dcdd1e717a66d10bb4af3dcc12e88ad270f977a1681
Instruction ID: 96b03f187fb9e0853573e55b6ca7d351d463085614600874b949a4144e767186
Opcode Fuzzy Hash: 8f5d889e027a06b8c7d30dcdd1e717a66d10bb4af3dcc12e88ad270f977a1681
Instruction Fuzzy Hash: 8052D471A01245AFDB14DF68CC55BAEBBB4EF45314F18826CE915AB2D2EB34DD04CBA0

Function 00D36130 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 648threadCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00D36300
SetLastError.KERNEL32(0000000E), ref: 00D3631D
GetCurrentThreadId.KERNEL32 ref: 00D36335
EnterCriticalSection.KERNEL32(00EC957C), ref: 00D36352
LeaveCriticalSection.KERNEL32(00EC957C), ref: 00D36375
DialogBoxParamW.USER32(000007D0,00000000,00C76090,00000000), ref: 00D36392
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00D3652E
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00D36558

Part of subcall function 00D04B40: MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,00000000,00000000,?,?,00EC9384,00D4DA40,?), ref: 00D04B58
Part of subcall function 00D04B40: MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,?,-00000001), ref: 00D04B8A

SetEvent.KERNEL32(?,?,00000000,?,00000001), ref: 00D366E8
SetEvent.KERNEL32(?), ref: 00D36749

Part of subcall function 00D41C20: DeleteFileW.KERNEL32(?,?,?,?,?,00D3676B,?), ref: 00D41C4B

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

Strings

v, xrefs: 00D36375
Code returned to Windows by setup:, xrefs: 00D368B1
Advinst_Extract_, xrefs: 00D364C5, 00D364D7, 00D364E1

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ByteCharMultiWide$CriticalEventInit_thread_footerSection$ActiveCurrentDeleteDialogEnterErrorFileHeapLastLeaveParamProcessThreadWindow
String ID: v$Advinst_Extract_$Code returned to Windows by setup:
API String ID: 2923632737-2472245143
Opcode ID: dcb1cfba8dcd7f225177dfe797f75707d77f144bb34e18cc33e9b9df62d21ea9
Instruction ID: 728aa4f43e52d6ebbc4b5d37c5fe032bebcfad775ee8ad488eae1c2425effaa6
Opcode Fuzzy Hash: dcb1cfba8dcd7f225177dfe797f75707d77f144bb34e18cc33e9b9df62d21ea9
Instruction Fuzzy Hash: A2429271D01249EFDB00DFA8C849B9EBBF4EF55314F188169E815AB292DB74DA04CFA0

Function 00D43590 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 179
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 00D435CA
SetLastError.KERNEL32(0000000E,?,?,?,?,?,?), ref: 00D43607
GetCurrentThreadId.KERNEL32 ref: 00D43692
SetWindowTextW.USER32(?,?), ref: 00D4371C
GetDlgItem.USER32(?,000003E9), ref: 00D43726
SetWindowTextW.USER32(00000000,?), ref: 00D43732
GetDlgItem.USER32(?,00000002), ref: 00D4379F
SetWindowTextW.USER32(00000000,?), ref: 00D437A7

Part of subcall function 00D3C1B0: GetDlgItem.USER32(?,00000002), ref: 00D3C1D0
Part of subcall function 00D3C1B0: GetWindowRect.USER32(00000000,?), ref: 00D3C1E6
Part of subcall function 00D3C1B0: ShowWindow.USER32(00000000,00000000,?,?,?,?,?,?,?,00D435EA,?,?,?,?,?,?), ref: 00D3C1FF
Part of subcall function 00D3C1B0: InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,?,?,?,00D435EA,?,?), ref: 00D3C20A
Part of subcall function 00D3C1B0: GetDlgItem.USER32(?,000003E9), ref: 00D3C21C
Part of subcall function 00D3C1B0: GetWindowRect.USER32(00000000,?), ref: 00D3C232
Part of subcall function 00D3C1B0: SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206,?,?,?,?,?,?,?,00D435EA), ref: 00D3C275

Strings

v, xrefs: 00D4366D

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$Item$RectText$ActiveCurrentErrorInvalidateLastShowThread
String ID: v
API String ID: 127311041-3261393531
Opcode ID: ef0ddad0cd8eb8546c4de4d3b44769fde21fb7654f2a306a4ea7ce3bf6e3868d
Instruction ID: 8132743d12c8497ec5425e851d415141639ac2430b1aeac9e9528e3f61fcdc56
Opcode Fuzzy Hash: ef0ddad0cd8eb8546c4de4d3b44769fde21fb7654f2a306a4ea7ce3bf6e3868d
Instruction Fuzzy Hash: 8A61C2B1901705EFDB11DF69CC48B49BBB4FF04320F148659E995AB2E2C771AA05CFA0

Function 00C3AFF0 Relevance: 21.4, APIs: 4, Strings: 8, Instructions: 353
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000000,?,?,00000043), ref: 00C3B127
GetProcAddress.KERNEL32(00000000,InitializeEmbeddedUI), ref: 00C3B13F
GetProcAddress.KERNEL32(00000000,ShutdownEmbeddedUI), ref: 00C3B149
GetProcAddress.KERNEL32(00000000,EmbeddedUIHandler), ref: 00C3B154

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

Strings

EmbeddedUIHandler, xrefs: 00C3B14B
e09f3004, xrefs: 00C3B24E
19.7.1, xrefs: 00C3B22A
INAN, xrefs: 00C3B027
InitializeEmbeddedUI, xrefs: 00C3B139
build , xrefs: 00C3B23F
ShutdownEmbeddedUI, xrefs: 00C3B141
SELECT `Data` FROM `Binary` WHERE `Name` = 'InstallerAnalytics.dll', xrefs: 00C3B084

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AddressProc$HeapInit_thread_footer$AllocateLibraryLoadProcess
String ID: build $19.7.1$EmbeddedUIHandler$INAN$InitializeEmbeddedUI$SELECT `Data` FROM `Binary` WHERE `Name` = 'InstallerAnalytics.dll'$ShutdownEmbeddedUI$e09f3004
API String ID: 2564778481-2055252535
Opcode ID: c10cee2c677320dc484a78b2bcdd50aa083164ffcc192b511160dcc8d280cad3
Instruction ID: ae2d32d7be7805e562decff72588035565509ba96846d5232e49990cbc270daa
Opcode Fuzzy Hash: c10cee2c677320dc484a78b2bcdd50aa083164ffcc192b511160dcc8d280cad3
Instruction Fuzzy Hash: B1D19071910209DFDB04DFA8DC55BEEBBB4FF08310F144629E925A72C1EB75AA04CB90

Function 00D5D8D0 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 43
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,00000000,00D4098B,?,?,?,?,?), ref: 00D5D8E5

Strings

tB, xrefs: 00D5D8F7, 00D5D8FD
ExtractAllFiles, xrefs: 00D5D937
InitExtraction, xrefs: 00D5D91D
GetTotalFilesSize, xrefs: 00D5D925
EndExtraction, xrefs: 00D5D949

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: LibraryLoad
String ID: EndExtraction$ExtractAllFiles$GetTotalFilesSize$InitExtraction$tB
API String ID: 1029625771-137316502
Opcode ID: 9bf5bfc7ebae8ae2d6adf403ca1df1695a07460c37747eae4ae0e1cc25e8fecf
Instruction ID: fda6f510a3633db7db0d627e27fe76c72c108184e166c23bf15c62b4bfbb4f7d
Opcode Fuzzy Hash: 9bf5bfc7ebae8ae2d6adf403ca1df1695a07460c37747eae4ae0e1cc25e8fecf
Instruction Fuzzy Hash: 73019E79941725DFCB18AB62EC0DC563FA1F758356305617AEA11B3221CB73480ACF94

Function 6C613B60 Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 409
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6C608270: GetProcessHeap.KERNEL32 ref: 6C6082CC

Part of subcall function 6C607730: #17.MSI(00000002,?,00000000,?,F1829F80), ref: 6C6077E2
Part of subcall function 6C607730: #125.MSI(00000000,00000000,[1],?,F1829F80), ref: 6C6077F9
Part of subcall function 6C607730: #125.MSI(00000000,00000001,F1829F80,?,F1829F80), ref: 6C607806
Part of subcall function 6C607730: #103.MSI(00000000,04000000,00000000,?,F1829F80), ref: 6C607818
Part of subcall function 6C607730: #8.MSI(00000000,?,F1829F80), ref: 6C607827

FindNextFileW.KERNELBASE(00000000,?,00000000,?,00000000,*.*,00000003,7FFFFFFE,?,6C698D6C,?), ref: 6C613E67
DeleteFileW.KERNEL32(00000000,?), ref: 6C61408B

Strings

Logging is enabled, sending data ..., xrefs: 6C613D62
*.*, xrefs: 6C613CB3
!, xrefs: 6C614091
session, xrefs: 6C613FAA
., xrefs: 6C613E8A
Logging is disabled, discard collected data., xrefs: 6C613BF1

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: #125File$#103DeleteFindHeapNextProcess
String ID: !$*.*$.$Logging is disabled, discard collected data.$Logging is enabled, sending data ...$session
API String ID: 1195310492-2153466073
Opcode ID: c8c1389a2dfebd9dd4c64dc888ff6f47388adb1962660f5d1663e9ca262d7b2e
Instruction ID: 42163cfb6a33314feec5edd0b6016a12d102dc838cb69e268e454bfa57f7b290
Opcode Fuzzy Hash: c8c1389a2dfebd9dd4c64dc888ff6f47388adb1962660f5d1663e9ca262d7b2e
Instruction Fuzzy Hash: 0DF1D330905248DFDB15CFA8CD54BEEBBB4AF05319F148298D005A7B91EB749B88CF99

Function 00D03420 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D03420: GetModuleFileNameW.KERNEL32(00000000,?,00000104,6C34C19C,00000000,?,00E183F6,000000FF), ref: 00D03368

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

FreeLibrary.KERNEL32(00000001,6C34C19C,?,00000001,?,?,?), ref: 00D035B7
EnterCriticalSection.KERNEL32(00EC9338), ref: 00D035D2
DestroyWindow.USER32(00000000), ref: 00D035F0
LeaveCriticalSection.KERNEL32(00EC9338), ref: 00D03639
CoUninitialize.COMBASE ref: 00D03703

Strings

v, xrefs: 00D03639
.local, xrefs: 00D033D4
%s%lu, xrefs: 00D0349D

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalInit_thread_footerSection$DestroyEnterFileFreeHeapLeaveLibraryModuleNameProcessUninitializeWindow
String ID: v$%s%lu$.local
API String ID: 605930860-1141559199
Opcode ID: 3ddfae29e563be0fb3bb15f5e0269c15d3edbfe72daf3462cd4123a8ee18d40d
Instruction ID: d243e2ba338ff73533402ba8da35a11487a017e32bc7eacbcb84b32eae1e0edd
Opcode Fuzzy Hash: 3ddfae29e563be0fb3bb15f5e0269c15d3edbfe72daf3462cd4123a8ee18d40d
Instruction Fuzzy Hash: EA91D171A01604DFDB20DF69C848B9ABBF8FF44314F18456DE81AAB3D2DB759904CBA1

Function 00DB3FD7 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32(?,?,?,00DB4376,00EC7F88,?,00000000,?,00D4361C,?,00000000,00000000,?,?), ref: 00DB3FE9
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,00DB4376,00EC7F88,?,00000000,?,00D4361C,?,00000000,00000000), ref: 00DB3FFE
DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DB407A

Strings

AtlThunk_AllocateData, xrefs: 00DB400F
AtlThunk_DataToCode, xrefs: 00DB403D
AtlThunk_FreeData, xrefs: 00DB4054
atlthunk.dll, xrefs: 00DB3FF9
AtlThunk_InitData, xrefs: 00DB4026

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 40d9e38f70b1f4d26084a4e87935253428f5fba516b48ff1666e509fc7329e56
Instruction ID: 74814186bcf5e20cf586ddae2ca6da3a7f3dea9b725dc27772eb14bef01f8c1d
Opcode Fuzzy Hash: 40d9e38f70b1f4d26084a4e87935253428f5fba516b48ff1666e509fc7329e56
Instruction Fuzzy Hash: DA01C431649314AACB51F7159E4BFD63F588F12708F080068FEC677193D7A28E89CAA2

Function 00D24F80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 173
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D20240: __Init_thread_footer.LIBCMT ref: 00D20312

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,6C34C19C,00000000,00000000,?), ref: 00D24FD5
GetTempPathW.KERNEL32(00000104,?), ref: 00D25069
GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 00D2509A
Wow64DisableWow64FsRedirection.KERNEL32(?), ref: 00D2512D
CopyFileW.KERNEL32(?,?,00000000), ref: 00D2514F
Wow64RevertWow64FsRedirection.KERNEL32(?), ref: 00D2517E

Strings

shim_clone, xrefs: 00D2508E

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Wow64$FilePathRedirectionTemp$CopyDisableFolderInit_thread_footerNameRevert
String ID: shim_clone
API String ID: 4264308349-3944563459
Opcode ID: 848d23e17c7171794b180b9f8c2b8fe44525779e0868f9a0dc15eb954a12f70c
Instruction ID: 4da557f727c01c601171a79d533cdd20f445af3e124de5ccf9f629da7ffa2f21
Opcode Fuzzy Hash: 848d23e17c7171794b180b9f8c2b8fe44525779e0868f9a0dc15eb954a12f70c
Instruction Fuzzy Hash: 7C510574A016289EDB25DF24EC05FAAB7F9EF64700F4440A9E809E7181EB759E45CBB0

Function 6C626F60 Relevance: 10.8, APIs: 7, Instructions: 342fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,F1829F80,00000000,00000000), ref: 6C626FEB
ReadFile.KERNEL32(?,00000000,00001000,?,00000000,00001000), ref: 6C62705D
ReadFile.KERNEL32(?,00000000,00001000,00000000,00000000,?,?,00000000), ref: 6C6272EA
CloseHandle.KERNEL32(?), ref: 6C62734B

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$Read$CloseCreateHandle
String ID:
API String ID: 1724936099-0
Opcode ID: bc1a046d1d482dee3316918c4980f7fa68ae4f6688a81bc43a218dbc62f76aa1
Instruction ID: 04abbbe460be8efdc05009069158f9d875c8845ecab4c437bf3c8bf7fb05f8a4
Opcode Fuzzy Hash: bc1a046d1d482dee3316918c4980f7fa68ae4f6688a81bc43a218dbc62f76aa1
Instruction Fuzzy Hash: 87D18E70E053189BDB10CFA5C958BEEBBB5FF45308F24461CE415AB680DB78A948CF99

Function 00D34E40 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 290COMMON

Download Yara Rule

APIs

Part of subcall function 00D34CA0: GetTickCount.KERNEL32 ref: 00D34D24
Part of subcall function 00D34CA0: __Xtime_get_ticks.LIBCPMT ref: 00D34D2C
Part of subcall function 00D34CA0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D34D76

Part of subcall function 00D581C0: GetUserNameW.ADVAPI32(00000000,?), ref: 00D5824E
Part of subcall function 00D581C0: GetLastError.KERNEL32 ref: 00D58254
Part of subcall function 00D581C0: GetUserNameW.ADVAPI32(00000000,?), ref: 00D5829C
Part of subcall function 00D581C0: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 00D582D2
Part of subcall function 00D581C0: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 00D5831C

__Init_thread_footer.LIBCMT ref: 00D34F64

Strings

\/:*?"<>|, xrefs: 00D34F26

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: EnvironmentNameUserVariable$CountErrorInit_thread_footerLastTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|
API String ID: 2099558200-3830478854
Opcode ID: a13858fd808af82426525c43f92080de28c529e58f8bb2ecdaf0af4a2f49df62
Instruction ID: 95d6697b6de491fa8c1c8a93da5108eb72eb1975086acb85d45003d97ba15a88
Opcode Fuzzy Hash: a13858fd808af82426525c43f92080de28c529e58f8bb2ecdaf0af4a2f49df62
Instruction Fuzzy Hash: 70C18C71D01648DFDF14DFA8C859B9EBBB4BF04304F184268E405BB2D2DB75AA09CBA1

Function 00D5D430 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00E2902D,-00000400,?,00000002,00000400,6C34C19C,?,?,?), ref: 00D5D4D6
GetLastError.KERNEL32(?,?), ref: 00D5D4E4
ReadFile.KERNEL32(00E2902D,00000000,00000400,?,00000000,?,?), ref: 00D5D4FF

Strings

ADVINSTSFX, xrefs: 00D5D533, 00D5D5EE

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$ErrorLastPointerRead
String ID: ADVINSTSFX
API String ID: 64821003-4038163286
Opcode ID: 7acfe06e91b3efcc4e51bc0005f1cc6d8d0cc211808d79b50123db71d0e394a7
Instruction ID: 871c18ec402cc16aa870aac364b9f6b19b02b1861dffe66c7ef0849ee9c270b3
Opcode Fuzzy Hash: 7acfe06e91b3efcc4e51bc0005f1cc6d8d0cc211808d79b50123db71d0e394a7
Instruction Fuzzy Hash: FA61A2B1A001099BDF20CF68C885BBEBBB6FB45315F294255EC15A7291D734ED4ACB70

Function 00D1ADE0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 169fileCOMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(?,00000000,?,\\?\,00000004,?,?,?,00E18D5D,000000FF,?,00D1B0F6,?), ref: 00D1AE83

Part of subcall function 00C092A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00C21134,00000000,?,00000010,?,*.*,?,80070057), ref: 00C092C3

RemoveDirectoryW.KERNEL32(?,6C34C19C,?,?,?,?,00E18D5D,000000FF,?,00D1B0F6,?,00000000), ref: 00D1AEB2
GetLastError.KERNEL32(?,6C34C19C,?,?,?,?,00E18D5D,000000FF,?,00D1B0F6,?,00000000), ref: 00D1AEC2
DeleteFileW.KERNEL32(?,00000000,?,\\?\,00000004,?,?,?,00000000,00E18D5D,000000FF,?,80004005,6C34C19C,?), ref: 00D1AF93
GetLastError.KERNEL32(?,?,?,00000000,00E18D5D,000000FF,?,80004005,6C34C19C,?,?,?,?,00E18D5D,000000FF), ref: 00D1AFD2

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

Strings

\\?\, xrefs: 00D1AE44, 00D1AE56, 00D1AE60, 00D1AF54, 00D1AF66, 00D1AF70

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: DirectoryErrorInit_thread_footerLastRemove$DeleteFileFindHeapProcessResource
String ID: \\?\
API String ID: 34920479-4282027825
Opcode ID: 863afc6f131285fa79e04263909e7152df06f4a8d2eac121e6a58fb3673242d5
Instruction ID: c69ad40bce4bf9e285faa0d83cbbe11819a6ac2ab4fced1bc1fde3c8ec963a0e
Opcode Fuzzy Hash: 863afc6f131285fa79e04263909e7152df06f4a8d2eac121e6a58fb3673242d5
Instruction Fuzzy Hash: AD51DEB1A01618EFDB10DF68E808BAAB7A4FF05320F14465AF861E72D1CB719944CB61

Function 6C63021B Relevance: 10.6, APIs: 7, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6C630262
___scrt_uninitialize_crt.LIBCMT ref: 6C63027C

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: 2977d70eb79cff2e16dbe1daa0e64e4e4e77b4fedcaed185985c95e8f7ed01d7
Instruction ID: 1a97efd7a39935ea3dacb5005d302cab5a5fe92ea4cb87c095d7fa865bad6c9a
Opcode Fuzzy Hash: 2977d70eb79cff2e16dbe1daa0e64e4e4e77b4fedcaed185985c95e8f7ed01d7
Instruction Fuzzy Hash: 2841B472E056B5AFEB109F55C880BEF3AB4EB42758F007116E9186BB40D7754909CBAC

Function 00D06C10 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,6C34C19C,00000000,?,75A8EB20,?,?,00DDCB30,000000FF), ref: 00D06C53
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 00D06C7C
RegCreateKeyExW.KERNEL32(?,00D5887A,00000000,00000000,00000000,00DDCB30,00000000,00000000,00DDCB30,6C34C19C,00000000,?,75A8EB20,?,?,00DDCB30), ref: 00D06CC9
RegCloseKey.ADVAPI32(00000000,?,75A8EB20,?,?,00DDCB30,000000FF), ref: 00D06CDC

Strings

RegCreateKeyTransactedW, xrefs: 00D06C76
Advapi32.dll, xrefs: 00D06C4E

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AddressCloseCreateHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1765684683-2994018265
Opcode ID: e9cf2b429f9cf4d6e42fa3164d2c34754c7f2bd33e37e3db208fe5885c70a92b
Instruction ID: 0d0c236eb030abf71f3f7ce82138ba80efae0d9da4dea435972c16a6783416fa
Opcode Fuzzy Hash: e9cf2b429f9cf4d6e42fa3164d2c34754c7f2bd33e37e3db208fe5885c70a92b
Instruction Fuzzy Hash: 9631B172604209AFEB248F45DC05FAABBB8FB48750F14812AF919E72C0D775E914CBA4

Function 00D3C1B0 Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000002), ref: 00D3C1D0
GetWindowRect.USER32(00000000,?), ref: 00D3C1E6
ShowWindow.USER32(00000000,00000000,?,?,?,?,?,?,?,00D435EA,?,?,?,?,?,?), ref: 00D3C1FF
InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,?,?,?,00D435EA,?,?), ref: 00D3C20A
GetDlgItem.USER32(?,000003E9), ref: 00D3C21C
GetWindowRect.USER32(00000000,?), ref: 00D3C232
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206,?,?,?,?,?,?,?,00D435EA), ref: 00D3C275

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$Rect$Item$InvalidateShow
String ID:
API String ID: 2147159307-0
Opcode ID: 4b413528b3ad0c08617b6d56df2a998999d0b52d87d58758149acebc0401e34a
Instruction ID: cf990b1d183975f29fde2531644ef9f09c969877a7ed7a1107fa0c3a628a08e9
Opcode Fuzzy Hash: 4b413528b3ad0c08617b6d56df2a998999d0b52d87d58758149acebc0401e34a
Instruction Fuzzy Hash: F4216B71608300AFD300DF25CC49E6B7BE8EF8D710F008669F899E6291E731E9868B52

Function 00D40160 Relevance: 9.4, APIs: 6, Instructions: 354fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,6C34C19C,?,?,00000002,?,?,?,?,?,?,00000000,00E232F2), ref: 00D401B7
GetLastError.KERNEL32(?,00000002), ref: 00D40449
GetLastError.KERNEL32(?,00000002), ref: 00D404F3
GetLastError.KERNEL32(?,00000002,?,?,?,?,?,?,00000000,00E232F2,000000FF,?,00D3F05A,00000010), ref: 00D401C6

Part of subcall function 00D1E5B0: FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,6C34C19C,?,00000000), ref: 00D1E5FB
Part of subcall function 00D1E5B0: GetLastError.KERNEL32(?,00000000), ref: 00D1E605

ReadFile.KERNEL32(?,00000000,00000008,80070057,00000000,?,00000002), ref: 00D40288
ReadFile.KERNEL32(?,6C34C19C,00000000,00000000,00000000,00000001,?,00000002), ref: 00D40305

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ErrorLast$File$Read$FormatMessagePointer
String ID:
API String ID: 3903527278-0
Opcode ID: 8720f6aac9d628ba238f402bcbc8b2b2633cdc2973095bd79f6237154c0a8f03
Instruction ID: fe7515da64002702da753e7833a512cf7b052cfd0ac20c74a19296aec9e8d793
Opcode Fuzzy Hash: 8720f6aac9d628ba238f402bcbc8b2b2633cdc2973095bd79f6237154c0a8f03
Instruction Fuzzy Hash: 40D17271D00209DFDB00DFA8D885BADBBB5FF44314F188269E915AB392EB749945CBA0

Function 6C6151A0 Relevance: 9.3, APIs: 6, Instructions: 251fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,F1829F80,?,00000000), ref: 6C61524F
GetFileSize.KERNEL32(00000000,00000000), ref: 6C61537B
WriteFile.KERNEL32(00000000,0000FEFF,00000002,?,00000000), ref: 6C6153A7
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 6C6153BD
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 6C615400
CloseHandle.KERNEL32(00000000), ref: 6C615465

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$Write$CloseCreateHandlePointerSize
String ID:
API String ID: 3932932802-0
Opcode ID: d77c7ab0bf51db0d81d2fb673dfaab1c1c70cfd7a54fc012cd1b818182b813d8
Instruction ID: e98826a0fa45f64aadb96e46fd141fb93c5714720f3396df4b8e1dcc2f0fc185
Opcode Fuzzy Hash: d77c7ab0bf51db0d81d2fb673dfaab1c1c70cfd7a54fc012cd1b818182b813d8
Instruction Fuzzy Hash: 34A17E70D05208DFEB10CFA9C955BEEFBB4BF05309F208219E525A7A81D774AA44CF99

Function 00D1B720 Relevance: 9.2, APIs: 6, Instructions: 233COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,6C34C19C,00000000,?,?), ref: 00D1B76B
CreateDirectoryW.KERNEL32(?,00000000,?,00000000,00E54494,00000001,?,?,?,?,?,00000000,00E1C395,000000FF,?,00D5EC41), ref: 00D1B82A
GetLastError.KERNEL32(?,?,?,?,00000000,00E1C395,000000FF,?,00D5EC41,00000000,?,00000000), ref: 00D1B838

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath
String ID:
API String ID: 953296794-0
Opcode ID: 1fc78e2da6738751fa85bf43f6f46d4e0390e296cc9f7274e7ec8c6bab7c3c65
Instruction ID: f4944b1aee60590b5d097b0c6b6c81d086096f7e426d742329dac530609f7934
Opcode Fuzzy Hash: 1fc78e2da6738751fa85bf43f6f46d4e0390e296cc9f7274e7ec8c6bab7c3c65
Instruction Fuzzy Hash: F881E271A04608AFDB10DFA8D889BDDBBB4EF15720F24425AE920A72D1DB709945CFA0

Function 00D437D0 Relevance: 9.1, APIs: 6, Instructions: 69threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00D5EF30,00E60B08,00000000,?), ref: 00D4384D
GetLastError.KERNEL32 ref: 00D4385A
WaitForSingleObject.KERNEL32(00000000,FFFFFFFF), ref: 00D43883
GetExitCodeThread.KERNEL32(00000000,?), ref: 00D4389D
TerminateThread.KERNEL32(00000000,00000000), ref: 00D438B5
CloseHandle.KERNEL32(00000000), ref: 00D438BE

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Thread$CloseCodeCreateErrorExitHandleLastObjectSingleTerminateWait
String ID:
API String ID: 1566822279-0
Opcode ID: 8f8bfe002994f65ba39419d7baee46068276afea358d7eed11ea7fa090cf7f41
Instruction ID: 9bba12693607456877d8faaee90dc359c049adb8b4eefe679a25617f8acd75b8
Opcode Fuzzy Hash: 8f8bfe002994f65ba39419d7baee46068276afea358d7eed11ea7fa090cf7f41
Instruction Fuzzy Hash: 8531C571900219AFDF10DFA9DD49BDEBBB4FB08714F104219E811B6290D7B99A08CFA4

Function 00D25480 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 196COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(80004005,00E23C95,6C34C19C,?,?,?,?,?,00000000,00E23C95,000000FF,?,80004005,6C34C19C,?), ref: 00D254E5
GetFileVersionInfoW.KERNELBASE(80004005,?,00000000,000000FF,00000000,?,?,?,?,00000000,00E23C95,000000FF,?,80004005,6C34C19C,?), ref: 00D25533

Strings

ProductName, xrefs: 00D25593
\StringFileInfo\%04x%04x\%s, xrefs: 00D2559D
\VarFileInfo\Translation, xrefs: 00D25567

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: FileInfoVersion$Size
String ID: ProductName$\StringFileInfo\%04x%04x\%s$\VarFileInfo\Translation
API String ID: 2104008232-2149928195
Opcode ID: bbcc1bd026eb4988a0de4ee80ccd3971b481a917f0de9cdc2e20ed5db080850a
Instruction ID: d56474198820f66f7ab7358567620953d20fca66736e5a157581205297361b2b
Opcode Fuzzy Hash: bbcc1bd026eb4988a0de4ee80ccd3971b481a917f0de9cdc2e20ed5db080850a
Instruction Fuzzy Hash: EF61A171901519DFDB10DFA8E849EAEB7F8FF25315F188169E811E7291D7309D04CB60

Function 00D25370 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D24F80: SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,6C34C19C,00000000,00000000,?), ref: 00D24FD5
Part of subcall function 00D24F80: GetTempPathW.KERNEL32(00000104,?), ref: 00D25069
Part of subcall function 00D24F80: GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 00D2509A

GetFileVersionInfoSizeW.KERNELBASE(?,000000FF,Shlwapi.dll,6C34C19C,00000000,?,?,00000000,00E1D9C5,000000FF,Shlwapi.dll,00D25326,?,?,?), ref: 00D253BD
GetFileVersionInfoW.KERNELBASE(?,?,?,00000000,00000000,?,?), ref: 00D253E9
GetLastError.KERNEL32(?,?), ref: 00D2542E
DeleteFileW.KERNEL32(?), ref: 00D25441

Strings

Shlwapi.dll, xrefs: 00D25370, 00D253A8

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$InfoPathTempVersion$DeleteErrorFolderLastNameSize
String ID: Shlwapi.dll
API String ID: 2355151265-1687636465
Opcode ID: 3efdfd35cc21d2a90802832da1b7223912b2795757973e9c7c7cc022460db098
Instruction ID: 87593645d3c1e418790b670df68370003e6c8cf34db8afa26a05cca2a2f3fb60
Opcode Fuzzy Hash: 3efdfd35cc21d2a90802832da1b7223912b2795757973e9c7c7cc022460db098
Instruction Fuzzy Hash: ED319C71904219AFCB10DFA5E844FEEFBB8EF18315F18412AE806B3290D7349985CBB0

Function 00D230C0 Relevance: 7.8, APIs: 5, Instructions: 292COMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,00000000,?,00000100), ref: 00D231BC
LoadStringW.USER32(?,00000000,?,00000001), ref: 00D23264

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: LoadString
String ID:
API String ID: 2948472770-0
Opcode ID: dcba534ac5a900fa04e8deb800f3d9f3132f96ed2832bb98a496fb80c9a44597
Instruction ID: 2acfce2e5b739ceec3be3c67d21a03c9d6572625ecb19eed523bc206f97b699d
Opcode Fuzzy Hash: dcba534ac5a900fa04e8deb800f3d9f3132f96ed2832bb98a496fb80c9a44597
Instruction Fuzzy Hash: 84B17CB1D00218EFDB04DFA8D845BEEBBB5FF58314F148229E415B7280DB796A45CBA4

Function 00D5E990 Relevance: 7.7, APIs: 5, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,6C34C19C,?,?,00000000,?,?,?,?,00E2941D,000000FF,?,00D40E0E), ref: 00D5E9D0
CreateThread.KERNEL32(00000000,00000000,00D5ECE0,?,00000000,?), ref: 00D5EA06
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00D5EB0F
GetExitCodeThread.KERNEL32(00000000,?), ref: 00D5EB1A
CloseHandle.KERNEL32(00000000), ref: 00D5EB3A

Part of subcall function 00C18590: RaiseException.KERNEL32(6C34C19C,6C34C19C,00000000,00000000,00DB3F71,C000008C,00000001,?,00DB3FA2,00000000,?,?,?,00C090D7,00000000,6C34C19C), ref: 00C1859C

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CreateThread$CloseCodeEventExceptionExitHandleObjectRaiseSingleWait
String ID:
API String ID: 3595790897-0
Opcode ID: abba6ba8219efd2d4985c950f22a25cb7efb4492177512d71ca1877f0f44e741
Instruction ID: db8b1923a8d1b259873cec1eb0c6fda5fe6386a99b68807f82ca67048f096910
Opcode Fuzzy Hash: abba6ba8219efd2d4985c950f22a25cb7efb4492177512d71ca1877f0f44e741
Instruction Fuzzy Hash: 4A518A74A00709DFCB28DF68C884BAABBF5FF49311F244659E916A7391D730A944CFA0

Function 00D1ABE0 Relevance: 7.7, APIs: 5, Instructions: 161fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?), ref: 00D1AD04
SetFileAttributesW.KERNEL32(?,00000000), ref: 00D1AD11
GetFileAttributesW.KERNEL32(?,?,?,00E59138,00000001,6C34C19C,?,0000000A,00000000,00000000,00E1C175,000000FF), ref: 00D1AD20
SetFileAttributesW.KERNEL32(?,00000000), ref: 00D1AD2D
FindNextFileW.KERNELBASE(?,?), ref: 00D1AD6B

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$Attributes$FindNext
String ID:
API String ID: 3019667586-0
Opcode ID: 48f24dc4cf3f819965e52d31c8d2e0936206eabd1aea3484d68c4262cf9f3620
Instruction ID: 3045dac18528fe0f82289bf0fae015fed59e786d0407f810d076c239c7f665fa
Opcode Fuzzy Hash: 48f24dc4cf3f819965e52d31c8d2e0936206eabd1aea3484d68c4262cf9f3620
Instruction Fuzzy Hash: CE51A030502649AFDB24EF68ED54BEE77B4EF00311F184219E815A75E1EB709D84CB62

Function 6C6302CB Relevance: 7.6, APIs: 5, Instructions: 87COMMONLIBRARYCODE

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6C630308
dllmain_crt_dispatch.LIBCMT ref: 6C63031F
dllmain_raw.LIBCMT ref: 6C630367
dllmain_crt_dispatch.LIBCMT ref: 6C63037A
dllmain_raw.LIBCMT ref: 6C63038D

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 4cc3525d7a4ff6b2b6a67ba597a76fed2e96b5a3fe585034e80f17526af6046a
Instruction ID: 10ec5e7e56ad5f275472790b7a3a8e97842fd4aacad4071c8721e91bdc71366b
Opcode Fuzzy Hash: 4cc3525d7a4ff6b2b6a67ba597a76fed2e96b5a3fe585034e80f17526af6046a
Instruction Fuzzy Hash: 6721AB71D456B6ABEB118E15C880AAF3A79EB41758F007115FD1C5F710D3314D098BEC

Function 00C1845B Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 00C18470
GetWindowLongW.USER32(?,000000FC), ref: 00C18485
CallWindowProcW.USER32(?,?,00000082,?,?), ref: 00C1849B
GetWindowLongW.USER32(?,000000FC), ref: 00C184B5
SetWindowLongW.USER32(?,000000FC,?), ref: 00C184C5

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$Long$CallProc
String ID:
API String ID: 513923721-0
Opcode ID: 3465acab50174cfd833276aa8becb5d921dbed5ec80b764c512471f9664ec536
Instruction ID: cc6522e35829d53e9d7921c60f1e7e94f8de5b89dc5185f945f3c8977f04c479
Opcode Fuzzy Hash: 3465acab50174cfd833276aa8becb5d921dbed5ec80b764c512471f9664ec536
Instruction Fuzzy Hash: BF21FF72108600AFC7219F29DC84D57FBF5FB89720B108A2DF5EA92660DB32E955AF50

Function 00D1BFF0 Relevance: 7.6, APIs: 5, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjectsEx.USER32(00000001,00000000,000000FF,000005FF,00000004), ref: 00D1C011
PeekMessageW.USER32(?,00000000), ref: 00D1C057
TranslateMessage.USER32(00000000), ref: 00D1C062
DispatchMessageW.USER32(00000000), ref: 00D1C069
MsgWaitForMultipleObjectsEx.USER32(00000001,?,000000FF,000005FF,00000004), ref: 00D1C07B

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Message$MultipleObjectsWait$DispatchPeekTranslate
String ID:
API String ID: 4084795276-0
Opcode ID: f4af65635278be54572d61f701dcbfc2f9ed073fbbd01c865658be7a55148d1e
Instruction ID: 43d0c155a8ba752d60afb4c94035f264243d17a74f452c13169bde9ca260e97c
Opcode Fuzzy Hash: f4af65635278be54572d61f701dcbfc2f9ed073fbbd01c865658be7a55148d1e
Instruction Fuzzy Hash: 22115971A84305BEE320CB55AC81FE7B7DCEB88764F500236FA50A20C0DB31E9898B31

Function 6C627A60 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 421COMMON

Download Yara Rule

APIs

Part of subcall function 6C608270: GetProcessHeap.KERNEL32 ref: 6C6082CC

PathIsUNCW.SHLWAPI(00000010), ref: 6C627CCD

Strings

\\?\UNC\, xrefs: 6C627AF6, 6C627BB9, 6C627BBF
gkal, xrefs: 6C627ECF, 6C627EE5
\\?\, xrefs: 6C627C6E, 6C627C74

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: HeapPathProcess
String ID: \\?\$\\?\UNC\$gkal
API String ID: 300331711-113488020
Opcode ID: dd4a204b37e65d0fd865c20b6118e0987ecbc8dc61ac051130407ac36fbaafc9
Instruction ID: f6bfaf62ea48b2ac6065c5293c5dbec6b164d8e8386fc39a963d52bcb218704b
Opcode Fuzzy Hash: dd4a204b37e65d0fd865c20b6118e0987ecbc8dc61ac051130407ac36fbaafc9
Instruction Fuzzy Hash: 8DF19071A0150ADFDB04CFA8C844B9EF7B5FF45318F148669D421A7790DB39A909CFA8

Function 00D59FE0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 257filepipeCOMMON

Download Yara Rule

APIs

ConnectNamedPipe.KERNEL32(?,00000000,6C34C19C,?,000000FF,?,?,00000000,00E2863E,000000FF,?,00D5A25A,000000FF,?,00000001), ref: 00D5A01C
GetLastError.KERNEL32(?,?,00000000,00E2863E,000000FF,?,00D5A25A,000000FF,?,00000001), ref: 00D5A026

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

ReadFile.KERNEL32(?,?,00007F90,?,00000000,6C34C19C,?,000000FF,?,?,00000000,00E2863E,000000FF,?,00D5A25A,000000FF), ref: 00D5A073

Strings

\\.\pipe\ToServer, xrefs: 00D5A2E4, 00D5A2F5, 00D5A2FF

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Init_thread_footer$ConnectErrorFileHeapLastNamedPipeProcessRead
String ID: \\.\pipe\ToServer
API String ID: 2973225359-63420281
Opcode ID: 8394d367f15cc03f2af8e697d4b79159f234b6eb8d267f3652160302e3a46179
Instruction ID: a05fc3916fb7ba01865a2a71435a78b56e43cd9c20041b37c367724ad25a553e
Opcode Fuzzy Hash: 8394d367f15cc03f2af8e697d4b79159f234b6eb8d267f3652160302e3a46179
Instruction Fuzzy Hash: DD91BF71A002189FDF14DF6CC805BAAB7A4FF45324F14866DED269B3C1DB75A904CBA1

Function 6C627EB0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 175COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,F1829F80,00000000,00000000,?,?,00000000,6C6616B5,000000FF,?,6C616B67,?,00000000), ref: 6C627EF9
CreateDirectoryW.KERNEL32(00000000,00000000,?,?,6C67A1AC,00000001,?), ref: 6C627FAD
GetLastError.KERNEL32 ref: 6C627FB7

Strings

gkal, xrefs: 6C627ECF, 6C628084, 6C627EE5

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath
String ID: gkal
API String ID: 953296794-4225057778
Opcode ID: 3604020e021658b7c1217fdb0b199bc593b804293e860ac539dd03b53e93f197
Instruction ID: e0c7772aa435b759b9c2ac5b64412010d6a0cc0150f1247148b96cf3d5b47548
Opcode Fuzzy Hash: 3604020e021658b7c1217fdb0b199bc593b804293e860ac539dd03b53e93f197
Instruction Fuzzy Hash: BF519131A04609DBDB00CFA9C884B9DFBB4EF4A324F24825AD421A76D0DB799904CF59

Function 6C605E00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,F1829F80,00000034), ref: 6C605E5C
GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 6C605E7E

Strings

%08X, xrefs: 6C605EB3
AABBCCDD, xrefs: 6C605E9E

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: FolderInformationPathVolume
String ID: %08X$AABBCCDD
API String ID: 1564939276-726327320
Opcode ID: 68d5b4eb6399e4c3125619bf135be97208b6cc80885030b8f891bd2609522057
Instruction ID: 5b717b3fc24ed365323fbdbc9609ef5756682e0838b9796504c2947b9101ed2f
Opcode Fuzzy Hash: 68d5b4eb6399e4c3125619bf135be97208b6cc80885030b8f891bd2609522057
Instruction Fuzzy Hash: 27313DB05143499FDB24CF64DD44BEABBF8FB04704F004A2EE955DBA80E7B466488B99

Function 00D1AEF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,00000000,?,\\?\,00000004,?,?,?,00000000,00E18D5D,000000FF,?,80004005,6C34C19C,?), ref: 00D1AF93

Part of subcall function 00C092A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00C21134,00000000,?,00000010,?,*.*,?,80070057), ref: 00C092C3

DeleteFileW.KERNEL32(?,6C34C19C,?,74DF3340,?,00000000,00E18D5D,000000FF,?,00D1AD37), ref: 00D1AFC2
GetLastError.KERNEL32(?,?,?,00000000,00E18D5D,000000FF,?,80004005,6C34C19C,?,?,?,?,00E18D5D,000000FF), ref: 00D1AFD2

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

Strings

\\?\, xrefs: 00D1AE44, 00D1AE56, 00D1AE60, 00D1AF54, 00D1AF66, 00D1AF70

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: DeleteFileInit_thread_footer$ErrorFindHeapLastProcessResource
String ID: \\?\
API String ID: 1908169709-4282027825
Opcode ID: 32b4edfd98ff249e929d4317be3b80f75fc6e2275c2b522a5508b1e1af21bee2
Instruction ID: 75d4203eb4bc6b242d0838287c400648be9e6566f06f82835194c4c837ddbcd4
Opcode Fuzzy Hash: 32b4edfd98ff249e929d4317be3b80f75fc6e2275c2b522a5508b1e1af21bee2
Instruction Fuzzy Hash: EB21DEB2901618EFDB04DF69E808BAEBBA4FF05320F15465AF861D72E1CB319945CF61

Function 00D349A0 Relevance: 6.1, APIs: 4, Instructions: 145fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,6C34C19C,?,00000010,?,00D37D90,?), ref: 00D34A06
SetFilePointer.KERNEL32(00000000,?,00000010,00000000), ref: 00D34A4F
ReadFile.KERNEL32(00000000,6C34C19C,?,?,00000000,00000078,?), ref: 00D34A91
CloseHandle.KERNEL32(00000000), ref: 00D34B0A

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$CloseCreateHandlePointerRead
String ID:
API String ID: 4133201480-0
Opcode ID: 80d1db99c6bda94fdabe08d1bbcbaaca1f54a552811bbd750e53942610350346
Instruction ID: 4e2cc61ad6f11d55ed028165ed1b0b06fc5ee849ad084dbaa6c2127505d4ca46
Opcode Fuzzy Hash: 80d1db99c6bda94fdabe08d1bbcbaaca1f54a552811bbd750e53942610350346
Instruction Fuzzy Hash: B8517D71A016099FDB11CFA8CC49BEEFBB8EF45324F188259E411AB2D1D778AD05CB64

Function 00D3C140 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00D3C149
DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00E212D0,000000FF), ref: 00D3C158
PostMessageW.USER32(?,00000401,00000000,00000000), ref: 00D3C176
IsWindow.USER32(?), ref: 00D3C185

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$CurrentDestroyMessagePostThread
String ID:
API String ID: 3186974096-0
Opcode ID: a8822e09d837a99345653042bfa5a3258dd1d293b51883d13d72ea5a4fabca99
Instruction ID: c25e11e35d32ffd46d67ae628246ecf521b75461b1628ca0f4e1f87d0cc98961
Opcode Fuzzy Hash: a8822e09d837a99345653042bfa5a3258dd1d293b51883d13d72ea5a4fabca99
Instruction Fuzzy Hash: 2BF0E270019B409ED3309B29EE08F03BFE16B58B00F041A5DE082A6A90C3B1F845CF24

Function 00C10570 Relevance: 4.8, APIs: 3, Instructions: 345fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,?,00000000,?,6C34C19C,?), ref: 00C105E2
MoveFileW.KERNEL32(?,00000000), ref: 00C10835
DeleteFileW.KERNEL32(?), ref: 00C1087F

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$DeleteMoveNameTemp
String ID:
API String ID: 788073729-0
Opcode ID: fea8cfcf607709054e5229da03083f5944936d1b5ff4f8a6c669baddf0b076ae
Instruction ID: 0e1081ca8db8f36e6ceb10a6ce701f118eb512408df44c26a4b494b514834274
Opcode Fuzzy Hash: fea8cfcf607709054e5229da03083f5944936d1b5ff4f8a6c669baddf0b076ae
Instruction Fuzzy Hash: 68F18870D15268CADB24DF28CC987DDBBB0AF45304F2042C9D409A7291EBB96BC4DFA0

Function 00C101A0 Relevance: 4.8, APIs: 3, Instructions: 275fileCOMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNEL32(?,?,00000000,?,6C34C19C,?,00000004), ref: 00C101FB
DeleteFileW.KERNEL32(?,?,00000004), ref: 00C1023E
CreateDirectoryW.KERNEL32(?,00000000,?,00000004), ref: 00C1024D

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$CreateDeleteDirectoryNameTemp
String ID:
API String ID: 2411147693-0
Opcode ID: dd7a93eea3367bd32ffb4c1cf36c2e5fbebb257424b56bc7890cdc859a13eed6
Instruction ID: 999376c20072a781dd3239ce745dda267295868c99addf83ec27dae77c126d27
Opcode Fuzzy Hash: dd7a93eea3367bd32ffb4c1cf36c2e5fbebb257424b56bc7890cdc859a13eed6
Instruction Fuzzy Hash: 69B17AB0D00248DBDB14DF68C9997EEBBB4EF45314F24429DE405A7291DBB86B84DFA0

Function 00D6F220 Relevance: 4.7, APIs: 3, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00D6F900: OpenEventW.KERNEL32(00000000,00000000,00000000,_pbl_evt,00000008,?,?,00E5BE58,00000001,6C34C19C,00000000), ref: 00D6F9AE
Part of subcall function 00D6F900: CreateEventW.KERNEL32(00000000,00000001,00000001,?), ref: 00D6F9CB

WaitForSingleObject.KERNEL32(00000000,00000000,00000001,6C34C19C,?,00000000), ref: 00D6F26E
ResetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00E2B2E9,000000FF), ref: 00D6F283

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Event$CreateObjectOpenResetSingleWait
String ID:
API String ID: 2109722436-0
Opcode ID: 446f6b7b7ed4bd65d82b3a3e557094bcfce2963d199d8f6dedca6cac7791ea67
Instruction ID: 4faf8238005ba7aad237931de86c9f1bc50fedbafa0c25bc6375f5e2a6893fb5
Opcode Fuzzy Hash: 446f6b7b7ed4bd65d82b3a3e557094bcfce2963d199d8f6dedca6cac7791ea67
Instruction Fuzzy Hash: 0481D071D00648DFDB04CFA8D845B9EBBB0FF55314F24826DE404AB392D775AA46CBA0

Function 00DCEA0C Relevance: 4.7, APIs: 3, Instructions: 202COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 00DCEBBB

Part of subcall function 00DCCA67: RtlAllocateHeap.NTDLL(00000000,00000000,00DCA813,?,00DCE9B8,?,00000000,?,00DBE5A5,00000000,00DCA813,?,?,?,?,00DCA60D), ref: 00DCCA99

__freea.LIBCMT ref: 00DCEBD0
__freea.LIBCMT ref: 00DCEBE0

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID:
API String ID: 2243444508-0
Opcode ID: f44b2741edfa7a25b39c78eaccfd84046a3c87d7e2a8dc06dd8c11a93db905de
Instruction ID: 844c426ec751fc734fc1700d2f8ae2d08c0b926f0c0206aad7254adc60e80575
Opcode Fuzzy Hash: f44b2741edfa7a25b39c78eaccfd84046a3c87d7e2a8dc06dd8c11a93db905de
Instruction Fuzzy Hash: DC519FB2600217AFEF259FA4DC82FBB3BAAEB44750B19012DFD0AD7151E670CD109670

Function 00D3FC90 Relevance: 4.7, APIs: 3, Instructions: 191fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,6C34C19C,?,?), ref: 00D3FCF7
ReadFile.KERNEL32(?,00000000,00000018,?,00000000), ref: 00D3FE04

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 3bc436127b4a1236b3a84a2c3f7506f165097b8a24a188f74935fbfad388cac3
Instruction ID: 6c433108cf0c9501cf1ed87bffa3bc3dd57358ed2dcd68ac7a26068300aaae74
Opcode Fuzzy Hash: 3bc436127b4a1236b3a84a2c3f7506f165097b8a24a188f74935fbfad388cac3
Instruction Fuzzy Hash: D0617071D00609EFDB04CFA8C845B9DFBB4FF09320F14826AE924A7391DB759A04CBA1

Function 00D3D040 Relevance: 4.7, APIs: 3, Instructions: 183fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,6C34C19C,?,00000000,?,80004005,?,00000000), ref: 00D3D0DE
GetLastError.KERNEL32 ref: 00D3D116
GetLastError.KERNEL32(?), ref: 00D3D1AF

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ErrorLast$CreateFile
String ID:
API String ID: 1722934493-0
Opcode ID: 005925176d5010d181be14c8aacfa2ee1572d6a4dbabcf417e20b0e1a3a070f4
Instruction ID: 5ce51879a02c62ff64704a8402965a91440c1567c26357faf3b60d07f28c1aed
Opcode Fuzzy Hash: 005925176d5010d181be14c8aacfa2ee1572d6a4dbabcf417e20b0e1a3a070f4
Instruction Fuzzy Hash: E251F171A007059FDB20DF68E845B9AF7B2FF44320F148669E915E73E0EB31A905CBA0

Function 00D6C670 Relevance: 4.7, APIs: 3, Instructions: 181fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00D6D5B6,40000000,00000001,00000000,00000002,00000080,00000000,6C34C19C,?,00000001), ref: 00D6C6D2
WriteFile.KERNEL32(00000000,0000C800,0000C800,0000C800,00000000,?,0000C800), ref: 00D6C768
CloseHandle.KERNEL32(00000000,?,0000C800), ref: 00D6C7DC

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID:
API String ID: 1065093856-0
Opcode ID: 7fa63d0ca397bfa26ac9f51e722341ae164bd9bf3dbaed5f330d7297bfd3efc5
Instruction ID: aee788a8d6cae5786797f6382f04ac8fa75b5169f1462f0fbd6bffa940f0fc8b
Opcode Fuzzy Hash: 7fa63d0ca397bfa26ac9f51e722341ae164bd9bf3dbaed5f330d7297bfd3efc5
Instruction Fuzzy Hash: 8A516871A10219AFDF14DFA8DD49BEEBBB9FF48310F144259E800B7290DB75A904CBA4

Function 00D19470 Relevance: 4.6, APIs: 3, Instructions: 142fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,0000002A,00000000,?,6C34C19C), ref: 00D194E0
DeleteFileW.KERNEL32(?,?,00000000,0000002A,00000000,?,6C34C19C), ref: 00D1957A
FindNextFileW.KERNEL32(?,?), ref: 00D195BB

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$Delete$FindNext
String ID:
API String ID: 1410743141-0
Opcode ID: da1e946aafe62a6270b9cadf17270bcb6941930c9aab02a95fcae73014b8fe90
Instruction ID: 2d5cb88b1d3fd1249f6559334daa3fb06417b2a036df0815e94c446cac84b0f9
Opcode Fuzzy Hash: da1e946aafe62a6270b9cadf17270bcb6941930c9aab02a95fcae73014b8fe90
Instruction Fuzzy Hash: 26518530901218AFEF25DF58D9A9BEDF775EF05320F144299E819A72D1DB309D85CB60

Function 00D3BF40 Relevance: 4.6, APIs: 3, Instructions: 80COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00D3B881), ref: 00D3BF40
EnableWindow.USER32(?,00000000), ref: 00D3BFD1
DestroyWindow.USER32(?,?,?), ref: 00D3BFF7

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$DestroyEnableErrorLast
String ID:
API String ID: 2755773105-0
Opcode ID: 82981ec4252fdafcf996a5e678f5e4fb0d8aec1d0a9a603cce5513cb03890d79
Instruction ID: c461ed93395cba24c917603e4eed79e4c27ff15313421e76bc6214c67eaa2fa6
Opcode Fuzzy Hash: 82981ec4252fdafcf996a5e678f5e4fb0d8aec1d0a9a603cce5513cb03890d79
Instruction Fuzzy Hash: 892102B56141099BDB209F18EC41BAAB794EB54320F004227FD08C7391C7B6EC65DBF1

Function 00DBFD83 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00DBFD7D,?,00DB9912,?,?,6C34C19C,00DB9912,?), ref: 00DBFD94
TerminateProcess.KERNEL32(00000000,?,00DBFD7D,?,00DB9912,?,?,6C34C19C,00DB9912,?), ref: 00DBFD9B
ExitProcess.KERNEL32 ref: 00DBFDAD

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: aa54f16406950356ffa1b88cb2f0e65db099a60f94dcca5aff4c57f128af048d
Instruction ID: 14192b08b3507c9ae168ce974e2763f1bb07a3f360b8df5cef937b0e63fee4cb
Opcode Fuzzy Hash: aa54f16406950356ffa1b88cb2f0e65db099a60f94dcca5aff4c57f128af048d
Instruction Fuzzy Hash: ACD09E3100050CFFCF412FA2EC4D9DE3F26EF44345B144024B90A66033DBB1D996DA60

Function 00D1BB70 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000025,00000000,6C34C19C), ref: 00D1BD10

Part of subcall function 00D1BDD0: GetEnvironmentVariableW.KERNEL32(00000000,00000000,00000000,?,?,?,80004005), ref: 00D1BDDD

Strings

USERPROFILE, xrefs: 00D1BBBE

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Init_thread_footer$EnvironmentFolderHeapPathProcessSpecialVariable
String ID: USERPROFILE
API String ID: 1777821646-2419442777
Opcode ID: 0a3d2d3bcae7ac57b68d4e24638e47acfe9de52e87f6743790b3206dd93f7bd1
Instruction ID: 01a06f3510eca33220eed17b3464829cb6817469c438d7814574ee5dfd55a6e1
Opcode Fuzzy Hash: 0a3d2d3bcae7ac57b68d4e24638e47acfe9de52e87f6743790b3206dd93f7bd1
Instruction Fuzzy Hash: 6061C071A00605AFDB14DF68D859BEEB7A5EF44320F14866EE816DB392DF309904CBA0

Function 00D5A1A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,6C34C19C,?,00000010,?,?,00E2868E,000000FF), ref: 00D5A228

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

Part of subcall function 00D59FE0: ConnectNamedPipe.KERNEL32(?,00000000,6C34C19C,?,000000FF,?,?,00000000,00E2863E,000000FF,?,00D5A25A,000000FF,?,00000001), ref: 00D5A01C
Part of subcall function 00D59FE0: GetLastError.KERNEL32(?,?,00000000,00E2863E,000000FF,?,00D5A25A,000000FF,?,00000001), ref: 00D5A026

Strings

\\.\pipe\ToServer, xrefs: 00D5A2E4, 00D5A2F5, 00D5A2FF

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Init_thread_footer$ConnectErrorFileHeapLastNamedPipeProcessWrite
String ID: \\.\pipe\ToServer
API String ID: 3549655173-63420281
Opcode ID: c891d7bfcf6d75f46328886d6cca375f2dd9edc2fd9d365da2553c9e9f5e0704
Instruction ID: 57caeb25bd0c0ad99c496658c37283af39634f35e30424dc542447ef1c61b264
Opcode Fuzzy Hash: c891d7bfcf6d75f46328886d6cca375f2dd9edc2fd9d365da2553c9e9f5e0704
Instruction Fuzzy Hash: A4417C71A04218EFDB04CF58D805BAEB7E8EF45724F10426EEC15DB381DB76A904CBA4

Function 00C092A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 00C090A0: FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,6C34C19C,?,?,*.*,?,00000000,00DDCB30,000000FF,?,00C092B0,?), ref: 00C090F6

FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00C21134,00000000,?,00000010,?,*.*,?,80070057), ref: 00C092C3

Part of subcall function 00C09160: LoadResource.KERNEL32(00000000,00000000,6C34C19C,00000001,00000000,?,00000000,00DDC480,000000FF,?,00C0910C,6C34C19C,?,?,*.*,?), ref: 00C0918B
Part of subcall function 00C09160: LockResource.KERNEL32(00000000,?,00C0910C,6C34C19C,?,?,*.*,?,00000000,00DDCB30,000000FF,?,00C092B0,?,?,*.*), ref: 00C09196
Part of subcall function 00C09160: SizeofResource.KERNEL32(00000000,00000000,?,00C0910C,6C34C19C,?,?,*.*,?,00000000,00DDCB30,000000FF,?,00C092B0,?,?), ref: 00C091A4

Strings

*.*, xrefs: 00C092A0

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Resource$Find$LoadLockSizeof
String ID: *.*
API String ID: 3127896203-438819550
Opcode ID: 6745a363630c7826c61b44abcb379f6aee18e1c34a9d6d52f7393aedd8db57f8
Instruction ID: 01277d14b9892978bdc6bc5310ff27af236d5ca21df890daa7a9ab2ac347984d
Opcode Fuzzy Hash: 6745a363630c7826c61b44abcb379f6aee18e1c34a9d6d52f7393aedd8db57f8
Instruction Fuzzy Hash: 7211C172300125AFD7049B69D888ABBB39DEF88310B10802EF555CB292DB76DD11DBA0

Function 00C090A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00DB3F72: EnterCriticalSection.KERNEL32(00EC7F5C,?,?,?,00C090D7,00000000,6C34C19C,?,?,*.*,?,00000000,00DDCB30,000000FF,?,00C092B0), ref: 00DB3F7D
Part of subcall function 00DB3F72: LeaveCriticalSection.KERNEL32(00EC7F5C,?,?,?,00C090D7,00000000,6C34C19C,?,?,*.*,?,00000000,00DDCB30,000000FF,?,00C092B0), ref: 00DB3FA9

FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,6C34C19C,?,?,*.*,?,00000000,00DDCB30,000000FF,?,00C092B0,?), ref: 00C090F6

Part of subcall function 00C09160: LoadResource.KERNEL32(00000000,00000000,6C34C19C,00000001,00000000,?,00000000,00DDC480,000000FF,?,00C0910C,6C34C19C,?,?,*.*,?), ref: 00C0918B
Part of subcall function 00C09160: LockResource.KERNEL32(00000000,?,00C0910C,6C34C19C,?,?,*.*,?,00000000,00DDCB30,000000FF,?,00C092B0,?,?,*.*), ref: 00C09196
Part of subcall function 00C09160: SizeofResource.KERNEL32(00000000,00000000,?,00C0910C,6C34C19C,?,?,*.*,?,00000000,00DDCB30,000000FF,?,00C092B0,?,?), ref: 00C091A4

Strings

*.*, xrefs: 00C090B2

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Resource$CriticalSection$EnterFindLeaveLoadLockSizeof
String ID: *.*
API String ID: 529824247-438819550
Opcode ID: 31555e34a09ab5349e3ee8252a5cb17c61ca26d4bd81d8c8ec1e6c433f4181b1
Instruction ID: 40bc7f38f0a34efcc9d3a63ea2d2b8df077d487356cd1cc806204c45d5c85ddd
Opcode Fuzzy Hash: 31555e34a09ab5349e3ee8252a5cb17c61ca26d4bd81d8c8ec1e6c433f4181b1
Instruction Fuzzy Hash: 7911C832F04215ABD7254B59AC82B7AB3E8EB48B60F00027EFD16D33C1DA759D018690

Function 00DD47BA Relevance: 3.2, APIs: 2, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 00DD42EA: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00DD4315

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00DD4601,?,00000000,?,?,?), ref: 00DD481B
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00DD4601,?,00000000,?,?,?), ref: 00DD485D

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 898ac6e0af398b94d757c7be51067e5be8ecf8fe8bddef40a1914119357f106c
Instruction ID: 6450c659541aa1cc76aafd289c0161c71bb059c93a0660a18aeb622c95cf1c23
Opcode Fuzzy Hash: 898ac6e0af398b94d757c7be51067e5be8ecf8fe8bddef40a1914119357f106c
Instruction Fuzzy Hash: 7151F171A007859FEB20CF66C891AABBBF5EF46300F18406FD0969B352D67599468BB0

Function 00D5F3D0 Relevance: 3.1, APIs: 2, Instructions: 129COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00D5F421
EndDialog.USER32(00000000,00000001), ref: 00D5F430

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: DialogWindow
String ID:
API String ID: 2634769047-0
Opcode ID: 15d7118baccaea8a810cba746a432989263e840b64990e9929d0bc4106d8d4dd
Instruction ID: ae00702eb3ec4812405e48c19ba2718d1c16e7cd0cb54d02cda9d3929877f11e
Opcode Fuzzy Hash: 15d7118baccaea8a810cba746a432989263e840b64990e9929d0bc4106d8d4dd
Instruction Fuzzy Hash: 7B518C30901745DFDB11CF69C948B4AFBF4FF45311F1886A9E859EB2A1D770AA08CBA1

Function 6C6280B0 Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000,F1829F80,?,F1829F80,6C66170E,000000FF), ref: 6C628100

Part of subcall function 6C608270: GetProcessHeap.KERNEL32 ref: 6C6082CC

FreeLibrary.KERNEL32(00000000,?,80004005), ref: 6C6281BB

Part of subcall function 6C609680: FindResourceW.KERNEL32(00000000,?,00000006,00000000,?,?,6C628135,-00000010), ref: 6C6096B8

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: FindFolderFreeHeapLibraryPathProcessResourceSpecial
String ID:
API String ID: 584424649-0
Opcode ID: 115e0641ce9d3fcf89d7c38dd5ebe80ae67a60fa8667340b5108f58eb5e34872
Instruction ID: 2d76361e0f400e3ff2ffe9850591b9d0fbb5f021c2bb73499c486f15f859c368
Opcode Fuzzy Hash: 115e0641ce9d3fcf89d7c38dd5ebe80ae67a60fa8667340b5108f58eb5e34872
Instruction Fuzzy Hash: FE31C4716002059FEB18DF69CC18BEE77F8EF09308F10451EE819DBA91DB749A08CB99

Function 00CBC500 Relevance: 3.1, APIs: 2, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000004), ref: 00CBC54A
DestroyWindow.USER32(00000004,?,?,?,?,?,?,?,?,000000FF), ref: 00CBC557

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$Destroy
String ID:
API String ID: 3707531092-0
Opcode ID: af0a9a952eddc4df082f82b8f55cd72ee0561926baaa67ca8fdf23984797a8de
Instruction ID: 3fd20ab4d6f76b7aebf7c03fe3685bee01a7fb63b32fdc263fc6254bfba88398
Opcode Fuzzy Hash: af0a9a952eddc4df082f82b8f55cd72ee0561926baaa67ca8fdf23984797a8de
Instruction Fuzzy Hash: C231A970804689EFDB05DF69C909B8EFBB4BF11310F5482A9E455A36D1DBB0AA08DB91

Function 00D5D7F0 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 00D5D855
CloseHandle.KERNEL32(?), ref: 00D5D8A9

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CloseFreeHandleLibrary
String ID:
API String ID: 10933145-0
Opcode ID: fa2613e365a9c21555da5c123c84d1ac7449c7feae7ec11eef2f70c73b56d7e6
Instruction ID: 230044d7d66b42c64fe74f95a37b237d5ff7121dfca8b02f7ab3a89943f4b364
Opcode Fuzzy Hash: fa2613e365a9c21555da5c123c84d1ac7449c7feae7ec11eef2f70c73b56d7e6
Instruction Fuzzy Hash: D6216D70601A05EFD714DF2ADC4DB56BBE8FB04710F044269E824E7391DB7A9909CFA0

Function 00D1F130 Relevance: 3.0, APIs: 2, Instructions: 41windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D1E740: LoadLibraryW.KERNEL32(ComCtl32.dll,6C34C19C,?,?,00000000), ref: 00D1E77E
Part of subcall function 00D1E740: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00D1E7A1
Part of subcall function 00D1E740: FreeLibrary.KERNEL32(00000000), ref: 00D1E81F

Part of subcall function 00D1E740: LoadImageW.USER32(00000000,?,00000001,00000000,00000000,?), ref: 00D1E801

SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00D1F174
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00D1F17F

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: LibraryLoadMessageSend$AddressFreeImageProc
String ID:
API String ID: 2968665230-0
Opcode ID: 73d8ebaccaf79d57540715aaf8d30020680b7576986f8799e95982cba6430161
Instruction ID: 1f8b62d91ce6255fa9a5a22f2050e3d8b4593fee5238ed6553c8c517881ff4aa
Opcode Fuzzy Hash: 73d8ebaccaf79d57540715aaf8d30020680b7576986f8799e95982cba6430161
Instruction Fuzzy Hash: 45F0A9327802183BF620215A2C47F67B64DDB81B64F144276FE88AB2C2ECC27C0042E9

Function 00DCE778 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

LCMapStringEx.KERNEL32(?,00DCEAFA,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00DCE7AC
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00DCEAFA,?,?,00000000,?,00000000), ref: 00DCE7CA

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: a35416a21da7daf65d3cddae42cfffc92f8c3ac9048448b7e5ac2dc599575fa9
Instruction ID: d67ac54c7e1c09e4263aa0129117ddc7cda57fff096d680283b04d596d2ca712
Opcode Fuzzy Hash: a35416a21da7daf65d3cddae42cfffc92f8c3ac9048448b7e5ac2dc599575fa9
Instruction Fuzzy Hash: 7CF07A3200021ABBCF125F91EC09EDE3F26EF48760F198414FA1866070C736D931ABA4

Function 00D04B40 Relevance: 2.6, APIs: 2, Instructions: 68COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,00000000,00000000,?,?,00EC9384,00D4DA40,?), ref: 00D04B58
MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,?,-00000001), ref: 00D04B8A

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 9e66db6f20eebc68d9e2d36f9510fcd33ce98953ba629288b63ab3a3ae141cf0
Instruction ID: c07845eb8595e9ee07ef2fc6e6f0784c5bf4127008fe14e01c3223ecc1b1c1e9
Opcode Fuzzy Hash: 9e66db6f20eebc68d9e2d36f9510fcd33ce98953ba629288b63ab3a3ae141cf0
Instruction Fuzzy Hash: AB01C072302212AFD6109B59DC8DF5AB759EF94321F20421DF318AB2D1CBA1A815CBA0

Function 00DCCA2D Relevance: 2.5, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,00000000,?,00DCE9C9,00000000,00DCA813,00000000,?,00DBE5A5,00000000,00DCA813,?,?,?,?,00DCA60D), ref: 00DCCA43
GetLastError.KERNEL32(?,?,00DCE9C9,00000000,00DCA813,00000000,?,00DBE5A5,00000000,00DCA813,?,?,?,?,00DCA60D), ref: 00DCCA4E

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 7bb6b5112f2478c5208b5b32f8502bd586753a805a094d4d0540788070c8b3e7
Instruction ID: c038f63ec448518eabf251dbf97d95992138d8c59c28fa6687ae1728616b636f
Opcode Fuzzy Hash: 7bb6b5112f2478c5208b5b32f8502bd586753a805a094d4d0540788070c8b3e7
Instruction Fuzzy Hash: 4FE08C32100228EBCB116FF6EC0DF89BFA8EB00751F148024F708E6061EB7089448BB4

Function 00D41C20 Relevance: 1.7, APIs: 1, Instructions: 214fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,?,?,?,00D3676B,?), ref: 00D41C4B

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 750d1aeff865c7ba3f490ea382e5d236785656c457da2f716e6b8a1c75f2c186
Instruction ID: 4901ae6c758054d83381185e8338764c4e63c99e44cab720512ca10d074641dd
Opcode Fuzzy Hash: 750d1aeff865c7ba3f490ea382e5d236785656c457da2f716e6b8a1c75f2c186
Instruction Fuzzy Hash: 8351E376A00615DFDB20CF68D885B9AFBA4FF05720F148669E915EB381DB71AD40CBB0

Function 00DD43BE Relevance: 1.6, APIs: 1, Instructions: 147COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(E8458D00,?,00DD460D,00DD4601,00000000), ref: 00DD43F0

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: add0ec7f34875874d5d8e38a19f294c3fec5e31c47c1e2c1cb41ea49e7914f2e
Instruction ID: 2a62fd35015be50d04b6749d483d69e193f99bcdc0bd2736d0ecaf9076bf878a
Opcode Fuzzy Hash: add0ec7f34875874d5d8e38a19f294c3fec5e31c47c1e2c1cb41ea49e7914f2e
Instruction Fuzzy Hash: 1F5127715041589BDB218A28DD84FEA7BECEB56304F2405AEE5DAD7242C3749D86DF30

Function 00D1B000 Relevance: 1.6, APIs: 1, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

_wcsrchr.LIBVCRUNTIME ref: 00D1B0C1

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess_wcsrchr
String ID:
API String ID: 3663133277-0
Opcode ID: 441e9ef53b7610ea15c8a55aa67b1850d276af62bdf89a0a39ba6638f3caebbc
Instruction ID: dec0fba250089b9ded33a8de2d882131d9a9657ff344866ab6c44bb3340522c4
Opcode Fuzzy Hash: 441e9ef53b7610ea15c8a55aa67b1850d276af62bdf89a0a39ba6638f3caebbc
Instruction Fuzzy Hash: ED31D170A00605EFCB00DB68D858B9EF7B4EF45320F148259E4249B391DB31AD84CBA0

Function 00D42F70 Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

EnumResourceLanguagesW.KERNEL32(?,00000010,00000001,00D430A0,?), ref: 00D42FBB

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: EnumLanguagesResource
String ID:
API String ID: 4141015960-0
Opcode ID: 45bd8f36071fb4d928968a1facaed87f125398d2a488b64778d9a27fbfbf4478
Instruction ID: 50782ff3598856780b9b7a87d2b91a5f7e2ed20078df4d4edaf562528f8230b8
Opcode Fuzzy Hash: 45bd8f36071fb4d928968a1facaed87f125398d2a488b64778d9a27fbfbf4478
Instruction Fuzzy Hash: E341A47190024A9FDB10DF68C885BDEBBF4FF48714F10065AE421B7681DBB6AA44CBA0

Function 00D002A0 Relevance: 1.6, APIs: 1, Instructions: 89COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,?,6C34C19C,?,?,?,0000000A,00000000,00E17CC5,000000FF,?,00D19361,6C34C19C,00000000,?,00000000), ref: 00D0037B

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 776ec1ef7e3a760a90be572fb997729c80dadde2ac9bfefbedface19ac8a0dda
Instruction ID: c3bdf545dc98d30e7771b2fd7e1be1433e8fedfa69533fa4023015a7f3908fa3
Opcode Fuzzy Hash: 776ec1ef7e3a760a90be572fb997729c80dadde2ac9bfefbedface19ac8a0dda
Instruction Fuzzy Hash: B9210372900614AFD7299F18D884BAEFBE8FB44710F19432DE82997780DB70AC008BE0

Function 00D20100 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00D20370: __Init_thread_footer.LIBCMT ref: 00D203E6

Part of subcall function 00DB4BA2: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4BAD
Part of subcall function 00DB4BA2: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4BEA

__Init_thread_footer.LIBCMT ref: 00D201E0

Part of subcall function 00DB4B58: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B62
Part of subcall function 00DB4B58: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B95
Part of subcall function 00DB4B58: RtlWakeAllConditionVariable.NTDLL ref: 00DB4C0C

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionVariableWake
String ID:
API String ID: 984842325-0
Opcode ID: b6915f585baeb11b9b6f483b09ca8d86c918bbf33e6b13b91402a7a7aea3c44b
Instruction ID: d9032618b1af5d612ecd57187afe1c81af700339109c76f14755fd8dc0a86ac5
Opcode Fuzzy Hash: b6915f585baeb11b9b6f483b09ca8d86c918bbf33e6b13b91402a7a7aea3c44b
Instruction Fuzzy Hash: 3531EE70540350EFDB10DF05FC8AF88B7A1F710718F108629E422A7A92D3B6A909CB68

Function 00D5D970 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00000000,00D40CB8,?,00000000,00000000,?,?), ref: 00D5D98D

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AllocateCreateFileHeap
String ID:
API String ID: 3125202945-0
Opcode ID: 02c6febf4f2239025ef0a78804446a018263eaf108f92b026f179c4397233a52
Instruction ID: 04522fa29a9cd1effdf8355a7a8f30fb20468bf5438dfb90909c41bdbaf7d0bb
Opcode Fuzzy Hash: 02c6febf4f2239025ef0a78804446a018263eaf108f92b026f179c4397233a52
Instruction Fuzzy Hash: 1C31F374204B009FD324DF28D888B17BBE1FF98301F24895DE99AE7361D731A994CB65

Function 00D19390 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 00D19470: DeleteFileW.KERNEL32(00000000,0000002A,00000000,?,6C34C19C), ref: 00D194E0

RemoveDirectoryW.KERNEL32(00000000,?,6C34C19C,?,?,?,00000000,?,00000000,00E1BD13,000000FF,?,C000008C), ref: 00D193EE

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: DeleteDirectoryFileRemove
String ID:
API String ID: 3325800564-0
Opcode ID: fb5b5835aac368fbfd4187c5686ce25380c0b3d0199c7e82a60c34ef97e5e857
Instruction ID: bc482503a80e618772c2fd84d8dc8dfecf9412009c0a021d7549db92020dcdb0
Opcode Fuzzy Hash: fb5b5835aac368fbfd4187c5686ce25380c0b3d0199c7e82a60c34ef97e5e857
Instruction Fuzzy Hash: 53217471900218DFCB24DF58D494ADDF7B4FB49720F5546A9E8256B382DB309D45CBA0

Function 00D5ECE0 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e7dd9ffc793ce49d1aa1ce9cea90fe96a0eeae75bfeb563270d4c3f2c2e2d43
Instruction ID: acfc5866f31e79d19c0f4bd4ba49e070bc263c9745ca63da3dd7e9121e411cfa
Opcode Fuzzy Hash: 4e7dd9ffc793ce49d1aa1ce9cea90fe96a0eeae75bfeb563270d4c3f2c2e2d43
Instruction Fuzzy Hash: 0D11C632700A269F8B24BF59C5C4E16F7BAFF147123064126ED219B622DB60FD198BF0

Function 00D00A10 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00DB4BA2: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4BAD
Part of subcall function 00DB4BA2: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4BEA

__Init_thread_footer.LIBCMT ref: 00D00A82

Part of subcall function 00DB4B58: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B62
Part of subcall function 00DB4B58: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B95
Part of subcall function 00DB4B58: RtlWakeAllConditionVariable.NTDLL ref: 00DB4C0C

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID:
API String ID: 2296764815-0
Opcode ID: d24d500d75d535c8c2c0e190d99f0ef0d8e965df96a434fdc27fd474cc66ba2a
Instruction ID: 70c7f808bbe54243b1e65f6a0671e6dc0b2cbde2cd6e0b7ef6487cdd053eadfe
Opcode Fuzzy Hash: d24d500d75d535c8c2c0e190d99f0ef0d8e965df96a434fdc27fd474cc66ba2a
Instruction Fuzzy Hash: BB01D8B1A04744DFC718DF58E986F8877A0F744720F00027DE436E37C2D636A8068A36

Function 00D20370 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00DB4BA2: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4BAD
Part of subcall function 00DB4BA2: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4BEA

Part of subcall function 00D20410: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00D2047E
Part of subcall function 00D20410: RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 00D204C5
Part of subcall function 00D20410: RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 00D204E4
Part of subcall function 00D20410: RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 00D20513
Part of subcall function 00D20410: RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 00D20588

__Init_thread_footer.LIBCMT ref: 00D203E6

Part of subcall function 00DB4B58: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B62
Part of subcall function 00DB4B58: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B95
Part of subcall function 00DB4B58: RtlWakeAllConditionVariable.NTDLL ref: 00DB4C0C

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalQuerySectionValue$EnterLeave$ConditionInit_thread_footerOpenVariableWake
String ID:
API String ID: 3563064969-0
Opcode ID: 15be434e279810fb65e388fb99d835dd6834000716ed3d3d45019b2e1c926727
Instruction ID: cb6a94a7081f20c07216cdaab0c412653af6870661626f48cf67031fa48f2b58
Opcode Fuzzy Hash: 15be434e279810fb65e388fb99d835dd6834000716ed3d3d45019b2e1c926727
Instruction Fuzzy Hash: 1401F772A44744DFC714DF58DA46F89B7E0E705B20F104378EA21A73C2C632A9018B61

Function 00C09980 Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB641A: RaiseException.KERNEL32(E06D7363,00000001,00000003,6C34C19C,?,?,00D598B8,80004005,6C34C19C), ref: 00DB647A

RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AllocateExceptionHeapRaise
String ID:
API String ID: 3789339297-0
Opcode ID: 78ccdbc6c8fbc834585f7dd7a22b5b1422faf871556a7e601ab4f6037bfd8cdf
Instruction ID: 563ff32e01f6c8937b9364457153b379c7d4a9f540b7186a422df024de563db4
Opcode Fuzzy Hash: 78ccdbc6c8fbc834585f7dd7a22b5b1422faf871556a7e601ab4f6037bfd8cdf
Instruction Fuzzy Hash: 6CF02071A08248FFC700CF10DC02F9ABBA8FB08B00F00862EF919927A1DB36A900CA50

Function 00DCCA67 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00DCA813,?,00DCE9B8,?,00000000,?,00DBE5A5,00000000,00DCA813,?,?,?,?,00DCA60D), ref: 00DCCA99

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 156b3e636da7a0a500e1d72c5c97fdda7cabec7b38a80c99c19c5bbf210cdf9f
Instruction ID: ea891dcb60fd60945a812bd3063c7674deab484e12019e81185119a36c0d3c08
Opcode Fuzzy Hash: 156b3e636da7a0a500e1d72c5c97fdda7cabec7b38a80c99c19c5bbf210cdf9f
Instruction Fuzzy Hash: 9BE0E53162062B6AE621A6269D0DF5A7A48EB013E0F292129EE4DD3080DB20CC0189B4

Function 6C607FA0 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,F1829F80,?,Function_0006ED80,000000FF), ref: 6C607FCF

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: e05177a9de635ea3a2abfadfc173e431818e9c9c29bb0491ff24f05bf1c260c8
Instruction ID: b7eeaf4614648ec74f750dcf9dce8e5769d1546192ea15298eb0083af9c1ca26
Opcode Fuzzy Hash: e05177a9de635ea3a2abfadfc173e431818e9c9c29bb0491ff24f05bf1c260c8
Instruction Fuzzy Hash: BAE06D71608548AFD701CF05CD40F26BBE8F70AB10F10862AF815D7A80D736A8108AA8

Function 00DCA77B Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00DCA782

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: ee21cec73bfacaafd230b80b42b191c88a701dc55b7e21df7d9e23e6280de18c
Instruction ID: f2fdfde6cb15e47c7bb8f3af17811c689d03ae71a0e02af6af3542f1b754b7ed
Opcode Fuzzy Hash: ee21cec73bfacaafd230b80b42b191c88a701dc55b7e21df7d9e23e6280de18c
Instruction Fuzzy Hash: 94E075B2D4020E9ADB01DFD8D456BEFBBB8EB08300F504126A655E6141EB7557458BB1

Function 6C63DE24 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6C63DE2B

Memory Dump Source

Source File: 00000000.00000002.2087252363.000000006C5E1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5E0000, based on PE: true

Associated: 00000000.00000002.2087224760.000000006C5E0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087315347.000000006C664000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087345153.000000006C68F000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2087378335.000000006C69B000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5e0000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 794a4bf1b9c90f3013c577391d452b192bc21d493e5ce04aaafc35668996a4a0
Instruction ID: 3b2860dda9b941a5009225b2d005a25a0438e9b76913b7d281757eeec5e9d750
Opcode Fuzzy Hash: 794a4bf1b9c90f3013c577391d452b192bc21d493e5ce04aaafc35668996a4a0
Instruction Fuzzy Hash: 6DE09AB6D0020D9BDF00DFD4C445BEFB7B8AF05704F5051269215E7641EB789748CBA6

Function 00C08710 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00C0871B

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ca863e7e6f3ac16562e9952b7f58709d242eb4dbeae3d524235dc4808ff8fbe8
Instruction ID: 91599d4a0651a344ce7c7434579555f6949934fb6a97a1c854a15f01b382ca87
Opcode Fuzzy Hash: ca863e7e6f3ac16562e9952b7f58709d242eb4dbeae3d524235dc4808ff8fbe8
Instruction Fuzzy Hash: A4C08C302002104BC7304B18B90874236DC9B08700F008459B459D3240CBB0DC048A54

Non-executed Functions

Function 00C03010 Relevance: 435.0, Strings: 346, Instructions: 2486COMMON

Download Yara Rule

Strings

E, xrefs: 00C05761
X6, xrefs: 00C049F4
xF, xrefs: 00C057E7
PA, xrefs: 00C05360
x4, xrefs: 00C0483B
AI_ProcessGroups, xrefs: 00C05FF3
3000000, xrefs: 00C051DC
AI_UninstallGroups, xrefs: 00C05DFF
89, xrefs: 00C04C62
ODBCDataSource, xrefs: 00C041E5, 00C052F2
Environment, xrefs: 00C048B3, 00C051EF
0;, xrefs: 00C04E25
PatchSize, xrefs: 00C04D14
F, xrefs: 00C0583B
7, xrefs: 00C04B43
10000, xrefs: 00C0578C, 00C06383
p,, xrefs: 00C04134
UnregisterFonts, xrefs: 00C04351
@R, xrefs: 00C061C5
CreateFolder, xrefs: 00C04AC2, 00C04B48
HM, xrefs: 00C05DA3
-, xrefs: 00C041CD
`3, xrefs: 00C04756
;, xrefs: 00C04EBE
BindImage, xrefs: 00C04DC0, 00C04DE6
B, xrefs: 00C054CC
@H, xrefs: 00C0595E
AI_InstallPostPrerequisite, xrefs: 00C05B85
XQ, xrefs: 00C060FB
x3, xrefs: 00C04769
L, xrefs: 00C05D57
UnpublishComponents, xrefs: 00C03E9B
x=, xrefs: 00C0500F
InstallFiles, xrefs: 00C04C2E
120000, xrefs: 00C0481A
0(, xrefs: 00C03B08
MsiPublishAssemblies, xrefs: 00C057FF
h9, xrefs: 00C04C9C
hL, xrefs: 00C05CED
hK, xrefs: 00C05C19
AppId, xrefs: 00C04509, 00C04EE9
StartServices, xrefs: 00C056F3
@?, xrefs: 00C0519E
CreateFolders, xrefs: 00C04B22
X?, xrefs: 00C051B1
(,, xrefs: 00C040E7
AI_GxInstall, xrefs: 00C05D05
X5, xrefs: 00C0490E
@>, xrefs: 00C050B8
@P, xrefs: 00C06014
AppSearch, xrefs: 00C0321B, 00C032A4
ProgId, xrefs: 00C04615, 00C04FE3
2000, xrefs: 00C03255, 00C05D18, 00C05D95, 00C05E12, 00C05E8F, 00C06006, 00C06083, 00C06100
AI_ProcessTasks, xrefs: 00C060ED
(+, xrefs: 00C04015
@=, xrefs: 00C04FDE
`1, xrefs: 00C0458A
InstallInitialize, xrefs: 00C058F9
pH, xrefs: 00C05984
D, xrefs: 00C0567B
HO, xrefs: 00C05F4B
CostInitialize, xrefs: 00C033FD
IniFile, xrefs: 00C047A7, 00C05169
100000, xrefs: 00C05989
P8, xrefs: 00C04BA3
DuplicateFile, xrefs: 00C04939, 00C04D60
p>, xrefs: 00C050DE
hC, xrefs: 00C05536
x*, xrefs: 00C03F7C
File, xrefs: 00C03668, 00C049BF, 00C04C4F
PK, xrefs: 00C05C06
`*, xrefs: 00C03F55
Patch, xrefs: 00C04CDA
`F, xrefs: 00C057D4
PatchFiles, xrefs: 00C04CB4
0<, xrefs: 00C04EFF
%, xrefs: 00C0314D
WriteEnvironmentStrings, xrefs: 00C051C9
x;, xrefs: 00C04E5E
1800, xrefs: 00C05C1E, 00C0617D
Options, xrefs: 00C05B5F, 00C05BE0
p5, xrefs: 00C04921
P&, xrefs: 00C03514
ProcessComponents, xrefs: 00C03B70
@6, xrefs: 00C049CD
T, xrefs: 00C0635D
HF, xrefs: 00C057AD
I, xrefs: 00C05A14
Extension, xrefs: 00C0458F, 00C04F66
(?, xrefs: 00C05177
(*, xrefs: 00C03F2F
RegisterProgIdInfo, xrefs: 00C04FBD
WriteIniValues, xrefs: 00C05143
`(, xrefs: 00C03BB0
h/, xrefs: 00C043D2
PublishFeatures, xrefs: 00C0587C
AI_GxUninstall, xrefs: 00C05EF9
9, xrefs: 00C04D0F
(P, xrefs: 00C06001
12000, xrefs: 00C041D2, 00C04258, 00C042DE, 00C04926, 00C049AC, 00C04A32, 00C04AAF, 00C04B35, 00C04E50, 00C052DF, 00C05365, 00C053EB
`P, xrefs: 00C0602F
xP, xrefs: 00C06045
8., xrefs: 00C042C6
AI_ChainProductsPseudo, xrefs: 00C06276
RemoveFolders, xrefs: 00C04A9C
CreateShortcuts, xrefs: 00C04E3D
200000, xrefs: 00C0590C
hM, xrefs: 00C05DBE
HD, xrefs: 00C055F5
p-, xrefs: 00C0421A
UnregisterComPlus, xrefs: 00C040B3
1, xrefs: 00C045FD
h%, xrefs: 00C0323C
@+, xrefs: 00C04028
P%, xrefs: 00C03220
8-, xrefs: 00C041E0
MsiConfigureServices, xrefs: 00C0566D, 00C05693
~, xrefs: 00C05B69
%, xrefs: 00C03402
`E, xrefs: 00C056EE
Shortcut, xrefs: 00C0482D, 00C04E63
HE, xrefs: 00C056DB
800, xrefs: 00C039DD
8A, xrefs: 00C0534D
@*, xrefs: 00C03F42
02, xrefs: 00C0464A
AI_UninstallAccounts, xrefs: 00C05D82
A, xrefs: 00C0533A
H2, xrefs: 00C0465D
AI_ProcessAccounts, xrefs: 00C06070
UnregisterClassInfo, xrefs: 00C044E3
15000, xrefs: 00C03FBA, 00C04040, 00C04BBB, 00C04D4D, 00C04F53, 00C05680, 00C0588F
RemoveRegistry, xrefs: 00C04483
(R, xrefs: 00C0619E
xE, xrefs: 00C05701
XR, xrefs: 00C061D8
8B, xrefs: 00C05433
XH, xrefs: 00C05971
8, xrefs: 00C04B7D
AI_DownloadPrereq, xrefs: 00C059F3
SelfUnregModules, xrefs: 00C04139
8@, xrefs: 00C05270
ServiceControl, xrefs: 00C03FCD, 00C04053, 00C05719
(G, xrefs: 00C05877
AI_CountRowAction, xrefs: 00C062F3
UnregisterProgIdInfo, xrefs: 00C045EF
8000, xrefs: 00C0414C, 00C04364, 00C05262, 00C054F7
InstallFinalize, xrefs: 00C05976
`<, xrefs: 00C04F28
1500000, xrefs: 00C055FA
hA, xrefs: 00C05373
RemoveShortcuts, xrefs: 00C04807
Registry, xrefs: 00C043FD, 00C050E3
3000, xrefs: 00C03BBF, 00C03EAE, 00C03F34, 00C040C6, 00C043EA, 00C04470, 00C044F6, 00C0457C, 00C04602, 00C04688, 00C048A0, 00C04ED6, 00C0504D, 00C05471, 00C05574
:, xrefs: 00C04DE1
O, xrefs: 00C05FC8
P9, xrefs: 00C04C89
MIME, xrefs: 00C0469B, 00C05060
1500, xrefs: 00C04709, 00C04794, 00C05C9B, 00C06203
p?, xrefs: 00C051C4
J, xrefs: 00C05BA6
8, xrefs: 00C04C29
FileSize, xrefs: 00C04C8E
500, xrefs: 00C05F89
7, xrefs: 00C04A97
8%, xrefs: 00C0319B
h., xrefs: 00C042EC
H3, xrefs: 00C0472F
Feature, xrefs: 00C03F47, 00C058A2
@Q, xrefs: 00C060E8
30000, xrefs: 00C03DA1, 00C05156, 00C05812
6000, xrefs: 00C050D0
@I, xrefs: 00C05A27
H(, xrefs: 00C03B57
@G, xrefs: 00C0588A
AI_InstallPrerequisite, xrefs: 00C05AFF
., xrefs: 00C042B3
87, xrefs: 00C04AAA
H<, xrefs: 00C04F15
0:, xrefs: 00C04D48
ODBCTranslator, xrefs: 00C0426B, 00C05378
@,, xrefs: 00C0410E
x2, xrefs: 00C04683
RemoveIniValues, xrefs: 00C046FB, 00C04781
PC, xrefs: 00C05520
AI_ExtractPrereq, xrefs: 00C05A79
FileCost, xrefs: 00C035E4
P0, xrefs: 00C04491
H:, xrefs: 00C04D5B
100, xrefs: 00C04CC7, 00C04FD0, 00C05F0C
H', xrefs: 00C03831
(H, xrefs: 00C0594B
(=, xrefs: 00C04FCB
AI_XmlInstall, xrefs: 00C05C0B, 00C05C88
HN, xrefs: 00C05E77
', xrefs: 00C03A13
@4, xrefs: 00C04815
MoveFile, xrefs: 00C04BCE
Font, xrefs: 00C04377, 00C05275
X@, xrefs: 00C0528B
&, xrefs: 00C036F6
`N, xrefs: 00C05E8A
`;, xrefs: 00C04E4B
AI_XmlUninstall, xrefs: 00C0616A, 00C061F0
X>, xrefs: 00C050CB
/, xrefs: 00C04385
01, xrefs: 00C04564
ServiceInstall, xrefs: 00C0560D
StopServices, xrefs: 00C03FA7, 00C0402D
xO, xrefs: 00C05F71
X-, xrefs: 00C041F3
(F, xrefs: 00C0579A
p7, xrefs: 00C04AD0
@5, xrefs: 00C048FB
(Q, xrefs: 00C060D5
RemoveIniFile, xrefs: 00C04721
XI, xrefs: 00C05A4E
SelfRegModules, xrefs: 00C054E4
InstallODBC, xrefs: 00C052CC, 00C05352, 00C053D8
AI_AppSearchEx, xrefs: 00C05F76, 00C05F9C
P., xrefs: 00C042D9
8S, xrefs: 00C06297
RegisterExtensionInfo, xrefs: 00C04F40
PT, xrefs: 00C0637E
(, xrefs: 00C03D39
MsiUnpublishAssemblies, xrefs: 00C03D52
C, xrefs: 00C05595
hB, xrefs: 00C05459
x(, xrefs: 00C03BF5
h:, xrefs: 00C04D6E
RemoveODBC, xrefs: 00C041BF, 00C04245, 00C042CB
00, xrefs: 00C0447E
AI_UserAccounts, xrefs: 00C05DA8, 00C06096
AI_XmlAttribute, xrefs: 00C05CAE, 00C06211
x<, xrefs: 00C04F3B
H), xrefs: 00C03E70
p6, xrefs: 00C04A07
RegisterFonts, xrefs: 00C0524F
J, xrefs: 00C05AFA
8J, xrefs: 00C05B0D
pI, xrefs: 00C05A61
., xrefs: 00C0435F
InstallServices, xrefs: 00C055E7
p@, xrefs: 00C052A1
0E, xrefs: 00C056C8
h', xrefs: 00C0388C
H1, xrefs: 00C04577
SelfReg, xrefs: 00C0415F, 00C0550A
hT, xrefs: 00C06391
X+, xrefs: 00C0403B
8T, xrefs: 00C0636B
pQ, xrefs: 00C0610E
MsiAssembly, xrefs: 00C05825
`2, xrefs: 00C04670
`), xrefs: 00C03E83
DuplicateFiles, xrefs: 00C04D3A
AI_ScheduledTasks, xrefs: 00C06113
8/, xrefs: 00C043AC
K, xrefs: 00C05BE5
N, xrefs: 00C05EF4
RegisterComPlus, xrefs: 00C0555C
XG, xrefs: 00C0589D
RemoveEnvironmentStrings, xrefs: 00C0488D
RegisterTypeLibraries, xrefs: 00C0545E
h0, xrefs: 00C044B8
RemoveExistingProducts, xrefs: 00C03034
`O, xrefs: 00C05F5E
RemoveFiles, xrefs: 00C04999, 00C04A1F
XS, xrefs: 00C062B2
<, xrefs: 00C04F92
CostFinalize, xrefs: 00C037AC
3, xrefs: 00C047B5
0', xrefs: 00C037E2
xG, xrefs: 00C058B8
X4, xrefs: 00C04828
0), xrefs: 00C03E31
AI_XmlElement, xrefs: 00C05C31, 00C06190
RemoveRegistryValues, xrefs: 00C043D7, 00C0445D
0, xrefs: 00C04517
K, xrefs: 00C05C83
), xrefs: 00C03EF6
Component_, xrefs: 00C03ED4, 00C03FE0, 00C04075, 00C040EC, 00C041F8, 00C0427E, 00C04318, 00C04410, 00C04496, 00C04734, 00C047BA, 00C04840, 00C048C6, 00C0494C, 00C049D2, 00C04AD5, 00C04B5B, 00C04BE1, 00C04C67, 00C04D73, 00C04E76, 00C050F6, 00C0517C, 00C05202, 00C05305, 00C0538B, 00C05416, 00C05497, 00C0559A, 00C05620, 00C056B5, 00C0572C, 00C057B2
AI_UninstallTasks, xrefs: 00C05E7C
WriteRegistryValues, xrefs: 00C050BD
@, xrefs: 00C0525D
AI_UserGroups, xrefs: 00C05E25, 00C06019
pJ, xrefs: 00C05B33
$, xrefs: 00C030A6
A, xrefs: 00C053E6
0O, xrefs: 00C05F35
RemoveFile, xrefs: 00C04A45
B, xrefs: 00C0541B
20000, xrefs: 00C05706
xN, xrefs: 00C05E9D
H;, xrefs: 00C04E38
`D, xrefs: 00C05608
8K, xrefs: 00C05BF3
/, xrefs: 00C04445
5000, xrefs: 00C04DD3
UnregisterExtensionInfo, xrefs: 00C04569
Complus, xrefs: 00C040D9, 00C05587
PL, xrefs: 00C05CDA
MoveFiles, xrefs: 00C04BA8
(5, xrefs: 00C048E8
P7, xrefs: 00C04ABD
0M, xrefs: 00C05D90
6, xrefs: 00C049BA
h8, xrefs: 00C04BB6
`=, xrefs: 00C04FF9
P/, xrefs: 00C043BF
0N, xrefs: 00C05E64
0C, xrefs: 00C05505
Location, xrefs: 00C05A53, 00C05AD9
UnregisterMIMEInfo, xrefs: 00C04675
UnpublishFeatures, xrefs: 00C03F1C
88, xrefs: 00C04B90
h&, xrefs: 00C03562
x), xrefs: 00C03E96
AI_Game, xrefs: 00C05D2B, 00C05F1F
(>, xrefs: 00C050A2
PublishComponents, xrefs: 00C05779
PublishComponent, xrefs: 00C03EC1, 00C0579F
8L, xrefs: 00C05CC4
p+, xrefs: 00C0404E
(4, xrefs: 00C04802
X,, xrefs: 00C04121
Feature_, xrefs: 00C03DF0, 00C045A2, 00C04F77, 00C05836, 00C05A2C, 00C05AB2, 00C05B38, 00C05BBE
AI_DefaultActionCost, xrefs: 00C06370
ODBCDriver, xrefs: 00C042F1, 00C053FE
2, xrefs: 00C046E3
RegisterClassInfo, xrefs: 00C04EC3
InstallValidate, xrefs: 00C0398E
TypeLib, xrefs: 00C05484
pR, xrefs: 00C061EB
S, xrefs: 00C06284
PB, xrefs: 00C05446
0D, xrefs: 00C055E2
Component, xrefs: 00C03486, 00C0384A, 00C03A2C, 00C03C0E
pS, xrefs: 00C062C8
8&, xrefs: 00C034C8
PJ, xrefs: 00C05B20
RemoveDuplicateFiles, xrefs: 00C04913
RegisterMIMEInfo, xrefs: 00C0503A
(3, xrefs: 00C0471C
M, xrefs: 00C05E20
AI_PreRequisite, xrefs: 00C05A19, 00C05A9F, 00C05B25, 00C05BAB

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID: %$ -$ .$ /$ 6$ 7$ 8$ @$ A$ B$ I$ J$ K$ S$ T$(*$(+$(,$(3$(4$(5$(=$(>$(?$(F$(G$(H$(P$(Q$(R$0'$0($0)$00$01$02$0:$0;$0<$0C$0D$0E$0M$0N$0O$100$10000$100000$12000$120000$1500$15000$1500000$1800$2000$20000$200000$3000$30000$3000000$500$5000$6000$8%$8&$8-$8.$8/$800$8000$87$88$89$8@$8A$8B$8J$8K$8L$8S$8T$@*$@+$@,$@4$@5$@6$@=$@>$@?$@G$@H$@I$@P$@Q$@R$AI_AppSearchEx$AI_ChainProductsPseudo$AI_CountRowAction$AI_DefaultActionCost$AI_DownloadPrereq$AI_ExtractPrereq$AI_Game$AI_GxInstall$AI_GxUninstall$AI_InstallPostPrerequisite$AI_InstallPrerequisite$AI_PreRequisite$AI_ProcessAccounts$AI_ProcessGroups$AI_ProcessTasks$AI_ScheduledTasks$AI_UninstallAccounts$AI_UninstallGroups$AI_UninstallTasks$AI_UserAccounts$AI_UserGroups$AI_XmlAttribute$AI_XmlElement$AI_XmlInstall$AI_XmlUninstall$AppId$AppSearch$BindImage$Complus$Component$Component_$CostFinalize$CostInitialize$CreateFolder$CreateFolders$CreateShortcuts$DuplicateFile$DuplicateFiles$Environment$Extension$Feature$Feature_$File$FileCost$FileSize$Font$H'$H($H)$H1$H2$H3$H:$H;$H<$HD$HE$HF$HM$HN$HO$IniFile$InstallFiles$InstallFinalize$InstallInitialize$InstallODBC$InstallServices$InstallValidate$Location$MIME$MoveFile$MoveFiles$MsiAssembly$MsiConfigureServices$MsiPublishAssemblies$MsiUnpublishAssemblies$ODBCDataSource$ODBCDriver$ODBCTranslator$Options$P%$P&$P.$P/$P0$P7$P8$P9$PA$PB$PC$PJ$PK$PL$PT$Patch$PatchFiles$PatchSize$ProcessComponents$ProgId$PublishComponent$PublishComponents$PublishFeatures$RegisterClassInfo$RegisterComPlus$RegisterExtensionInfo$RegisterFonts$RegisterMIMEInfo$RegisterProgIdInfo$RegisterTypeLibraries$Registry$RemoveDuplicateFiles$RemoveEnvironmentStrings$RemoveExistingProducts$RemoveFile$RemoveFiles$RemoveFolders$RemoveIniFile$RemoveIniValues$RemoveODBC$RemoveRegistry$RemoveRegistryValues$RemoveShortcuts$SelfReg$SelfRegModules$SelfUnregModules$ServiceControl$ServiceInstall$Shortcut$StartServices$StopServices$TypeLib$UnpublishComponents$UnpublishFeatures$UnregisterClassInfo$UnregisterComPlus$UnregisterExtensionInfo$UnregisterFonts$UnregisterMIMEInfo$UnregisterProgIdInfo$WriteEnvironmentStrings$WriteIniValues$WriteRegistryValues$X+$X,$X-$X4$X5$X6$X>$X?$X@$XG$XH$XI$XQ$XR$XS$`($`)$`*$`1$`2$`3$`;$`<$`=$`D$`E$`F$`N$`O$`P$h%$h&$h'$h.$h/$h0$h8$h9$h:$hA$hB$hC$hK$hL$hM$hT$p+$p,$p-$p5$p6$p7$p>$p?$p@$pH$pI$pJ$pQ$pR$pS$x($x)$x*$x2$x3$x4$x;$x<$x=$xE$xF$xG$xN$xO$xP$~$$$%$&$'$($)$.$/$0$1$2$3$7$8$9$:$;$<$A$B$C$D$E$F$J$K$L$M$N$O
API String ID: 0-659361337
Opcode ID: ae3f8d7d2de2adda299de67f6c2dab08356fd7ac30e5973aae71172c000178d0
Instruction ID: 8056d0a4a2847cf7fd86fcce8c8aa06913af22d98029995349180309c2005e22
Opcode Fuzzy Hash: ae3f8d7d2de2adda299de67f6c2dab08356fd7ac30e5973aae71172c000178d0
Instruction Fuzzy Hash: 1133B7A0A89384BDD709DBB4A91BF6D69609FD1704F10735CF1503B2D2CBB61A06E3A6

Function 00C045FE Relevance: 334.0, Strings: 266, Instructions: 1549COMMON

Download Yara Rule

Strings

E, xrefs: 00C05761
X6, xrefs: 00C049F4
xF, xrefs: 00C057E7
PA, xrefs: 00C05360
x4, xrefs: 00C0483B
AI_ProcessGroups, xrefs: 00C05FF3
3000000, xrefs: 00C051DC
AI_UninstallGroups, xrefs: 00C05DFF
89, xrefs: 00C04C62
ODBCDataSource, xrefs: 00C052F2
Environment, xrefs: 00C048B3, 00C051EF
0;, xrefs: 00C04E25
PatchSize, xrefs: 00C04D14
F, xrefs: 00C0583B
7, xrefs: 00C04B43
10000, xrefs: 00C0578C, 00C06383
@R, xrefs: 00C061C5
CreateFolder, xrefs: 00C04AC2, 00C04B48
HM, xrefs: 00C05DA3
`3, xrefs: 00C04756
;, xrefs: 00C04EBE
BindImage, xrefs: 00C04DC0, 00C04DE6
B, xrefs: 00C054CC
@H, xrefs: 00C0595E
AI_InstallPostPrerequisite, xrefs: 00C05B85
XQ, xrefs: 00C060FB
x3, xrefs: 00C04769
L, xrefs: 00C05D57
x=, xrefs: 00C0500F
InstallFiles, xrefs: 00C04C2E
120000, xrefs: 00C0481A
MsiPublishAssemblies, xrefs: 00C057FF
h9, xrefs: 00C04C9C
hL, xrefs: 00C05CED
hK, xrefs: 00C05C19
AppId, xrefs: 00C04EE9
StartServices, xrefs: 00C056F3
@?, xrefs: 00C0519E
CreateFolders, xrefs: 00C04B22
X?, xrefs: 00C051B1
AI_GxInstall, xrefs: 00C05D05
X5, xrefs: 00C0490E
@>, xrefs: 00C050B8
@P, xrefs: 00C06014
ProgId, xrefs: 00C04615, 00C04FE3
2000, xrefs: 00C05D18, 00C05D95, 00C05E12, 00C05E8F, 00C06006, 00C06083, 00C06100
AI_ProcessTasks, xrefs: 00C060ED
@=, xrefs: 00C04FDE
InstallInitialize, xrefs: 00C058F9
pH, xrefs: 00C05984
D, xrefs: 00C0567B
HO, xrefs: 00C05F4B
IniFile, xrefs: 00C047A7, 00C05169
100000, xrefs: 00C05989
P8, xrefs: 00C04BA3
DuplicateFile, xrefs: 00C04939, 00C04D60
p>, xrefs: 00C050DE
hC, xrefs: 00C05536
File, xrefs: 00C049BF, 00C04C4F
PK, xrefs: 00C05C06
Patch, xrefs: 00C04CDA
`F, xrefs: 00C057D4
PatchFiles, xrefs: 00C04CB4
0<, xrefs: 00C04EFF
WriteEnvironmentStrings, xrefs: 00C051C9
x;, xrefs: 00C04E5E
1800, xrefs: 00C05C1E, 00C0617D
Options, xrefs: 00C05B5F, 00C05BE0
p5, xrefs: 00C04921
@6, xrefs: 00C049CD
T, xrefs: 00C0635D
HF, xrefs: 00C057AD
I, xrefs: 00C05A14
Extension, xrefs: 00C04F66
(?, xrefs: 00C05177
RegisterProgIdInfo, xrefs: 00C04FBD
WriteIniValues, xrefs: 00C05143
PublishFeatures, xrefs: 00C0587C
AI_GxUninstall, xrefs: 00C05EF9
9, xrefs: 00C04D0F
(P, xrefs: 00C06001
12000, xrefs: 00C04926, 00C049AC, 00C04A32, 00C04AAF, 00C04B35, 00C04E50, 00C052DF, 00C05365, 00C053EB
`P, xrefs: 00C0602F
xP, xrefs: 00C06045
AI_ChainProductsPseudo, xrefs: 00C06276
RemoveFolders, xrefs: 00C04A9C
CreateShortcuts, xrefs: 00C04E3D
200000, xrefs: 00C0590C
hM, xrefs: 00C05DBE
HD, xrefs: 00C055F5
MsiConfigureServices, xrefs: 00C0566D, 00C05693
~, xrefs: 00C05B69
`E, xrefs: 00C056EE
Shortcut, xrefs: 00C0482D, 00C04E63
HE, xrefs: 00C056DB
8A, xrefs: 00C0534D
02, xrefs: 00C0464A
AI_UninstallAccounts, xrefs: 00C05D82
A, xrefs: 00C0533A
H2, xrefs: 00C0465D
AI_ProcessAccounts, xrefs: 00C06070
15000, xrefs: 00C04BBB, 00C04D4D, 00C04F53, 00C05680, 00C0588F
(R, xrefs: 00C0619E
xE, xrefs: 00C05701
XR, xrefs: 00C061D8
8B, xrefs: 00C05433
XH, xrefs: 00C05971
8, xrefs: 00C04B7D
AI_DownloadPrereq, xrefs: 00C059F3
8@, xrefs: 00C05270
ServiceControl, xrefs: 00C05719
(G, xrefs: 00C05877
AI_CountRowAction, xrefs: 00C062F3
8000, xrefs: 00C05262, 00C054F7
InstallFinalize, xrefs: 00C05976
`<, xrefs: 00C04F28
1500000, xrefs: 00C055FA
hA, xrefs: 00C05373
RemoveShortcuts, xrefs: 00C04807
Registry, xrefs: 00C050E3
3000, xrefs: 00C04688, 00C048A0, 00C04ED6, 00C0504D, 00C05471, 00C05574
:, xrefs: 00C04DE1
O, xrefs: 00C05FC8
P9, xrefs: 00C04C89
MIME, xrefs: 00C0469B, 00C05060
1500, xrefs: 00C04709, 00C04794, 00C05C9B, 00C06203
p?, xrefs: 00C051C4
J, xrefs: 00C05BA6
8, xrefs: 00C04C29
FileSize, xrefs: 00C04C8E
500, xrefs: 00C05F89
7, xrefs: 00C04A97
H3, xrefs: 00C0472F
Feature, xrefs: 00C058A2
@Q, xrefs: 00C060E8
30000, xrefs: 00C05156, 00C05812
6000, xrefs: 00C050D0
@I, xrefs: 00C05A27
@G, xrefs: 00C0588A
AI_InstallPrerequisite, xrefs: 00C05AFF
87, xrefs: 00C04AAA
H<, xrefs: 00C04F15
0:, xrefs: 00C04D48
ODBCTranslator, xrefs: 00C05378
x2, xrefs: 00C04683
RemoveIniValues, xrefs: 00C046FB, 00C04781
PC, xrefs: 00C05520
AI_ExtractPrereq, xrefs: 00C05A79
H:, xrefs: 00C04D5B
100, xrefs: 00C04CC7, 00C04FD0, 00C05F0C
(H, xrefs: 00C0594B
(=, xrefs: 00C04FCB
AI_XmlInstall, xrefs: 00C05C0B, 00C05C88
HN, xrefs: 00C05E77
@4, xrefs: 00C04815
MoveFile, xrefs: 00C04BCE
Font, xrefs: 00C05275
X@, xrefs: 00C0528B
`N, xrefs: 00C05E8A
`;, xrefs: 00C04E4B
AI_XmlUninstall, xrefs: 00C0616A, 00C061F0
X>, xrefs: 00C050CB
ServiceInstall, xrefs: 00C0560D
xO, xrefs: 00C05F71
(F, xrefs: 00C0579A
p7, xrefs: 00C04AD0
@5, xrefs: 00C048FB
(Q, xrefs: 00C060D5
RemoveIniFile, xrefs: 00C04721
XI, xrefs: 00C05A4E
SelfRegModules, xrefs: 00C054E4
InstallODBC, xrefs: 00C052CC, 00C05352, 00C053D8
AI_AppSearchEx, xrefs: 00C05F76, 00C05F9C
8S, xrefs: 00C06297
RegisterExtensionInfo, xrefs: 00C04F40
PT, xrefs: 00C0637E
C, xrefs: 00C05595
hB, xrefs: 00C05459
h:, xrefs: 00C04D6E
AI_UserAccounts, xrefs: 00C05DA8, 00C06096
AI_XmlAttribute, xrefs: 00C05CAE, 00C06211
x<, xrefs: 00C04F3B
p6, xrefs: 00C04A07
RegisterFonts, xrefs: 00C0524F
J, xrefs: 00C05AFA
8J, xrefs: 00C05B0D
pI, xrefs: 00C05A61
InstallServices, xrefs: 00C055E7
p@, xrefs: 00C052A1
0E, xrefs: 00C056C8
SelfReg, xrefs: 00C0550A
hT, xrefs: 00C06391
8T, xrefs: 00C0636B
pQ, xrefs: 00C0610E
MsiAssembly, xrefs: 00C05825
`2, xrefs: 00C04670
DuplicateFiles, xrefs: 00C04D3A
AI_ScheduledTasks, xrefs: 00C06113
K, xrefs: 00C05BE5
N, xrefs: 00C05EF4
RegisterComPlus, xrefs: 00C0555C
XG, xrefs: 00C0589D
RemoveEnvironmentStrings, xrefs: 00C0488D
RegisterTypeLibraries, xrefs: 00C0545E
`O, xrefs: 00C05F5E
RemoveFiles, xrefs: 00C04999, 00C04A1F
XS, xrefs: 00C062B2
<, xrefs: 00C04F92
3, xrefs: 00C047B5
xG, xrefs: 00C058B8
X4, xrefs: 00C04828
AI_XmlElement, xrefs: 00C05C31, 00C06190
K, xrefs: 00C05C83
Component_, xrefs: 00C04734, 00C047BA, 00C04840, 00C048C6, 00C0494C, 00C049D2, 00C04AD5, 00C04B5B, 00C04BE1, 00C04C67, 00C04D73, 00C04E76, 00C050F6, 00C0517C, 00C05202, 00C05305, 00C0538B, 00C05416, 00C05497, 00C0559A, 00C05620, 00C056B5, 00C0572C, 00C057B2
AI_UninstallTasks, xrefs: 00C05E7C
WriteRegistryValues, xrefs: 00C050BD
@, xrefs: 00C0525D
AI_UserGroups, xrefs: 00C05E25, 00C06019
pJ, xrefs: 00C05B33
A, xrefs: 00C053E6
0O, xrefs: 00C05F35
RemoveFile, xrefs: 00C04A45
B, xrefs: 00C0541B
20000, xrefs: 00C05706
xN, xrefs: 00C05E9D
H;, xrefs: 00C04E38
`D, xrefs: 00C05608
8K, xrefs: 00C05BF3
5000, xrefs: 00C04DD3
Complus, xrefs: 00C05587
PL, xrefs: 00C05CDA
MoveFiles, xrefs: 00C04BA8
(5, xrefs: 00C048E8
P7, xrefs: 00C04ABD
0M, xrefs: 00C05D90
6, xrefs: 00C049BA
h8, xrefs: 00C04BB6
`=, xrefs: 00C04FF9
0N, xrefs: 00C05E64
0C, xrefs: 00C05505
Location, xrefs: 00C05A53, 00C05AD9
UnregisterMIMEInfo, xrefs: 00C04675
88, xrefs: 00C04B90
AI_Game, xrefs: 00C05D2B, 00C05F1F
(>, xrefs: 00C050A2
PublishComponents, xrefs: 00C05779
PublishComponent, xrefs: 00C0579F
8L, xrefs: 00C05CC4
(4, xrefs: 00C04802
Feature_, xrefs: 00C04F77, 00C05836, 00C05A2C, 00C05AB2, 00C05B38, 00C05BBE
AI_DefaultActionCost, xrefs: 00C06370
ODBCDriver, xrefs: 00C053FE
2, xrefs: 00C046E3
RegisterClassInfo, xrefs: 00C04EC3
TypeLib, xrefs: 00C05484
pR, xrefs: 00C061EB
S, xrefs: 00C06284
PB, xrefs: 00C05446
0D, xrefs: 00C055E2
pS, xrefs: 00C062C8
PJ, xrefs: 00C05B20
RemoveDuplicateFiles, xrefs: 00C04913
RegisterMIMEInfo, xrefs: 00C0503A
(3, xrefs: 00C0471C
M, xrefs: 00C05E20
AI_PreRequisite, xrefs: 00C05A19, 00C05A9F, 00C05B25, 00C05BAB

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID: 6$ 7$ 8$ @$ A$ B$ I$ J$ K$ S$ T$(3$(4$(5$(=$(>$(?$(F$(G$(H$(P$(Q$(R$02$0:$0;$0<$0C$0D$0E$0M$0N$0O$100$10000$100000$12000$120000$1500$15000$1500000$1800$2000$20000$200000$3000$30000$3000000$500$5000$6000$8000$87$88$89$8@$8A$8B$8J$8K$8L$8S$8T$@4$@5$@6$@=$@>$@?$@G$@H$@I$@P$@Q$@R$AI_AppSearchEx$AI_ChainProductsPseudo$AI_CountRowAction$AI_DefaultActionCost$AI_DownloadPrereq$AI_ExtractPrereq$AI_Game$AI_GxInstall$AI_GxUninstall$AI_InstallPostPrerequisite$AI_InstallPrerequisite$AI_PreRequisite$AI_ProcessAccounts$AI_ProcessGroups$AI_ProcessTasks$AI_ScheduledTasks$AI_UninstallAccounts$AI_UninstallGroups$AI_UninstallTasks$AI_UserAccounts$AI_UserGroups$AI_XmlAttribute$AI_XmlElement$AI_XmlInstall$AI_XmlUninstall$AppId$BindImage$Complus$Component_$CreateFolder$CreateFolders$CreateShortcuts$DuplicateFile$DuplicateFiles$Environment$Extension$Feature$Feature_$File$FileSize$Font$H2$H3$H:$H;$H<$HD$HE$HF$HM$HN$HO$IniFile$InstallFiles$InstallFinalize$InstallInitialize$InstallODBC$InstallServices$Location$MIME$MoveFile$MoveFiles$MsiAssembly$MsiConfigureServices$MsiPublishAssemblies$ODBCDataSource$ODBCDriver$ODBCTranslator$Options$P7$P8$P9$PA$PB$PC$PJ$PK$PL$PT$Patch$PatchFiles$PatchSize$ProgId$PublishComponent$PublishComponents$PublishFeatures$RegisterClassInfo$RegisterComPlus$RegisterExtensionInfo$RegisterFonts$RegisterMIMEInfo$RegisterProgIdInfo$RegisterTypeLibraries$Registry$RemoveDuplicateFiles$RemoveEnvironmentStrings$RemoveFile$RemoveFiles$RemoveFolders$RemoveIniFile$RemoveIniValues$RemoveShortcuts$SelfReg$SelfRegModules$ServiceControl$ServiceInstall$Shortcut$StartServices$TypeLib$UnregisterMIMEInfo$WriteEnvironmentStrings$WriteIniValues$WriteRegistryValues$X4$X5$X6$X>$X?$X@$XG$XH$XI$XQ$XR$XS$`2$`3$`;$`<$`=$`D$`E$`F$`N$`O$`P$h8$h9$h:$hA$hB$hC$hK$hL$hM$hT$p5$p6$p7$p>$p?$p@$pH$pI$pJ$pQ$pR$pS$x2$x3$x4$x;$x<$x=$xE$xF$xG$xN$xO$xP$~$2$3$7$8$9$:$;$<$A$B$C$D$E$F$J$K$L$M$N$O
API String ID: 0-2236961450
Opcode ID: 3a657591f785b1aa0b80e2acc3b7752c504b3ab16fde5f25a1d35ff66d8cc993
Instruction ID: b475a74a4c4ac425d4c3ef581f16fc3e6ec60555ad86ad6e889530c38bb6e92f
Opcode Fuzzy Hash: 3a657591f785b1aa0b80e2acc3b7752c504b3ab16fde5f25a1d35ff66d8cc993
Instruction Fuzzy Hash: 8EE2BA90F89785B9C71AE7F43A1BB6D59214FD2711F14739CF1613B2D2CA621B02E3A2

Function 00C2B461 Relevance: 64.6, APIs: 25, Strings: 11, Instructions: 1644memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

VariantClear.OLEAUT32 ref: 00C2B70F
VariantClear.OLEAUT32(?), ref: 00C2B86A
VariantClear.OLEAUT32(?), ref: 00C2B892
VariantClear.OLEAUT32(?), ref: 00C2BA1E
SysAllocString.OLEAUT32(00000000), ref: 00C2BA2F
VariantClear.OLEAUT32(?), ref: 00C2BA79
VariantClear.OLEAUT32(?), ref: 00C2BAA2
SysFreeString.OLEAUT32(00000000), ref: 00C2BAAD
VariantClear.OLEAUT32(?), ref: 00C2BBBB
VariantClear.OLEAUT32(?), ref: 00C2BBEC
VariantClear.OLEAUT32(?), ref: 00C2BC45
VariantClear.OLEAUT32(?), ref: 00C2BCF4
VariantClear.OLEAUT32(?), ref: 00C2B73D

Part of subcall function 00C092A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00C21134,00000000,?,00000010,?,*.*,?,80070057), ref: 00C092C3

VariantClear.OLEAUT32(?), ref: 00C2B80E
VariantClear.OLEAUT32(?), ref: 00C2B836
VariantClear.OLEAUT32(?), ref: 00C2BE38
SysAllocString.OLEAUT32(00000000), ref: 00C2BE49
VariantClear.OLEAUT32(?), ref: 00C2BE93
VariantClear.OLEAUT32(?), ref: 00C2BEBC
SysFreeString.OLEAUT32(00000000), ref: 00C2BEC7
VariantClear.OLEAUT32(?), ref: 00C2BFD5
SysAllocString.OLEAUT32(00000000), ref: 00C2BFE2
VariantClear.OLEAUT32(?), ref: 00C2C02A
VariantClear.OLEAUT32(?), ref: 00C2C052
SysFreeString.OLEAUT32(00000000), ref: 00C2C05C

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Strings

MsiEvaluateCondition, xrefs: 00C2C298
MsiGetProperty, xrefs: 00C2C1CF
MsiPublishEvents, xrefs: 00C2C5BC
MsiResolveFormatted, xrefs: 00C2C361
MsiGetFormattedError, xrefs: 00C2C817
MessageBox, xrefs: 00C2C685
MsiGetBinaryPathIndirect, xrefs: 00C2C4F3
MsiGetBinaryPath, xrefs: 00C2C42A
MsiGetBytesCountText, xrefs: 00C2C74E
MsiSetProperty, xrefs: 00C2C10D
GetFontHeight, xrefs: 00C2C8E0

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ClearVariant$String$AllocFree$HeapInit_thread_footer$AllocateFindProcessResource
String ID: GetFontHeight$MessageBox$MsiEvaluateCondition$MsiGetBinaryPath$MsiGetBinaryPathIndirect$MsiGetBytesCountText$MsiGetFormattedError$MsiGetProperty$MsiPublishEvents$MsiResolveFormatted$MsiSetProperty
API String ID: 3540692479-3153392536
Opcode ID: 270bef6e59ab7e3762b67233156ffcd7f5e69c57c5345db80c26095ecb7c1a48
Instruction ID: 85da31d83bd7db810dba2f3be52a9f5ea8af7e36ca7e1ef0fefcdfdf453db04a
Opcode Fuzzy Hash: 270bef6e59ab7e3762b67233156ffcd7f5e69c57c5345db80c26095ecb7c1a48
Instruction Fuzzy Hash: 6CE2A071D00258DFDB14DFA8D884BDEBBB4FF48314F208259E415AB791EB74AA85CB90

Function 00D4D260 Relevance: 44.3, APIs: 16, Strings: 9, Instructions: 517fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00EC93A8,C0000000,00000003,00000000,00000004,00000080,00000000,6C34C19C,00EC9384,00EC939C,?), ref: 00D4D2E0
GetLastError.KERNEL32 ref: 00D4D2FD
OutputDebugStringW.KERNEL32(00000000,00000020), ref: 00D4D376
OutputDebugStringW.KERNEL32(00000000,?,0000001C), ref: 00D4D47A
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,0000001C), ref: 00D4D4EB
WriteFile.KERNEL32(00000000,00EC8C20,00000000,00000000,00000000,?,0000001C), ref: 00D4D51B
WriteFile.KERNEL32(00000000,000000B7,?,00000000,00000000,00E46D60,00000002), ref: 00D4D5C6
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 00D4D5CF
FlushFileBuffers.KERNEL32(00000000,?,0000001C), ref: 00D4D520

Part of subcall function 00C092A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00C21134,00000000,?,00000010,?,*.*,?,80070057), ref: 00C092C3

OutputDebugStringW.KERNEL32(00000000,?,0000001D), ref: 00D4D6C3
WriteFile.KERNEL32(00000000,00000000,00000002,?,00000000,?,0000001D), ref: 00D4D749
FlushFileBuffers.KERNEL32(00000000,?,0000001D), ref: 00D4D754
WriteFile.KERNEL32(00000000,000000FF,?,00000000,00000000,00E46D60,00000002,?,?,CPU: ,00000005), ref: 00D4D7C8
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 00D4D7D1
WriteFile.KERNEL32(00000000,000000B7,?,00000000,00000000,00E46D60,00000002), ref: 00D4D856
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 00D4D85F

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

Strings

x86, xrefs: 00D4D557
LOGGER->Reusing LOG file at:, xrefs: 00D4D422, 00D4D434, 00D4D43E
CPU: , xrefs: 00D4D617, 00D4D62D, 00D4D75D
OS Version: %u.%u.%u SP%u (%s) [%s], xrefs: 00D4D596
LOGGER->failed to create LOG at:, xrefs: 00D4D331, 00D4D343, 00D4D34D
x64, xrefs: 00D4D560, 00D4D56C
LOGGER->Creating LOG file at:, xrefs: 00D4D66B, 00D4D67D, 00D4D687
workstation, xrefs: 00D4D56D
server, xrefs: 00D4D572, 00D4D57A

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$BuffersFlushWrite$DebugOutputString$Init_thread_footer$CreateErrorFindHeapLastPointerProcessResource
String ID: CPU: $LOGGER->Creating LOG file at:$LOGGER->Reusing LOG file at:$LOGGER->failed to create LOG at:$OS Version: %u.%u.%u SP%u (%s) [%s]$server$workstation$x64$x86
API String ID: 4051163352-1312762833
Opcode ID: 656d14ff2c944a9f44e651464b2490d6c9ae0c481c457a1b0a36a4c82bf8e57c
Instruction ID: 58714965261910c7a401c8e52f0b5833690d357239012d81ebff5ff1ba442882
Opcode Fuzzy Hash: 656d14ff2c944a9f44e651464b2490d6c9ae0c481c457a1b0a36a4c82bf8e57c
Instruction Fuzzy Hash: 13128270A01609DFDB10DF68CD49BAEBBB5EF45314F1482A8E815AB2E2DB70DD44CB60

Function 00C1EAF0 Relevance: 26.1, APIs: 17, Instructions: 608COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00C1EB28
GetWindowLongW.USER32(?,000000EB), ref: 00C1EBA3
ShowWindow.USER32(00000000,?), ref: 00C1EBC2
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00C1EBD0
GetWindowRect.USER32(00000000,?), ref: 00C1EBE7
ShowWindow.USER32(00000000,?), ref: 00C1EC08
SetWindowLongW.USER32(?,000000EB,?), ref: 00C1EC1F

Part of subcall function 00C18590: RaiseException.KERNEL32(6C34C19C,6C34C19C,00000000,00000000,00DB3F71,C000008C,00000001,?,00DB3FA2,00000000,?,?,?,00C090D7,00000000,6C34C19C), ref: 00C1859C

GetClientRect.USER32(?,?), ref: 00C1ECD8
ShowWindow.USER32(?,?), ref: 00C1ED5D
GetWindowLongW.USER32(?,000000EB), ref: 00C1ED8C
ShowWindow.USER32(?,?), ref: 00C1EDA9
GetWindowRect.USER32(?,?), ref: 00C1EDCE

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$LongRectShow$Client$ExceptionRaise
String ID:
API String ID: 3804784045-0
Opcode ID: 427dfa68cdd77a5a5ab6be8dc542103cee743a783b1a7fb2e7948114836decb3
Instruction ID: d368935b992a401220b32b8947a366925b3e6df8c1ffadca328b74d37de2183b
Opcode Fuzzy Hash: 427dfa68cdd77a5a5ab6be8dc542103cee743a783b1a7fb2e7948114836decb3
Instruction Fuzzy Hash: FD423971A04248DFCB24CFA9D884AADBBF5FF89300F10456DE856E7260D730A986DF51

Function 00C14BC0 Relevance: 22.9, APIs: 15, Instructions: 390memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C15050: EnterCriticalSection.KERNEL32(00EC957C,6C34C19C,00000000,?,?,?,?,?,?,00C1487E,00DDF9CD,000000FF), ref: 00C1508D
Part of subcall function 00C15050: LoadCursorW.USER32(00000000,00007F00), ref: 00C15108
Part of subcall function 00C15050: LoadCursorW.USER32(00000000,00007F00), ref: 00C151AE

SysFreeString.OLEAUT32(00000000), ref: 00C14C63
SysAllocString.OLEAUT32(00000000), ref: 00C14C94
GetWindowLongW.USER32(?,000000EC), ref: 00C14D6B
GetWindowLongW.USER32(?,000000EC), ref: 00C14D7B
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00C14D86
NtdllDefWindowProc_W.NTDLL(?,?,00000001,?), ref: 00C14D94
GetWindowLongW.USER32(?,000000EB), ref: 00C14DA2
SetWindowTextW.USER32(?,00E4446C), ref: 00C14E41
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00C14E76
GlobalLock.KERNEL32(00000000), ref: 00C14E84
GlobalUnlock.KERNEL32(?), ref: 00C14ED8
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00C14F63
SysFreeString.OLEAUT32(00000000), ref: 00C14F7C
NtdllDefWindowProc_W.NTDLL(?,?,?,00000000), ref: 00C14FC3
SysFreeString.OLEAUT32(00000000), ref: 00C14FE5

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$Long$String$FreeGlobal$AllocCursorLoadNtdllProc_$CriticalEnterLockSectionTextUnlock
String ID:
API String ID: 4180125975-0
Opcode ID: 4a2a2cb1168c05efe9e6a325646c009150aea19d327902dbe31c6860290dfb2d
Instruction ID: a5ada3ada28d4f3be1d862367c54167cb2ddee6d4b1597496f1adc9b8ad318e1
Opcode Fuzzy Hash: 4a2a2cb1168c05efe9e6a325646c009150aea19d327902dbe31c6860290dfb2d
Instruction Fuzzy Hash: 8ED1CD71904209EFDB14DFA4CC48FEFBBB8EF46310F144168E821A7291D7759A45EBA1

Function 00D28F30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 419fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

FindFirstFileW.KERNEL32(?,?,?,00000001), ref: 00D292D2
FindClose.KERNEL32(00000000), ref: 00D29300
FindClose.KERNEL32(00000000), ref: 00D29389

Strings

An acceptable version was found., xrefs: 00D29872
No acceptable version found. It must be downloaded manually from a site., xrefs: 00D29887
No acceptable version found. It is already downloaded and it will be installed., xrefs: 00D29895
No acceptable version found. Operating System not supported., xrefs: 00D2988E
Not selected for install., xrefs: 00D298A3
No acceptable version found. It must be downloaded., xrefs: 00D29880
No acceptable version found., xrefs: 00D2989C
No acceptable version found. It must be installed from package., xrefs: 00D29879

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Find$CloseInit_thread_footer$FileFirstHeapProcess
String ID: An acceptable version was found.$No acceptable version found.$No acceptable version found. It is already downloaded and it will be installed.$No acceptable version found. It must be downloaded manually from a site.$No acceptable version found. It must be downloaded.$No acceptable version found. It must be installed from package.$No acceptable version found. Operating System not supported.$Not selected for install.
API String ID: 544434140-749633484
Opcode ID: 81646d9f5aa4d2c3f0f5a4b040a5594574316110288ee6345ca1cc981c9e0e40
Instruction ID: 588745f025997006cb0ed6a98607b2011f01a51f48e924a58b3b49882dd4dfa4
Opcode Fuzzy Hash: 81646d9f5aa4d2c3f0f5a4b040a5594574316110288ee6345ca1cc981c9e0e40
Instruction Fuzzy Hash: D0F1CF70A04216CFDB10DF38C8587AEFBF0EF55314F188698D859AB392DB349A45CBA0

Function 00CFA2A0 Relevance: 19.7, APIs: 13, Instructions: 155windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001036,00010000,00000000), ref: 00CFA30B
GetParent.USER32(00000000), ref: 00CFA35E
GetWindowRect.USER32(00000000), ref: 00CFA361
GetParent.USER32(00000000), ref: 00CFA370
GetDC.USER32(00000000), ref: 00CFA373
CreateCompatibleDC.GDI32(00000000), ref: 00CFA3A0
CreateCompatibleBitmap.GDI32(00000000), ref: 00CFA3DF
SelectObject.GDI32(?,00000000), ref: 00CFA3F0
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 00CFA406

Part of subcall function 00CB39A0: IsWindowVisible.USER32(?), ref: 00CB3A1A
Part of subcall function 00CB39A0: GetWindowRect.USER32(?,?), ref: 00CB3A32
Part of subcall function 00CB39A0: GetWindowRect.USER32(?,?), ref: 00CB3A4A
Part of subcall function 00CB39A0: IntersectRect.USER32(?,?,?), ref: 00CB3A67
Part of subcall function 00CB39A0: EqualRect.USER32(?,?), ref: 00CB3A77
Part of subcall function 00CB39A0: GetSysColorBrush.USER32(0000000F), ref: 00CB3A8D

FillRect.USER32(?,?,00000000), ref: 00CFA41C
DeleteDC.GDI32(?), ref: 00CFA43C
SendMessageW.USER32(?,00001026,00000000,000000FF), ref: 00CFA460
SendMessageW.USER32(?,0000108A,00000000,00000011), ref: 00CFA473

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Rect$Window$MessageSend$CompatibleCreateParent$BitmapBrushColorDeleteEqualFillIntersectObjectPointsSelectVisible
String ID:
API String ID: 2161025992-0
Opcode ID: 16e62071f0c243716fc9201210a3d9da570817ced9c744e0ad2ea2e6ed875ee3
Instruction ID: 50cd00cfbd70f6e4fa4ca1a0137e8d7c2b253f06d9372eee3f0e9fa6afd9a163
Opcode Fuzzy Hash: 16e62071f0c243716fc9201210a3d9da570817ced9c744e0ad2ea2e6ed875ee3
Instruction Fuzzy Hash: 61516670D04648AFDB10CFA9CD44BDEBBF8EF59710F10432AE855B7290EB716A858B60

Function 00D2CFD0 Relevance: 19.1, APIs: 2, Strings: 8, Instructions: 1614fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

Part of subcall function 00C092A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00C21134,00000000,?,00000010,?,*.*,?,80070057), ref: 00C092C3

CopyFileW.KERNEL32(?,?,00000000,00000000,00000000), ref: 00D2D558
CopyFileW.KERNEL32(?,?,00000000,00000000,00000000,?,?,?,?), ref: 00D2DA59

Part of subcall function 00D04B40: MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,00000000,00000000,?,?,00EC9384,00D4DA40,?), ref: 00D04B58
Part of subcall function 00D04B40: MultiByteToWideChar.KERNEL32(00000003,00000000,80000004,000000FF,?,-00000001), ref: 00D04B8A

Strings

instname-custom.mst, xrefs: 00D2D50B, 00D2DA0C
AI_PRODUCTNAME_ARP, xrefs: 00D2D6AF, 00D2D6C1, 00D2D6CB, 00D2DC19, 00D2DC2B, 00D2DC35
{%0.8X-%0.4X-%0.4X-%0.2X%0.2X-%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X}, xrefs: 00D2D8A3
ProductName, xrefs: 00D2D627, 00D2D639, 00D2D643, 00D2DBA2, 00D2DBB4, 00D2DBBE
instname-target.msi, xrefs: 00D2D4CD, 00D2D9CE
InstanceId, xrefs: 00D2DD04, 00D2DD16, 00D2DD1E
\\?\, xrefs: 00D2D436, 00D2D930
ProductCode, xrefs: 00D2DC90, 00D2DCA2, 00D2DCAC

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ByteCharCopyFileHeapInit_thread_footerMultiWide$AllocateFindProcessResource
String ID: AI_PRODUCTNAME_ARP$InstanceId$ProductCode$ProductName$\\?\$instname-custom.mst$instname-target.msi${%0.8X-%0.4X-%0.4X-%0.2X%0.2X-%0.2X%0.2X%0.2X%0.2X%0.2X%0.2X}
API String ID: 2868415777-2893908338
Opcode ID: fbf37d152083762f0929d789c8444bd45615c0aa6aae7e7080490daa7ed8f8f1
Instruction ID: 9c8f07087e4a6b17e19671b690a2e9102c355395d2774f269f4c75b4944fc9c4
Opcode Fuzzy Hash: fbf37d152083762f0929d789c8444bd45615c0aa6aae7e7080490daa7ed8f8f1
Instruction Fuzzy Hash: E0D2B171A00649DFDB00DFA8D849BAEBBF5EF55318F188169E415EB292DB34DD04CBA0

Function 00CFAA20 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 373windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 00CFACDA
RedrawWindow.USER32(?,00000000,00000000,00000541), ref: 00CFACEC
SendMessageW.USER32(?,00000443,00000000), ref: 00CFAD44
GetDC.USER32(00000000), ref: 00CFAD68
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00CFAD73
MulDiv.KERNEL32(?,00000000), ref: 00CFAD7B
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?), ref: 00CFADA0

Strings

Segoe UI, xrefs: 00CFAD52
NumberValidationTipMsg, xrefs: 00CFABA1
NumberValidationTipTitle, xrefs: 00CFAA94

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$CapsCreateDeviceFontMessageRedrawSend
String ID: NumberValidationTipMsg$NumberValidationTipTitle$Segoe UI
API String ID: 367477953-2319862951
Opcode ID: 5e4743c39d0917f773202cebbeff145e16393e10a64f876f6aea5cc2790f87dc
Instruction ID: 2f39a932d87ffb2c6c4b689caa16cb6a625c1d3a61ccadbb5d08061f751fe4ad
Opcode Fuzzy Hash: 5e4743c39d0917f773202cebbeff145e16393e10a64f876f6aea5cc2790f87dc
Instruction Fuzzy Hash: 91E1CE71A00708AFEB18CF64CC59BEEB7B1EF49300F108259E55AA72D1DB746A49CF91

Function 00C144A0 Relevance: 16.9, APIs: 11, Instructions: 417nativememoryCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(80070216,000000EC), ref: 00C146CB
GetWindowLongW.USER32(00000000,000000EC), ref: 00C146DB
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 00C146E6
NtdllDefWindowProc_W.NTDLL(00000000,00000000,00000001,80070216,?,?,80070216), ref: 00C146F4
GetWindowLongW.USER32(00000000,000000EB), ref: 00C14702
SetWindowTextW.USER32(00000000,00E4446C), ref: 00C147A1
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00C147D6
GlobalLock.KERNEL32(00000000), ref: 00C147E4
GlobalUnlock.KERNEL32(?), ref: 00C14838
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00C1489D
NtdllDefWindowProc_W.NTDLL(00000000,00000000,6C34C19C,00000000), ref: 00C148EF

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$Long$Global$NtdllProc_$AllocLockTextUnlock
String ID:
API String ID: 3555041256-0
Opcode ID: 81cd5dc4ad387b7955401c6e4d8dcbe7f8f416ab872eb6960c4b9b54eccc6997
Instruction ID: 0a6b187d587ef13ecd92c718f9da6baab34260c8f1a0da7ea3c7df64401d9b1b
Opcode Fuzzy Hash: 81cd5dc4ad387b7955401c6e4d8dcbe7f8f416ab872eb6960c4b9b54eccc6997
Instruction Fuzzy Hash: B0E1D071A00205DFDB18DF69CC48BEFBBA9EF46314F140129E921E7291DB34DA44EBA0

Function 00D02AF0 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 248fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000), ref: 00D02BDF
CloseHandle.KERNEL32(00000000), ref: 00D02C07
WriteFile.KERNEL32(?,?,?,?,00000000,?,?,?), ref: 00D02C49
CloseHandle.KERNEL32(?), ref: 00D02C9E
ShellExecuteExW.SHELL32 ref: 00D02D33

Strings

.bat, xrefs: 00D02B3E
EXE, xrefs: 00D02B43
runas, xrefs: 00D02D1B
open, xrefs: 00D02CC8

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CloseFileHandle$CreateExecuteShellWrite
String ID: .bat$EXE$open$runas
API String ID: 548387358-1492471297
Opcode ID: c05297aee92af2aceb80f5a3b248f24871045ee307365bfad472d33d88d53518
Instruction ID: 2edd979032932ae8faa41a8df577fb31d335154c6ce77e5a0bc921dc76e49875
Opcode Fuzzy Hash: c05297aee92af2aceb80f5a3b248f24871045ee307365bfad472d33d88d53518
Instruction Fuzzy Hash: 83A17D70902648DFEB11CFA8C948BADBBB4FF45314F148299E419AB2D1DB749D44CF60

Function 00C2C116 Relevance: 13.1, Strings: 10, Instructions: 592COMMON

Download Yara Rule

Strings

MsiEvaluateCondition, xrefs: 00C2C298
MsiGetProperty, xrefs: 00C2C1CF
MsiPublishEvents, xrefs: 00C2C5BC
MsiResolveFormatted, xrefs: 00C2C361
MsiGetFormattedError, xrefs: 00C2C817
MessageBox, xrefs: 00C2C685
MsiGetBinaryPathIndirect, xrefs: 00C2C4F3
MsiGetBinaryPath, xrefs: 00C2C42A
MsiGetBytesCountText, xrefs: 00C2C74E
GetFontHeight, xrefs: 00C2C8E0

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID: GetFontHeight$MessageBox$MsiEvaluateCondition$MsiGetBinaryPath$MsiGetBinaryPathIndirect$MsiGetBytesCountText$MsiGetFormattedError$MsiGetProperty$MsiPublishEvents$MsiResolveFormatted
API String ID: 0-2027876840
Opcode ID: 268aaca8cff4a851f1b90d7ac463c95c1c13bbc31142c03c37fdb5f95c47186d
Instruction ID: 45bcdf857ad53a7fc9bc91d77c56dbed0370ed2d34088101f6b8b20a96941d65
Opcode Fuzzy Hash: 268aaca8cff4a851f1b90d7ac463c95c1c13bbc31142c03c37fdb5f95c47186d
Instruction Fuzzy Hash: 664249B1D10259CFDF14CFA8D885BDEBBB1FF48314F20821AE015AB691E7746686CB94

Function 00C2C127 Relevance: 13.1, Strings: 10, Instructions: 591COMMON

Download Yara Rule

Strings

MsiEvaluateCondition, xrefs: 00C2C298
MsiGetProperty, xrefs: 00C2C1CF
MsiPublishEvents, xrefs: 00C2C5BC
MsiResolveFormatted, xrefs: 00C2C361
MsiGetFormattedError, xrefs: 00C2C817
MessageBox, xrefs: 00C2C685
MsiGetBinaryPathIndirect, xrefs: 00C2C4F3
MsiGetBinaryPath, xrefs: 00C2C42A
MsiGetBytesCountText, xrefs: 00C2C74E
GetFontHeight, xrefs: 00C2C8E0

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID: GetFontHeight$MessageBox$MsiEvaluateCondition$MsiGetBinaryPath$MsiGetBinaryPathIndirect$MsiGetBytesCountText$MsiGetFormattedError$MsiGetProperty$MsiPublishEvents$MsiResolveFormatted
API String ID: 0-2027876840
Opcode ID: 7d2a491b4d78dc18618b78814a456101c6f39b1524578134ab1e44c6e011206b
Instruction ID: 9b34afee43fd9296c70cb406437d900b08ca794587e291509f68f86db9e7a286
Opcode Fuzzy Hash: 7d2a491b4d78dc18618b78814a456101c6f39b1524578134ab1e44c6e011206b
Instruction Fuzzy Hash: 8C4239B1D10259CFDF14CFA8D885BDEBBB1FF48314F20821AE015AB691E7746686CB94

Function 00D49310 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 410COMMON

Download Yara Rule

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

_wcsrchr.LIBVCRUNTIME ref: 00D4949D
_wcsrchr.LIBVCRUNTIME ref: 00D494C5
GetLogicalDriveStringsW.KERNEL32(00000064,?), ref: 00D4951E
GetDriveTypeW.KERNEL32(?), ref: 00D4953A
Wow64DisableWow64FsRedirection.KERNEL32(00000000,00000000), ref: 00D495C1
Wow64RevertWow64FsRedirection.KERNEL32(00000000,00000000), ref: 00D49821

Strings

]%!, xrefs: 00D494B9

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Wow64$DriveInit_thread_footerRedirection_wcsrchr$DisableHeapLogicalProcessRevertStringsType
String ID: ]%!
API String ID: 139206881-1069524040
Opcode ID: 95ba299e195e4f4c0e1339671c4062843c6accc45cfa02a8d020eef1a841fe68
Instruction ID: f3160421f26ed66d349b11b1a61d0b593fd3481bb867ccd8084c65eca4ab6d87
Opcode Fuzzy Hash: 95ba299e195e4f4c0e1339671c4062843c6accc45cfa02a8d020eef1a841fe68
Instruction Fuzzy Hash: E1F1D271900259CFDB24DF69C858BAEF7B5EF45310F1482E8E519A7292DB709E84CFA0

Function 00DB41D9 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,00DB40F5,00000000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB41DB
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB4202
HeapAlloc.KERNEL32(00000000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB4209
InitializeSListHead.KERNEL32(00000000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB4216
GetProcessHeap.KERNEL32(00000000,00000000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB422B
HeapFree.KERNEL32(00000000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB4232

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: e21a72a623d0ff5345313ff877055253aa0b4d7fa2923724daa707f7a7837e95
Instruction ID: 070c23b7440739381363fea19c0838291798c896b0004b019a5b982ccdfc556d
Opcode Fuzzy Hash: e21a72a623d0ff5345313ff877055253aa0b4d7fa2923724daa707f7a7837e95
Instruction Fuzzy Hash: A6F04F35640601DFD7109F6AAC0CB567AF8FB99B12F044428FA86E7251DB70D8059A60

Function 00D1A850 Relevance: 7.7, APIs: 5, Instructions: 240fileCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00D1A8A8

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

FindFirstFileW.KERNEL32(?,00000000,?,?,00000000), ref: 00D1A9A8
FindFirstFileW.KERNEL32(?,00000000,0000002A,?,00000000,?,?,00000000), ref: 00D1AA45
FindClose.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 00D1AA6B
FindClose.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 00D1AAB5

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Find$CloseFileFirstInit_thread_footer$HeapProcess_wcsrchr
String ID:
API String ID: 352340201-0
Opcode ID: 30a6877d4879be4b4d5b88a006dedef8beee12baedd484a2f0fd96e4542a6e53
Instruction ID: 3b8c7c3e64a4a5d9df06386f0f9155356d8b79945240e9c3e9792e2e09d6669e
Opcode Fuzzy Hash: 30a6877d4879be4b4d5b88a006dedef8beee12baedd484a2f0fd96e4542a6e53
Instruction Fuzzy Hash: 0F71E071A01209EFDB10DF68DD49BEAB7F4FF45324F244219E815D7281EB749988CB62

Function 00DCCBBA Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00DCCC47

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: fcc137dfe0708e1f7a0708534d1b12ff6f576f64afdac42b5cb573f5b23bebeb
Instruction ID: f959e2c655c3346997eafb5db214238b20676885a52a8ae287ac981338eb7dd1
Opcode Fuzzy Hash: fcc137dfe0708e1f7a0708534d1b12ff6f576f64afdac42b5cb573f5b23bebeb
Instruction Fuzzy Hash: ABB126329142469FDB15CF68C881FFEBBA5EF56310F18916EEA09AB241D234DD01CBB0

Function 00D4A4B0 Relevance: 6.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c89cf38be516ce6c18d0c947f3e0c94f9acad217a7c4e105e0906d902e6a6ec
Instruction ID: c3d451c678562747e899ee82b4e48daef8083a5b149633bd501ea52f7942083a
Opcode Fuzzy Hash: 1c89cf38be516ce6c18d0c947f3e0c94f9acad217a7c4e105e0906d902e6a6ec
Instruction Fuzzy Hash: 6C818F71901218DFDB60DF6CCC49B99BBB4EF45314F1882D9E819AB292DB709E44CFA1

Function 00C22390 Relevance: 6.1, APIs: 4, Instructions: 87timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00000003,00000001,6C34C19C,?,?,?,?,00DE1D64,000000FF), ref: 00C223D1
GetWindowLongW.USER32(00000003,000000FC), ref: 00C223E6
SetWindowLongW.USER32(00000003,000000FC,?), ref: 00C223F8
DeleteCriticalSection.KERNEL32(?,6C34C19C,?,?,?,?,00DE1D64,000000FF), ref: 00C22423

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: LongWindow$CriticalDeleteKillSectionTimer
String ID:
API String ID: 1032004442-0
Opcode ID: afddfed6196cfb8b929a7f60254051e8edca899eea672316fd980993741cb8f1
Instruction ID: 33f0635f69024d504dfe60c7b65622a1a55ee0940f62cadc45654fc4f3ade945
Opcode Fuzzy Hash: afddfed6196cfb8b929a7f60254051e8edca899eea672316fd980993741cb8f1
Instruction Fuzzy Hash: 2031D270A04656FFCB10DF29DC04F99BBB8FF05310F108269E864A3692D771EA15DBA0

Function 00C2DAC0 Relevance: 5.9, APIs: 1, Strings: 2, Instructions: 656COMMON

Download Yara Rule

APIs

Part of subcall function 00DB4BA2: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4BAD
Part of subcall function 00DB4BA2: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4BEA

__Init_thread_footer.LIBCMT ref: 00C2DB5E

Part of subcall function 00DB4B58: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B62
Part of subcall function 00DB4B58: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B95
Part of subcall function 00DB4B58: RtlWakeAllConditionVariable.NTDLL ref: 00DB4C0C

Strings

AiFeatIco, xrefs: 00C2DE4B
Icon, xrefs: 00C2DF23

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: AiFeatIco$Icon
API String ID: 2296764815-1280411655
Opcode ID: 15317e93c6229fdbdc093f80ebfa96f60debb79e673f03b260377db4a69ba4b7
Instruction ID: d490af0abe52213f30d58169b225b3ba651643a44638209988cfe1831cb854c0
Opcode Fuzzy Hash: 15317e93c6229fdbdc093f80ebfa96f60debb79e673f03b260377db4a69ba4b7
Instruction Fuzzy Hash: D1527B70A00668DFDB24DF68CC58BDDBBB4FB59304F1442A9E419AB291DB706E85CF90

Function 00C24200 Relevance: 5.7, Strings: 4, Instructions: 720COMMON

Download Yara Rule

Strings

AI_NO_BORDER_NORMAL, xrefs: 00C2430E
AI_CONTROL_VISUAL_STYLE_EX, xrefs: 00C246F2
AI_CONTROL_VISUAL_STYLE, xrefs: 00C2426E
AI_NO_BORDER_HOVER, xrefs: 00C243CF

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID: AI_CONTROL_VISUAL_STYLE$AI_CONTROL_VISUAL_STYLE_EX$AI_NO_BORDER_HOVER$AI_NO_BORDER_NORMAL
API String ID: 0-932585912
Opcode ID: dffdf526b7fa49ccb1436d791c20f653abac66927b1fe2ab8b3a2eea73268397
Instruction ID: d8111bb4b666ad955057cc7ab7f6212b2ba8a2027402a45959f1e7eeddbba842
Opcode Fuzzy Hash: dffdf526b7fa49ccb1436d791c20f653abac66927b1fe2ab8b3a2eea73268397
Instruction Fuzzy Hash: 7342D071D00228CBDF18DF68DC59BAEB7B1FF85300F148259E4A5AB781D774AA05CBA1

Function 00D4A8B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?), ref: 00D4A96C
FindClose.KERNEL32(00000000), ref: 00D4AAB7

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Strings

%d.%d.%d.%d, xrefs: 00D4AA49

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Find$AllocateCloseFileFirstHeap
String ID: %d.%d.%d.%d
API String ID: 1673784098-3491811756
Opcode ID: ee52bdf0bd37658e1c61bd2edea1eb1c02e43732fb29578003091e928d30997c
Instruction ID: 4b849b59a934a9871e0fb7d014e475acd58f1e001c41eb54e33d380ef641ceb1
Opcode Fuzzy Hash: ee52bdf0bd37658e1c61bd2edea1eb1c02e43732fb29578003091e928d30997c
Instruction Fuzzy Hash: DA61A070905219DFDF20DF28CD49B9DBBB4EF44314F148299E808AB291DB759E84CF91

Function 00C28080 Relevance: 5.4, Strings: 4, Instructions: 371COMMON

Download Yara Rule

Strings

OldProductCode, xrefs: 00C28460
MultipleInstances, xrefs: 00C281B9
MultipleInstancesProps, xrefs: 00C2829D
ProductCode, xrefs: 00C283F0

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID: MultipleInstances$MultipleInstancesProps$OldProductCode$ProductCode
API String ID: 0-469785651
Opcode ID: 207a98bbfdce51172e5603017771ee6c9249d85829f73b8fdfe6e7c23827f9e1
Instruction ID: 8b2c97fb9a641504b611db0898a69c0142712291ffd84c97ec25160171a826d1
Opcode Fuzzy Hash: 207a98bbfdce51172e5603017771ee6c9249d85829f73b8fdfe6e7c23827f9e1
Instruction Fuzzy Hash: 8DD13975A01211CFDB18DF18D851BAEB3B1FF94704F14865DD912ABB91EB30AE0ACB90

Function 00D430D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

GetLocaleInfoW.KERNEL32(?,00000002,00E4446C,00000000), ref: 00D43141
GetLocaleInfoW.KERNEL32(?,00000002,00D42CC5,-00000001,00000078,-00000001), ref: 00D4317D

Strings

%d-%s, xrefs: 00D43187

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: InfoInit_thread_footerLocale$HeapProcess
String ID: %d-%s
API String ID: 1688948774-1781338863
Opcode ID: 2647ff9f8611fc6079df1861ca06050e6236fc155f1ae535795415c70c1ddcca
Instruction ID: e316270c0b144dcf6cc5abc5b969dfe9daaf70625972a98bd0fb83798095208f
Opcode Fuzzy Hash: 2647ff9f8611fc6079df1861ca06050e6236fc155f1ae535795415c70c1ddcca
Instruction Fuzzy Hash: 9F318BB1A00209AFDB00DFA9CC4ABAEFBB8FF44714F108659F515A72D2DB755908CB90

Function 00DB19D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00DB1916,0000001C,00DB1B0B,00000000,?,?,?,?,?,?,?,00DB1916,00000004,00EC7A44,00DB1B9B), ref: 00DB19E2
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00DB1916,00000004,00EC7A44,00DB1B9B), ref: 00DB19FD

Strings

D, xrefs: 00DB19F1

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 3b1da9e4f002bcbda87f21582602bf6b4a717db90b388cf17e170f7661088635
Instruction ID: 302abc6cdfc3f9b97adf23563a2bcb354b1cc32b5c5a06e20dc72ac8c6479346
Opcode Fuzzy Hash: 3b1da9e4f002bcbda87f21582602bf6b4a717db90b388cf17e170f7661088635
Instruction Fuzzy Hash: 7C01F736A00109ABCF14DE29DC19BEE7BA9AFC4324F0CC221ED5AE7145DA74E8068690

Function 00CFFE80 Relevance: 4.7, APIs: 3, Instructions: 193fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,6C34C19C,?), ref: 00CFFF4C
FindNextFileW.KERNEL32(000000FF,00000010,?,6C34C19C,?), ref: 00D000A5
FindClose.KERNEL32(000000FF,?,?,6C34C19C,?), ref: 00D00104

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: ff5967c55b586abffad1c521dbf5fe6251268d421d5acf8849f042778622f2e1
Instruction ID: 59d201d15d5c3bb4e562b57e7a651d4d7aa6e709b44efac38f81a7068f0fc644
Opcode Fuzzy Hash: ff5967c55b586abffad1c521dbf5fe6251268d421d5acf8849f042778622f2e1
Instruction Fuzzy Hash: C781BE70D04259DFDF24DFA4C859BEDBBB4EF05300F508299E819A7291DB706A85CB61

Function 00C1E6B0 Relevance: 4.6, APIs: 3, Instructions: 93COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000004), ref: 00C1E6FE
GetWindowLongW.USER32(00000004,000000FC), ref: 00C1E717
SetWindowLongW.USER32(00000004,000000FC,?), ref: 00C1E729

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 366a354c3ccc8e7d116c34852ba3c3ea2d50a1e17da4a3463683905971b77ab7
Instruction ID: 0d599574517c41997fc87a6dbb32ec5ef724fca2f24d2c4b125b449b734e764a
Opcode Fuzzy Hash: 366a354c3ccc8e7d116c34852ba3c3ea2d50a1e17da4a3463683905971b77ab7
Instruction Fuzzy Hash: 03418CB0604A46EFEB10CF69D908B9AFBB4FF05314F104268E825D7AD0D776E924DB90

Function 00DB9913 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00DB9A0B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00DB9A15
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00DB9A22

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 30b2e6f4eac3b0f59adb52cb35c3c469a91da970d01ffb6f4d46e1015b2c382f
Instruction ID: da1a4d19976bf416d3a64d672d74bd1ad5cb744266eeb911f1035aa422d37ab8
Opcode Fuzzy Hash: 30b2e6f4eac3b0f59adb52cb35c3c469a91da970d01ffb6f4d46e1015b2c382f
Instruction Fuzzy Hash: FD31B27490122CEBCB21DF29D989BCDBBB8AF18310F5041EAE41DA7251EB709F858F55

Function 00C09160 Relevance: 4.6, APIs: 3, Instructions: 65COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,6C34C19C,00000001,00000000,?,00000000,00DDC480,000000FF,?,00C0910C,6C34C19C,?,?,*.*,?), ref: 00C0918B
LockResource.KERNEL32(00000000,?,00C0910C,6C34C19C,?,?,*.*,?,00000000,00DDCB30,000000FF,?,00C092B0,?,?,*.*), ref: 00C09196
SizeofResource.KERNEL32(00000000,00000000,?,00C0910C,6C34C19C,?,?,*.*,?,00000000,00DDCB30,000000FF,?,00C092B0,?,?), ref: 00C091A4

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 887e6ed572b2a5fc9bdae260390c207cbf87e59d94f93bd1d5dfcfe1709ad7c6
Instruction ID: 17133dd05e03f11f40dda15e71d63be8bb638d68708245c7d2f862601d7aa6db
Opcode Fuzzy Hash: 887e6ed572b2a5fc9bdae260390c207cbf87e59d94f93bd1d5dfcfe1709ad7c6
Instruction Fuzzy Hash: 6711E736B006559FC7348F29DC49B6AB7E8EB89720F00492BEC5AD3281E6759D00CA90

Function 00C17190 Relevance: 4.5, APIs: 3, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(0000001B,000000FC), ref: 00C171A9
SetWindowLongW.USER32(0000001B,000000FC,?), ref: 00C171B7
DestroyWindow.USER32(0000001B), ref: 00C171E3

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$Long$Destroy
String ID:
API String ID: 3055081903-0
Opcode ID: e7b96dd569c0756f119fb355b871096a8b88e0a5abf53879ef923c73102efdb1
Instruction ID: 8c959545687952e72125803426b5f3876305a380aaf96c701d92f27177bb51ef
Opcode Fuzzy Hash: e7b96dd569c0756f119fb355b871096a8b88e0a5abf53879ef923c73102efdb1
Instruction Fuzzy Hash: FCF0307000CF11AFD7615F29ED05F86BBE1BF05721B104728E4FA925E0CB31A945EB00

Function 00D4D180 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,6C34C19C), ref: 00D4D1DE

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

Strings

%04d-%02d-%02d %02d-%02d-%02d, xrefs: 00D4D220

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Init_thread_footer$HeapLocalProcessTime
String ID: %04d-%02d-%02d %02d-%02d-%02d
API String ID: 219929307-3768011868
Opcode ID: 617706efd9b767d19d9f63b1136dfa824e489ab858eebba36bd8e7c7e6f0b160
Instruction ID: 1574cc2a20d66323ce7a3634b4a715ee9cd9fcb1eb1c072a709b99099ddaf202
Opcode Fuzzy Hash: 617706efd9b767d19d9f63b1136dfa824e489ab858eebba36bd8e7c7e6f0b160
Instruction Fuzzy Hash: 09217CB1D00218AFDB14DF99D941BBEB7F8EB0C710F10422EF955A7281EB745944CBA5

Function 00C2F4E0 Relevance: 3.3, APIs: 2, Instructions: 257windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000102B,00000000,00000001), ref: 00C2F60B
SendMessageW.USER32(?,0000102B,?,-00000002), ref: 00C2F7F5

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d80c19780b5fba5cde6f9b926048af1c2870abbbbdc0c089b8730adf96532c89
Instruction ID: 273b5475ef8d2a3c12e36c0b749bbc51fd52f523b175d6a4bf2fd344ed72ed2d
Opcode Fuzzy Hash: d80c19780b5fba5cde6f9b926048af1c2870abbbbdc0c089b8730adf96532c89
Instruction Fuzzy Hash: F3B1C071A0025AAFDB18CF24C995BA9FBF5FB05304F14827DE469DB691D730EA42CB90

Function 00D1E5B0 Relevance: 3.1, APIs: 2, Instructions: 134windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,6C34C19C,?,00000000), ref: 00D1E5FB
GetLastError.KERNEL32(?,00000000), ref: 00D1E605

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AllocateErrorFormatHeapLastMessage
String ID:
API String ID: 4114510652-0
Opcode ID: 280eb4553c603e3b510796d13df4c0979e76f1df0cf97984f901fcf56d06db0d
Instruction ID: 440cc1198fa04a56050ce3ddcaa7c0c1af43fcf4b0e713b4466f093b671f7fcd
Opcode Fuzzy Hash: 280eb4553c603e3b510796d13df4c0979e76f1df0cf97984f901fcf56d06db0d
Instruction Fuzzy Hash: 2241D0B1A01219AFEB14CF99D8057AEFBF4EB44714F18466AEC05E73C1DBB55904CBA0

Function 00C710D0 Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000FC), ref: 00C7113F
SetWindowLongW.USER32(00000000,000000FC,?), ref: 00C7114D

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 592e62e68fa18dc09b601242513454425dee1f13e5e7154208583d4450b850d4
Instruction ID: db23f0dda2c6b0c2fc11d4436d665ed5d31688cc44b71a5fb6c3cab809f1f99c
Opcode Fuzzy Hash: 592e62e68fa18dc09b601242513454425dee1f13e5e7154208583d4450b850d4
Instruction Fuzzy Hash: 20318971904605EFCB10DF69C944B9AFBB4FF05320F548269E824AB6D1C732AA54CBA0

Function 00C3D8C0 Relevance: 3.0, APIs: 2, Instructions: 10COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 00C3D8C5
SetUnhandledExceptionFilter.KERNEL32(Function_0011A060), ref: 00C3D8DB

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ExceptionFilterUnhandled__set_se_translator
String ID:
API String ID: 2480343447-0
Opcode ID: 4f4c81f61c09f6cfbfc485e0ba87fe497f52c47f6c0b3eb743eaa94de390b0e5
Instruction ID: 5fae01514887a866c4711ef7f58f3cec150d42c01a8b98d17a2dc236bbd5db56
Opcode Fuzzy Hash: 4f4c81f61c09f6cfbfc485e0ba87fe497f52c47f6c0b3eb743eaa94de390b0e5
Instruction Fuzzy Hash: 14D02220884244EFE7048721BC1EB843FB0F714309F080028D40B211C3CBA2A88DE733

Function 00C745B0 Relevance: 1.8, Strings: 1, Instructions: 521COMMON

Download Yara Rule

Strings

unordered_map/set too long, xrefs: 00C74795, 00C74982

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ExceptionRaise__floor_pentium4
String ID: unordered_map/set too long
API String ID: 996205981-306623848
Opcode ID: 66c2c47102cc6db0291840c0f756d64e7a6efcdd4dd6c95ec4c0c650da3d1a8f
Instruction ID: 758e6e3b970cec7d0dd9d20604a27bb6759043b0a93bf924fd491e4aaf9e3b29
Opcode Fuzzy Hash: 66c2c47102cc6db0291840c0f756d64e7a6efcdd4dd6c95ec4c0c650da3d1a8f
Instruction Fuzzy Hash: 2012C371A006099FCB09DF69C881AADF7F5EF48350F14C26AE819EB391D731E951CB90

Function 00C27AC0 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,-00002000,?,?,00C260F7,?,?,?,?,?,?,?,?,00C25F68,?,?), ref: 00C27B10

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 3a50672c01ef9246dbdcdc4e4dd8fcf3563d02c46e2a97f378fb0800165e3f79
Instruction ID: f59b4b30928a445036f6495e8bbe2e1b144d71003a16d475524f3d470b2e49b4
Opcode Fuzzy Hash: 3a50672c01ef9246dbdcdc4e4dd8fcf3563d02c46e2a97f378fb0800165e3f79
Instruction Fuzzy Hash: 23F0827001C151DFD7118F28E8D8B6ABBA6FB44315F4446F5E054C5860C3358F44EF10

Function 00DD1639 Relevance: .6, Instructions: 637COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaca07b048086fcd8918602b92ceb1e0ec663f032a788cd89185679800d0b382
Instruction ID: 971bfee6f59014c9f14403e036872c02a19b1a3dea31bc7ef0734528a46b9b57
Opcode Fuzzy Hash: eaca07b048086fcd8918602b92ceb1e0ec663f032a788cd89185679800d0b382
Instruction Fuzzy Hash: 6C321325E69F014DD7239639C826336A68DEFB73C5F15D737F82AB5AA5EB28C4834100

Function 00DBD24E Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf63165ef9fdf0965dbe8a6ce38c909efb3737bf227600ebaa4b72577398472
Instruction ID: 2b96a39cc410a2ab22a82517358e4422aaa36f9492521e7d3524eda5d96f06d1
Opcode Fuzzy Hash: 5cf63165ef9fdf0965dbe8a6ce38c909efb3737bf227600ebaa4b72577398472
Instruction Fuzzy Hash: 2BE16C74A00605CFCB24DF68C580AEAB7F2FF49314B284659D49B9B291E730ED46CB75

Function 00DBCEC0 Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae966dfa230d7057cf89edd88e88591a5397cc8ccbafebc79760b7ed9748f5c4
Instruction ID: 74eff91fb5ebdacd2ef0c201e0c5b0bd7a1c34fc524210cf457a7dcc35ba40e0
Opcode Fuzzy Hash: ae966dfa230d7057cf89edd88e88591a5397cc8ccbafebc79760b7ed9748f5c4
Instruction Fuzzy Hash: E8C17C70900646CFCB249E68C480AFABBB3BF49350F184659E4979B291E731E946CB71

Function 00C15220 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a51eb6b258f29b0b2b6fc9e2ace1fa41fb03fc9698c91d973910a7091bc75dd3
Instruction ID: 75c5c061f1982ef9758a0df42c1292ed06603b8da556f6ce0ac1fdd296361db6
Opcode Fuzzy Hash: a51eb6b258f29b0b2b6fc9e2ace1fa41fb03fc9698c91d973910a7091bc75dd3
Instruction Fuzzy Hash: 607107B1801B48CFE761CF78C94578ABBF0BB05324F144A5ED4A99B3D1D3B96648CB91

Function 00CBC330 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88f6717128fade9a87e878e182fd1cac8f68a3e5067cc670218a479c6c5e1ef1
Instruction ID: c3bf401c89b89349d306cd217419c662330c616f4164ea047e79541293abe452
Opcode Fuzzy Hash: 88f6717128fade9a87e878e182fd1cac8f68a3e5067cc670218a479c6c5e1ef1
Instruction Fuzzy Hash: 794105B0905649EED704CF69C50978AFBF0BB09318F10869DC4589B781C3BAA618CF95

Function 00C1E540 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce945735f8d4359ecfa53336c9bad2b2a7b328b041397809366bf420b3a73bae
Instruction ID: 8d4d58d261752337d70776e3ac5bfb1e5f4f97c572a8fc523d8307c8aed9d95b
Opcode Fuzzy Hash: ce945735f8d4359ecfa53336c9bad2b2a7b328b041397809366bf420b3a73bae
Instruction Fuzzy Hash: D631CFB0405B84CEE321CF2AC658787BFF0AB15718F104A5DD4E69BB91D3BAA548CB91

Function 00C178B0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9902d25ad53aca1cd9e59ea6a366147bfb7ee6f383a230994cebe4f21c166d99
Instruction ID: d191c39e34ea835c03f42ecdebafdbc129d3cb466b20aafcf5b8f548dc4acb75
Opcode Fuzzy Hash: 9902d25ad53aca1cd9e59ea6a366147bfb7ee6f383a230994cebe4f21c166d99
Instruction Fuzzy Hash: 82214CB0804784DFD710CF59C904B8ABBF4FF1A314F1186AED455AB791D3B9AA48CB91

Function 00C358F0 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ab87d32c48e69e16a8fe3176049c8144bc2420eb3574896b2a497a1fe5f666
Instruction ID: bdda5e0ecf5e1cb8c9f73789ff7b5ba4ef76e3d857699421f8e022f3407e3ea4
Opcode Fuzzy Hash: 39ab87d32c48e69e16a8fe3176049c8144bc2420eb3574896b2a497a1fe5f666
Instruction Fuzzy Hash: 1A1100B1905648DFC740CF59D544B49BBF4FB09328F2082AEE8589B381D3769A0ACF94

Function 00DCE8FB Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f085a71b5377a85159d6d6ed49515e1f5627b2e0494222b3d34044b9928ebcce
Instruction ID: 79dd8b9768fd1cadf2fa4fd998df418a5ca17017faccc38b45873dc9650684dd
Opcode Fuzzy Hash: f085a71b5377a85159d6d6ed49515e1f5627b2e0494222b3d34044b9928ebcce
Instruction Fuzzy Hash: 90F0A0B2611220EFCB52C748C605F4973B8EB44B11F1500AAE000E7251CAB1DE01CBE0

Function 00DCE93F Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a31a1b2c87d20f6f1ccd6e3f5e56cdbfee1b29986efbea090f4dac1cf3a30c
Instruction ID: 61730d18f83d817af9b37c65c456c3e0261d82222d2ffb9c26f6620e819fd820
Opcode Fuzzy Hash: 52a31a1b2c87d20f6f1ccd6e3f5e56cdbfee1b29986efbea090f4dac1cf3a30c
Instruction Fuzzy Hash: 32E08CB2911228EBCB64DBD8C904E8AF3FCEB45B00B15089AF501E3200D674EE00CBE0

Function 00DBFDF7 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16a962eb7063aa5dac9a286c1eb4be0eb6ad47394398426903ba7e2235a18e8e
Instruction ID: bf0cc78197c06cf6c6984a79ca5f16cf1c7619cd61dbe207680743e03b62de14
Opcode Fuzzy Hash: 16a962eb7063aa5dac9a286c1eb4be0eb6ad47394398426903ba7e2235a18e8e
Instruction Fuzzy Hash: F7C08C34001940CBCE298B1497727F53354E391782F88049CD4030B653DA2EDD82DA30

Function 00C171F0 Relevance: 33.7, APIs: 17, Strings: 2, Instructions: 460stringCOMMON

Download Yara Rule

APIs

RedrawWindow.USER32(?,00000000,00000000,00000507,6C34C19C), ref: 00C1727E
IsWindow.USER32(?), ref: 00C17290
GetParent.USER32(?), ref: 00C172D1
lstrcmpW.KERNEL32(?,#32770), ref: 00C172F1

Strings

#32770, xrefs: 00C172E8
h, xrefs: 00C1A512

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$ParentRedrawlstrcmp
String ID: #32770$h
API String ID: 3033045798-2263804114
Opcode ID: cf3a1eb0a81226e14c972836b8399c110770ec6681d4b9743dc49a766e3bdf8a
Instruction ID: 8dc0460edbd27a040fdf9b58d41899b7786f8e2e871ec54deb785b0726af69c0
Opcode Fuzzy Hash: cf3a1eb0a81226e14c972836b8399c110770ec6681d4b9743dc49a766e3bdf8a
Instruction Fuzzy Hash: 2F027070A08208DFDB14CFA5C948BEEBBF5FF4A310F144658F415A7290DB75AA85EB20

Function 00D54100 Relevance: 30.1, APIs: 9, Strings: 8, Instructions: 335COMMON

Download Yara Rule

Strings

powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new, xrefs: 00D5425F
Unable to create process: , xrefs: 00D54304
Unable to find file , xrefs: 00D54133
txt, xrefs: 00D541D3
Unable to get a temp file for script output, temp path: , xrefs: 00D5420F
Unable to retrieve exit code from process., xrefs: 00D54481
ps1, xrefs: 00D541A6, 00D541B8, 00D541C2
Unable to retrieve PowerShell output from file: , xrefs: 00D5445E

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID: Unable to create process: $Unable to find file $Unable to get a temp file for script output, temp path: $Unable to retrieve PowerShell output from file: $Unable to retrieve exit code from process.$powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new$ps1$txt
API String ID: 0-4129021124
Opcode ID: 95e3c2dff136e2f94749a97ba83c72bacabd15b9f0c6de72a07b62afbaf97c64
Instruction ID: dbc16eaf085c158165380d2977e85f9bd35dbd74bacbab7581d8c2e6449733fc
Opcode Fuzzy Hash: 95e3c2dff136e2f94749a97ba83c72bacabd15b9f0c6de72a07b62afbaf97c64
Instruction Fuzzy Hash: DBC19E71D01609AFDF10DFA8C945BAEBBB4EF05314F148259F814B72D2DB749A48CBA1

Function 00D26CC0 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 259COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000001F6), ref: 00D26D0E
GetDlgItem.USER32(?,000001F8), ref: 00D26D1B
GetDlgItem.USER32(?,000001F7), ref: 00D26D6C
SetWindowTextW.USER32(00000000,00000000), ref: 00D26D7B
ShowWindow.USER32(?,00000005), ref: 00D26DE1
GetDlgItem.USER32(?,000001F7), ref: 00D26E03
SetWindowTextW.USER32(00000000,00000000), ref: 00D26E12
ShowWindow.USER32(?,00000000), ref: 00D26E77
ShowWindow.USER32(?,00000000), ref: 00D26E7E
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000616), ref: 00D26EC7
GetDlgItem.USER32(?,00000000), ref: 00D26EF9
IsWindow.USER32(00000000), ref: 00D26F03
SetWindowPos.USER32(?,00000000,10C25DE5,01F66800,76FF0000,E815FF24,00000014,?,00000000,?,?,00000616), ref: 00D26F50

Strings

Details <<, xrefs: 00D26D53
Details >>, xrefs: 00D26DEA

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$Item$Show$Text
String ID: Details <<$Details >>
API String ID: 2476474966-3763984547
Opcode ID: 8ade747cfbc15d7d561ac15c2d254b630d8e7d1d331978070332d4af72716e5d
Instruction ID: 5768a03ed723b2e262a7cb2a40492aac9ee0626f454badf965a5ccf3020d784c
Opcode Fuzzy Hash: 8ade747cfbc15d7d561ac15c2d254b630d8e7d1d331978070332d4af72716e5d
Instruction Fuzzy Hash: 8B91AD71D00219AFDF049FA8ED95BAEBBB1EF18314F148229F511B7690D731A891CBA0

Function 00D269C0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 132windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D1E740: LoadLibraryW.KERNEL32(ComCtl32.dll,6C34C19C,?,?,00000000), ref: 00D1E77E
Part of subcall function 00D1E740: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00D1E7A1
Part of subcall function 00D1E740: FreeLibrary.KERNEL32(00000000), ref: 00D1E81F

GetDlgItem.USER32(?,000001F4), ref: 00D26A01
SendMessageW.USER32(00000000,00000170,00000000,00000000), ref: 00D26A12
GetDC.USER32(00000000), ref: 00D26A1A
GetDeviceCaps.GDI32(00000000), ref: 00D26A21
MulDiv.KERNEL32(00000009,00000000), ref: 00D26A2A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,Courier New), ref: 00D26A53
GetDlgItem.USER32(?,000001F6), ref: 00D26A64
IsWindow.USER32(00000000), ref: 00D26A6D
SendMessageW.USER32(00000000,00000030,?,00000000), ref: 00D26A84
GetDlgItem.USER32(?,000001F8), ref: 00D26A8E
GetWindowRect.USER32(?,?), ref: 00D26A9F
GetWindowRect.USER32(?,?), ref: 00D26AB2
GetWindowRect.USER32(00000000,?), ref: 00D26AC2

Strings

Courier New, xrefs: 00D26A30

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$ItemRect$LibraryMessageSend$AddressCapsCreateDeviceFontFreeLoadProc
String ID: Courier New
API String ID: 1731048342-2572734833
Opcode ID: 0324713b5ac8bea7a59bafdcb1261090a078db26564084709ec7f4f4afb0d688
Instruction ID: 9d330a198a3942b6be1a22171f72093e40fb739b9ca4550e0251eac9f4f8ecd6
Opcode Fuzzy Hash: 0324713b5ac8bea7a59bafdcb1261090a078db26564084709ec7f4f4afb0d688
Instruction Fuzzy Hash: 0A41E671B843087FFB149F259D42FBE7BA9EF58B04F000529BB05BA1C1DAB1AC448B64

Function 00D4E0A0 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 230memoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,Everyone,10000000,00000000,6C34C19C), ref: 00D4E152
LocalFree.KERNEL32(00000000,Everyone,10000000,00000000,6C34C19C), ref: 00D4E163
LocalAlloc.KERNEL32(00000040,00000014), ref: 00D4E1D8
GetLastError.KERNEL32 ref: 00D4E1F6
LocalFree.KERNEL32(00000000), ref: 00D4E207
GetLastError.KERNEL32 ref: 00D4E226
LocalFree.KERNEL32(00000000), ref: 00D4E237
CreateDirectoryW.KERNEL32(?,?), ref: 00D4E260
LocalFree.KERNEL32(00000000,Everyone,10000000,00000000,6C34C19C), ref: 00D4E2B4
LocalFree.KERNEL32(00000000,Everyone,10000000,00000000,6C34C19C), ref: 00D4E317
LocalFree.KERNEL32(00000000,Everyone,10000000,00000000,6C34C19C), ref: 00D4E321

Strings

Everyone, xrefs: 00D4E13A

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Local$Free$ErrorLast$AllocCreateDirectory
String ID: Everyone
API String ID: 2702579218-3285609282
Opcode ID: 21bb4fde3c6b9f5333270386c26ae63e05f68d3e7b4c11b12a8723db53f6169c
Instruction ID: 578330f4602288c8240fea8d52ce776f175f96af8a60dddae2b2bcd6d6d6de46
Opcode Fuzzy Hash: 21bb4fde3c6b9f5333270386c26ae63e05f68d3e7b4c11b12a8723db53f6169c
Instruction Fuzzy Hash: A49109B0E01249ABEF24DFE5D988BDEBBB8BF04704F144119E511BB290DBB59908CF61

Function 00C364D0 Relevance: 22.7, APIs: 15, Instructions: 178windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000318,00000000,00000004), ref: 00C36537
CreateRectRgn.GDI32(00000000,00000000,00000000,00000000), ref: 00C36545
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00C3655F
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C36577
SendMessageW.USER32(?,0000130A,00000000,?), ref: 00C365A8
CreateRectRgn.GDI32(?,?,?,?), ref: 00C365E2
DeleteObject.GDI32(00000000), ref: 00C365F9
GetClientRect.USER32(?,?), ref: 00C36615
CreateRectRgn.GDI32(00000000,00000000,?,?), ref: 00C36640
CreateRectRgn.GDI32(?,?,?,?), ref: 00C3665D
SelectClipRgn.GDI32(00000000,00000000), ref: 00C36674
GetParent.USER32(?), ref: 00C36684
SendMessageW.USER32(00000000,00000136,?,?), ref: 00C36695
DeleteObject.GDI32(00000000), ref: 00C366AB
DeleteObject.GDI32(?), ref: 00C366B0

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: MessageRectSend$Create$DeleteObject$ClientClipParentSelect
String ID:
API String ID: 1236051970-0
Opcode ID: 2ac753250ca29493101baf290f3cb3adae2318d7ab60a0b1dbcd091171bbdc88
Instruction ID: 1e95f60ca82b0bb63d5ccf7e688cb2853cc7808bf714c9135d0c053958842eaf
Opcode Fuzzy Hash: 2ac753250ca29493101baf290f3cb3adae2318d7ab60a0b1dbcd091171bbdc88
Instruction Fuzzy Hash: 14610771904618AFDB119FA5CD49FEEBBB9FF08710F140129F665AB2A0C7716905CF50

Function 00D38270 Relevance: 21.4, APIs: 4, Strings: 8, Instructions: 439COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,6C34C19C), ref: 00D382D9
IsWow64Process.KERNEL32(00000000), ref: 00D382E0

Part of subcall function 00D1AB00: _wcsrchr.LIBVCRUNTIME ref: 00D1AB39

_wcsrchr.LIBVCRUNTIME ref: 00D38361
_wcsrchr.LIBVCRUNTIME ref: 00D383F7

Strings

/fvomus //, xrefs: 00D384AA, 00D384FF, 00D38500
EXE_CMD_LINE="%s ", xrefs: 00D38682
TRANSFORMS=":%d", xrefs: 00D38450
/p //, xrefs: 00D384A1
%s AI_SETUPEXEPATH="%s" SETUPEXEDIR="%s", xrefs: 00D3862F
"%s" , xrefs: 00D3859D
/i //, xrefs: 00D384AF
.x64, xrefs: 00D38342

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: _wcsrchr$Process$CurrentWow64
String ID: "%s" $ /fvomus //$ /i //$ /p //$ EXE_CMD_LINE="%s "$ TRANSFORMS=":%d"$%s AI_SETUPEXEPATH="%s" SETUPEXEDIR="%s"$.x64
API String ID: 657290924-2074823060
Opcode ID: 57515693d14beaf290a4ec911e8836db54d4378d9872ecc201c8add6dca7bbc5
Instruction ID: f1aa877968367c3bf8a9867ac4b0da12bbf2c5319f293a033eab0ae2ea9a60f2
Opcode Fuzzy Hash: 57515693d14beaf290a4ec911e8836db54d4378d9872ecc201c8add6dca7bbc5
Instruction Fuzzy Hash: EBF1B171A017069FDB10DF68C845BAEBBA5FF45310F188668F815AB2D2DB74DD04DBA0

Function 00D4CF60 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 192fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00EC9384,6C34C19C,?,00000010), ref: 00D4CF9C

Part of subcall function 00C092A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00C21134,00000000,?,00000010,?,*.*,?,80070057), ref: 00C092C3

EnterCriticalSection.KERNEL32(00000010,6C34C19C,?,00000010), ref: 00D4CFA9
WriteFile.KERNEL32(00000000,?,?,000000FF,00000000), ref: 00D4CFDB
FlushFileBuffers.KERNEL32(00000000,?,?,000000FF,00000000), ref: 00D4CFE4
WriteFile.KERNEL32(00000000,00D42D47,9384B9EC,00E25BDD,00000000,00E4443C,00000001,?,?,000000FF,00000000), ref: 00D4D066
FlushFileBuffers.KERNEL32(00000000,?,?,000000FF,00000000), ref: 00D4D06F
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 00D4D0A5
FlushFileBuffers.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 00D4D0AE
WriteFile.KERNEL32(00000000,?,?,?,00000000,00E46D60,00000002,?,?,?,00000000,?,?,000000FF,00000000), ref: 00D4D10F
FlushFileBuffers.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 00D4D118
LeaveCriticalSection.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 00D4D148

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Strings

v, xrefs: 00D4D148

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$BuffersFlushWrite$CriticalSection$AllocateEnterFindHeapInitializeLeaveResource
String ID: v
API String ID: 201293332-3261393531
Opcode ID: c6a11fc4617ab6e482c04cc5ee89078e816784db7d1bae8c71f993e01947c8cd
Instruction ID: 5ad05c3446563fb34ca2e1d5ca0ab0bd967a76f48cbcaccfa9d9e394d2e39a99
Opcode Fuzzy Hash: c6a11fc4617ab6e482c04cc5ee89078e816784db7d1bae8c71f993e01947c8cd
Instruction Fuzzy Hash: 3D61BD31A01648AFDB00DF69CD49BAABFB5FF45310F148198F905A72A2D7719918DFA0

Function 00C76CB0 Relevance: 21.2, APIs: 14, Instructions: 170COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00C76CF7
GetParent.USER32 ref: 00C76D0D
GetWindowRect.USER32(?,?), ref: 00C76D18
GetParent.USER32(?), ref: 00C76D20
GetClientRect.USER32(00000000,?), ref: 00C76D2F
GetClientRect.USER32(?,?), ref: 00C76D38
MapWindowPoints.USER32(00000002,00000000,?,00000002), ref: 00C76D44
GetWindow.USER32(?,00000004), ref: 00C76D52
GetWindowRect.USER32(?,?), ref: 00C76D60
GetWindowLongW.USER32(00000000,000000F0), ref: 00C76D6D
MonitorFromWindow.USER32(?,00000002), ref: 00C76D85
GetMonitorInfoW.USER32(00000000,00000004), ref: 00C76D9F
SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015), ref: 00C76E4D

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$Rect$ClientLongMonitorParent$FromInfoPoints
String ID:
API String ID: 3127921553-0
Opcode ID: 3d6af355cad151d37968a030761918dc924e81879a28b9be27d32ddbb5ea35da
Instruction ID: 758961b0294a0f5c9b66e4ed4605d2f2e780738861d042e3c70fa0829fe49dbe
Opcode Fuzzy Hash: 3d6af355cad151d37968a030761918dc924e81879a28b9be27d32ddbb5ea35da
Instruction Fuzzy Hash: C6514D72E045199FDB20CFA9CD45EEEBBB9EB48710F254229E815B3294DB31AD05CF90

Function 00D29470 Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 410libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D43C70: GetSystemDefaultLangID.KERNEL32(6C34C19C,?,?,?,?), ref: 00D43CA6

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process2,?,?,?,?,00000000), ref: 00D295D3
GetProcAddress.KERNEL32(00000000), ref: 00D295DA
__Init_thread_footer.LIBCMT ref: 00D295F1
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000000), ref: 00D29610

Strings

kernel32, xrefs: 00D295CE
Searching for:, xrefs: 00D296C9
Wrong OS or Os language for:, xrefs: 00D2993B
Undefined, xrefs: 00D298AA
No acceptable version found. It must be installed from package., xrefs: 00D298C3, 00D298C4
Search result:, xrefs: 00D29849
IsWow64Process2, xrefs: 00D295C9

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AddressCurrentDefaultHandleInit_thread_footerLangModuleProcProcessSystem
String ID: IsWow64Process2$No acceptable version found. It must be installed from package.$Search result:$Searching for:$Undefined$Wrong OS or Os language for:$kernel32
API String ID: 52476621-3263831601
Opcode ID: 1da2a57152f0ef283168c710f299d98e51d0cfd2901ea7ad1c4ec8f61f5c2f99
Instruction ID: 6ffb9b11a8a73f5db5bbcb7586a8e25b6f87ac2e68f1648350e1ed79d5e2efc7
Opcode Fuzzy Hash: 1da2a57152f0ef283168c710f299d98e51d0cfd2901ea7ad1c4ec8f61f5c2f99
Instruction Fuzzy Hash: 95F1B070A006148FCB10DFA8D8A5B9EF7F1FF54328F18425DE466AB291DB31A946CF60

Function 00D24730 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 340threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00EC944C,6C34C19C,?,?,00000000), ref: 00D24852
EnterCriticalSection.KERNEL32(?,6C34C19C,?,?,00000000,?,?,?,?,?,00000000,00E1D8F7,000000FF), ref: 00D24864
GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,00000000,00E1D8F7,000000FF), ref: 00D24871
GetCurrentThread.KERNEL32 ref: 00D2487C
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,?,00E4446C,00000000), ref: 00D24AAE
LeaveCriticalSection.KERNEL32(?,00000000), ref: 00D24BDC

Strings

*** Stack Trace (x86) ***, xrefs: 00D249AD
v, xrefs: 00D24BDC
[0x%.8Ix] , xrefs: 00D24550, 00D24AB5
MODULE_BASE_ADDRESS, xrefs: 00D24AFB
<--------------------MORE--FRAMES-------------------->, xrefs: 00D24A52

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$Current$EnterHandleInitializeLeaveModuleProcessThread
String ID: *** Stack Trace (x86) ***$ v$<--------------------MORE--FRAMES-------------------->$MODULE_BASE_ADDRESS$[0x%.8Ix]
API String ID: 3051236879-1086252000
Opcode ID: f7872d6023d12c053081402fcd4236a05a02abc70caa9ea170caa577fbdef6c1
Instruction ID: 520cefd3f46ea1470145fbc764a34bf2d82ca6e3bfb15e1a4f25319be088bd9a
Opcode Fuzzy Hash: f7872d6023d12c053081402fcd4236a05a02abc70caa9ea170caa577fbdef6c1
Instruction Fuzzy Hash: 78D1AB71A003889FDF29DF64DC59BEE7BB8EF45308F104158E959AB281D7755B08CBA0

Function 00D247E0 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 265threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00EC944C,6C34C19C,?,?,00000000), ref: 00D24852
EnterCriticalSection.KERNEL32(?,6C34C19C,?,?,00000000,?,?,?,?,?,00000000,00E1D8F7,000000FF), ref: 00D24864
GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,00000000,00E1D8F7,000000FF), ref: 00D24871
GetCurrentThread.KERNEL32 ref: 00D2487C
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,?,00E4446C,00000000), ref: 00D24AAE
LeaveCriticalSection.KERNEL32(?,00000000), ref: 00D24BDC

Strings

*** Stack Trace (x86) ***, xrefs: 00D249AD
v, xrefs: 00D24BDC
[0x%.8Ix] , xrefs: 00D24AB5
MODULE_BASE_ADDRESS, xrefs: 00D24AFB
<--------------------MORE--FRAMES-------------------->, xrefs: 00D24A52

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$Current$EnterHandleInitializeLeaveModuleProcessThread
String ID: *** Stack Trace (x86) ***$ v$<--------------------MORE--FRAMES-------------------->$MODULE_BASE_ADDRESS$[0x%.8Ix]
API String ID: 3051236879-1086252000
Opcode ID: 6f70517e235a13c6f7752112e03f2fd5e4f50a598bce5c874a55c9a1efd6acbe
Instruction ID: 2801e6239ae13add6c69892ce5f11d78dd4b73c61b6eb0435b38107981d8b25f
Opcode Fuzzy Hash: 6f70517e235a13c6f7752112e03f2fd5e4f50a598bce5c874a55c9a1efd6acbe
Instruction Fuzzy Hash: 1AB1AA719003889FDF29DF64DC59BEE7BB8EF45308F004158E959AB282DB755B09CB60

Function 00C34DB0 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,tooltips_class32,00000000,80000063,80000000,80000000,80000000,80000000,?,00000000,00000000,6C34C19C), ref: 00C34E38

Part of subcall function 00C168F0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00C16926

SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00C34F3B
SendMessageW.USER32(00000000,00000439,00000000,0000002C), ref: 00C34F4F
SendMessageW.USER32(00000000,00000421,00000003,?), ref: 00C34F64
SendMessageW.USER32(00000000,00000418,00000000,0000012C), ref: 00C34F79
SendMessageW.USER32(?,000000D6,-00000001,00000000), ref: 00C34F90
ClientToScreen.USER32(?,?), ref: 00C34FB0
GetWindowRect.USER32(?,?), ref: 00C34FC2
SendMessageW.USER32(00000000,00000412,00000000), ref: 00C35024
SendMessageW.USER32(00000000,00000411,00000001,0000002C), ref: 00C35034

Strings

tooltips_class32, xrefs: 00C34E32

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: MessageSend$Window$ClientCreateLongRectScreen
String ID: tooltips_class32
API String ID: 1468030502-1918224756
Opcode ID: c605e7e20746df0ae1e397450403045029a52bbee1478bf3561cae969a07d0c2
Instruction ID: eafe43bd7d21942ab2c418496507785e3eb1189fc36343276969872e962b7ba5
Opcode Fuzzy Hash: c605e7e20746df0ae1e397450403045029a52bbee1478bf3561cae969a07d0c2
Instruction Fuzzy Hash: E0913C71A00608AFDB14CFA5CC95FEEBBF8FB08300F10852AE556EA290D775A905CF50

Function 00C1F8C0 Relevance: 18.3, APIs: 12, Instructions: 336windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C1F914
GetWindowRect.USER32(?,?), ref: 00C1F9F3
GetClientRect.USER32(?,?), ref: 00C1FA05
GetWindowDC.USER32(?), ref: 00C1FA17
CreateCompatibleDC.GDI32(00000000), ref: 00C1FA44
CreateCompatibleBitmap.GDI32(00000000), ref: 00C1FA86
SelectObject.GDI32(00000000,00000000), ref: 00C1FA95

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: RectWindow$CompatibleCreate$BitmapClientObjectSelect
String ID:
API String ID: 2032541772-0
Opcode ID: 581bb27e27250984c7fc086468589b69ad001fd0b04ad9e8e93c7d0106dd0c1a
Instruction ID: b7d8258eb9ced705f0086644b7266a5d203dacc0eecef3de011b0385bd9d9021
Opcode Fuzzy Hash: 581bb27e27250984c7fc086468589b69ad001fd0b04ad9e8e93c7d0106dd0c1a
Instruction Fuzzy Hash: 50E15871D04258EFDB20CFA9C948BAEBBF8EF09700F1042A9E859B7251D7716A85DF50

Function 00D59380 Relevance: 18.3, APIs: 12, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 357621fc78684d18983f7a089ffb5bd79a2e7a9533182a960d008e52b58b3b7b
Instruction ID: 5bbf6bbef88750120032e912782a11605b14d048a2289115113328d91df031db
Opcode Fuzzy Hash: 357621fc78684d18983f7a089ffb5bd79a2e7a9533182a960d008e52b58b3b7b
Instruction Fuzzy Hash: 74A1FE72600205EFDF10AF65DC95FAABBA4EF48312F144169FD09AB292DB75D809CB70

Function 00C15050 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00EC957C,6C34C19C,00000000,?,?,?,?,?,?,00C1487E,00DDF9CD,000000FF), ref: 00C1508D
LoadCursorW.USER32(00000000,00007F00), ref: 00C15108
LoadCursorW.USER32(00000000,00007F00), ref: 00C151AE
LeaveCriticalSection.KERNEL32(00EC957C), ref: 00C15203

Strings

v, xrefs: 00C15203
0, xrefs: 00C15193
WM_ATLGETCONTROL, xrefs: 00C150A4
AtlAxWin140, xrefs: 00C150BF, 00C15123
WM_ATLGETHOST, xrefs: 00C15099
AtlAxWinLic140, xrefs: 00C1516F, 00C151C5

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalCursorLoadSection$EnterLeave
String ID: v$0$AtlAxWin140$AtlAxWinLic140$WM_ATLGETCONTROL$WM_ATLGETHOST
API String ID: 3727441302-556780245
Opcode ID: 53411cab8192a0b587ed356205b5e8305576b33359c7cd420f763e49a6ecb7bb
Instruction ID: 6453bc18f2fda59766c8ebbc4998a8b1310b35a264149455d51475cab4e85922
Opcode Fuzzy Hash: 53411cab8192a0b587ed356205b5e8305576b33359c7cd420f763e49a6ecb7bb
Instruction Fuzzy Hash: F05135B1D45318EFDB11CF95D948BDEBBB8FB09304F10016AE454B7280DBB65A4A8FA1

Function 00C154B0 Relevance: 16.6, APIs: 11, Instructions: 139windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00C154EE
FillRect.USER32(00000000,?,00000000), ref: 00C1550D
DeleteObject.GDI32(00000000), ref: 00C15514
GetClientRect.USER32(?,?), ref: 00C1556F
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00C15588
CreateCompatibleDC.GDI32(00000000), ref: 00C15595
SelectObject.GDI32(00000000,00000000), ref: 00C155A7
FillRect.USER32(00000000,?,00000000), ref: 00C155D0
DeleteObject.GDI32(?), ref: 00C155DA
SelectObject.GDI32(00000000,?), ref: 00C15622
DeleteDC.GDI32(00000000), ref: 00C15629

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ObjectRect$Delete$ClientCompatibleCreateFillSelect$Bitmap
String ID:
API String ID: 441990398-0
Opcode ID: bf0be149a7ed1e62836d95033c4ddadf29246d0474bb464fae204303119b1e46
Instruction ID: 52f604ef42083788de8676c0487b40d6b3ba70fe459c328429f80af1a165b6b8
Opcode Fuzzy Hash: bf0be149a7ed1e62836d95033c4ddadf29246d0474bb464fae204303119b1e46
Instruction Fuzzy Hash: 6C41B471104741EFD3119F69DC88FABBBE9FB99700F004829FA96D2160DB72E8059F21

Function 00D4EAB0 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 319synchronizationfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

DeleteFileW.KERNEL32(?,?,?,?,00000000,?,?,?,?), ref: 00D4EDBA

Part of subcall function 00C092A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00C21134,00000000,?,00000010,?,*.*,?,80070057), ref: 00C092C3

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

ResetEvent.KERNEL32(00000000,6C34C19C,?,?,00000000,00E2614D,000000FF,?,80004005), ref: 00D4EE4F
WaitForSingleObject.KERNEL32(?,000000FF,?,?,00000000,00E2614D,000000FF,?,80004005), ref: 00D4EE6F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,00000000,00E2614D,000000FF,?,80004005), ref: 00D4EE7A

Strings

http://www.example.com, xrefs: 00D4EC1F
http://www.google.com, xrefs: 00D4EC0E
TEST, xrefs: 00D4EC02
tin9999.tmp, xrefs: 00D4EC09
http://www.yahoo.com, xrefs: 00D4EC18

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: HeapInit_thread_footerObjectSingleWait$AllocateDeleteEventFileFindProcessResetResource
String ID: TEST$http://www.example.com$http://www.google.com$http://www.yahoo.com$tin9999.tmp
API String ID: 3248508590-625802988
Opcode ID: 0a7b9cecbdb31698d289f8db04ac2959c6f9ba2705f6576a2cb9d58a715df96c
Instruction ID: c5239d20d00cf626f2c97ca875ae884ff9b98cd79cfdb7dfe1540a3db0b3927a
Opcode Fuzzy Hash: 0a7b9cecbdb31698d289f8db04ac2959c6f9ba2705f6576a2cb9d58a715df96c
Instruction Fuzzy Hash: 33C1E271900249EFDB14DF68CD09BAEB7B4FF45310F1486A9E816A72D1DB70AE04CBA0

Function 00D4E730 Relevance: 16.1, APIs: 4, Strings: 5, Instructions: 302libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD7A10: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00CD7A51

GetLastError.KERNEL32(6C34C19C,?,?,?,00E2602D,000000FF,?,00D32852,?), ref: 00D4E79D
GetProcAddress.KERNEL32(00000000,GetPackagePath), ref: 00D4E92D
GetProcAddress.KERNEL32(00000000,GetPackagePath), ref: 00D4E986
FreeLibrary.KERNEL32(00000000,?,?,?,?,00E2602D,000000FF,?,00D32852,?), ref: 00D4EA74

Strings

Kernel32.dll, xrefs: 00D4E771
neutral, xrefs: 00D4E832
x86, xrefs: 00D4E7E5
GetPackagePath, xrefs: 00D4E927, 00D4E980
x64, xrefs: 00D4E816

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AddressProc$DirectoryErrorFreeLastLibrarySystem
String ID: GetPackagePath$Kernel32.dll$neutral$x64$x86
API String ID: 2155880084-4043905686
Opcode ID: 915c0404fd9d089188391ad508395da5e53a30496acb23ac9241ae0c5e661db5
Instruction ID: f924859bb82ef277e022dafc8e8ca65733b741fcc2ee57d916326196bbf94d8f
Opcode Fuzzy Hash: 915c0404fd9d089188391ad508395da5e53a30496acb23ac9241ae0c5e661db5
Instruction Fuzzy Hash: 8EC14970A00209EFDF04CFA8C985B9DBBF1FF49314F188669E805AB291DB719945CFA1

Function 00D306D0 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 283COMMON

Download Yara Rule

APIs

Part of subcall function 00D25290: LoadLibraryW.KERNEL32(Shlwapi.dll,?,?,?,?,00D30731,?,6C34C19C,?,?), ref: 00D252AB
Part of subcall function 00D25290: GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 00D252C1
Part of subcall function 00D25290: FreeLibrary.KERNEL32(00000000), ref: 00D252FA

GetEnvironmentVariableW.KERNEL32(APPDATA,?,00000104,6C34C19C,?,?), ref: 00D30910

Strings

Shlwapi.dll, xrefs: 00D30727
PROGRAMFILES, xrefs: 00D308ED
ProgramFilesFolder, xrefs: 00D30797
APPDATA, xrefs: 00D30907, 00D3090F
AppDataFolder, xrefs: 00D30878, 00D308B5
AI_BOOTSTRAPPERLANGS, xrefs: 00D309E2, 00D30A2A
Shell32.dll, xrefs: 00D30753
ProgramFiles, xrefs: 00D30810, 00D30825, 00D3082D

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Library$AddressEnvironmentFreeLoadProcVariable
String ID: AI_BOOTSTRAPPERLANGS$APPDATA$AppDataFolder$PROGRAMFILES$ProgramFiles$ProgramFilesFolder$Shell32.dll$Shlwapi.dll
API String ID: 788177547-1020860216
Opcode ID: 604457e6b44912affd8d6d4410b8e0f226893ca9e4754f5791578a000171277b
Instruction ID: 290656d30980c0bfe7754b6584d5dbdcc562ecba021c226870efef13ef7eab16
Opcode Fuzzy Hash: 604457e6b44912affd8d6d4410b8e0f226893ca9e4754f5791578a000171277b
Instruction Fuzzy Hash: DC9125B1A002059FDB24EF24CC65BFAB7A5EF64710F184669E806D7292E731ED45CFA0

Function 00C33970 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 124windowstringCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000043A,00000000,00000074), ref: 00C339E5
lstrcpynW.KERNEL32(?,?,00000020), ref: 00C33A5B
GetDC.USER32(?), ref: 00C33A7E
GetDeviceCaps.GDI32(00000000), ref: 00C33A85
MulDiv.KERNEL32(?,00000048,00000000), ref: 00C33A98
SendMessageW.USER32(?,00000444,00000000,00000074), ref: 00C33ACA
DeleteObject.GDI32(?), ref: 00C33B06

Strings

t, xrefs: 00C33AA6
?, xrefs: 00C33A9E

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: MessageSend$CapsDeleteDeviceObjectlstrcpyn
String ID: ?$t
API String ID: 2619291461-1995845436
Opcode ID: 0fa715943cab6eedcf764be8d870a1272b2b8a9582b0af3bcb8d093c67b44f33
Instruction ID: a386477e473ef3ac975d67a316cd319ba4884b96b622eddcf041e18163d978ef
Opcode Fuzzy Hash: 0fa715943cab6eedcf764be8d870a1272b2b8a9582b0af3bcb8d093c67b44f33
Instruction Fuzzy Hash: 5C5139B1908380AFE721DF65DC49F9BBBE8EB48701F004929F6D9D6191D774A608CF62

Function 00D26800 Relevance: 15.2, APIs: 10, Instructions: 155COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00D26811
DeleteObject.GDI32(?), ref: 00D26869
EndDialog.USER32(?,00000000), ref: 00D268E9

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: DeleteDialogLongObjectWindow
String ID:
API String ID: 1328495006-0
Opcode ID: 02991c6c0a94dd6aa77c5c46fec322a3084a7edd1b09c37678dc86a68dca2c06
Instruction ID: ea2525f7a70955bdfc2d2e14b922f082cf2632af5ebb096cf2e970609ea1704b
Opcode Fuzzy Hash: 02991c6c0a94dd6aa77c5c46fec322a3084a7edd1b09c37678dc86a68dca2c06
Instruction Fuzzy Hash: 7D41E1322143249BCB249E2DBC09B7A7798DB95331F04076AFD92D66D0CA72DC51DAB1

Function 00CB39A0 Relevance: 15.1, APIs: 10, Instructions: 127windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00CB3A1A
GetWindowRect.USER32(?,?), ref: 00CB3A32
GetWindowRect.USER32(?,?), ref: 00CB3A4A
IntersectRect.USER32(?,?,?), ref: 00CB3A67
EqualRect.USER32(?,?), ref: 00CB3A77
GetSysColorBrush.USER32(0000000F), ref: 00CB3A8D
GetWindowRect.USER32(?,?), ref: 00CB3AB6
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 00CB3ACB
GetWindowLongW.USER32(?,000000EC), ref: 00CB3ADA
SetBrushOrgEx.GDI32(?,?,?,00000000), ref: 00CB3AF8

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$Rect$Brush$ColorEqualIntersectLongPointsVisible
String ID:
API String ID: 2158939716-0
Opcode ID: 3d81af5304e5d101e74fa5d8a1583eaf1a590d6b42ee33b8749622c19535e117
Instruction ID: 87eaa48a8fb2fb66518503dc47ec6a100ccc23c2ab15f8d76f1abcf0ed9d2901
Opcode Fuzzy Hash: 3d81af5304e5d101e74fa5d8a1583eaf1a590d6b42ee33b8749622c19535e117
Instruction Fuzzy Hash: 0241AF32A083459FC710CF25C884EABB7E8EF99714F14462DF899E3250E731EA458B62

Function 00C18D40 Relevance: 15.1, APIs: 10, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00C18D81
GetClientRect.USER32(?,?), ref: 00C18DA8
CreateCompatibleDC.GDI32(?), ref: 00C18DB8
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00C18DD9
DeleteDC.GDI32(00000000), ref: 00C18DE6
FillRect.USER32(?,?,00000006), ref: 00C18E2A

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CompatibleCreateRect$BitmapClientDeleteFill
String ID:
API String ID: 1262984673-0
Opcode ID: 16d8b5e6ae5f7dd50bd98c970079b39db095ffc1d365ecad39b7e28b747aa72e
Instruction ID: e500b109d4ecb30660bd05a873159d27dcd19a5516ba14ae54313e17cdc419de
Opcode Fuzzy Hash: 16d8b5e6ae5f7dd50bd98c970079b39db095ffc1d365ecad39b7e28b747aa72e
Instruction Fuzzy Hash: C331E2761082419FC715DF29DC88FAB7BE5BF99340F00092DFCC696162DB728988DB61

Function 00C132F0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 267memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00C13335
SysAllocString.OLEAUT32(?), ref: 00C13349
VariantInit.OLEAUT32(?), ref: 00C13384
VariantClear.OLEAUT32(?), ref: 00C133DA
VariantClear.OLEAUT32(?), ref: 00C133E4
VariantClear.OLEAUT32(?), ref: 00C133EE
VariantClear.OLEAUT32(?), ref: 00C133FB

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Strings

<body><h3 style="color:green;">Error loading resource:</h3><p style="white-space:nowrap">"%s"</p></body>, xrefs: 00C1347B

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Variant$Clear$AllocAllocateHeapInitString
String ID: <body><h3 style="color:green;">Error loading resource:</h3><p style="white-space:nowrap">"%s"</p></body>
API String ID: 1547307772-1571955069
Opcode ID: 6d465058597a68ab8748640283f5f949cf7161917a8972e6f10971725849d90b
Instruction ID: 4b31d434b874b74a240531b02b5fedfb7eb124460a4199640fb792b8ce206c3e
Opcode Fuzzy Hash: 6d465058597a68ab8748640283f5f949cf7161917a8972e6f10971725849d90b
Instruction Fuzzy Hash: B3918D71904249EFDB00DFA8CC44BDEBBB8FF49314F148269E415E7291D775AA44CBA0

Function 00D53EF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 178fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

Part of subcall function 00C092A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00C21134,00000000,?,00000010,?,*.*,?,80070057), ref: 00C092C3

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,ps1,ps1,00000003,?,00D330A8), ref: 00D53FE3
WriteFile.KERNEL32(00000000,0000FEFF,00000002,?,00000000), ref: 00D54027
WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 00D54044
CloseHandle.KERNEL32(00000000), ref: 00D5405E
CloseHandle.KERNEL32(00000000,?,?,00000000,00000000), ref: 00D5409D

Strings

Unable to get temp file , xrefs: 00D53FC4
Unable to save script file , xrefs: 00D5406D
ps1, xrefs: 00D53F59, 00D53F6B, 00D53F75, 00D53F86

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$CloseHandleInit_thread_footerWrite$CreateFindHeapProcessResource
String ID: Unable to get temp file $Unable to save script file $ps1
API String ID: 2821137686-4253966538
Opcode ID: b08ce3e38a7fb5ebdd9ad44b0824fb0accd8cd366859399c0585330388f1a489
Instruction ID: b56e79a734c7c63f628865ac4b4835825b251f430d54519041d313e61b85bc35
Opcode Fuzzy Hash: b08ce3e38a7fb5ebdd9ad44b0824fb0accd8cd366859399c0585330388f1a489
Instruction Fuzzy Hash: EE51E670A00209AFDF10DBA8CD49B9EBBB8EF45315F144254EE00B72D2D7759D48CBA1

Function 00DDA63F Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,00DDB3CF), ref: 00DDA658

Strings

log10, xrefs: 00DDA69A, 00DDA6A9
acos, xrefs: 00DDA78E
log, xrefs: 00DDA6B5, 00DDA6C4
exp, xrefs: 00DDA6D7, 00DDA73C
asin, xrefs: 00DDA785
pow, xrefs: 00DDA6F6, 00DDA7A0, 00DDA7ED
sqrt, xrefs: 00DDA797

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: ed807ab8961476e68ea704524ebfbcf774deb5263c7e241275663d26e9531209
Instruction ID: 6778775701127842dd54fb5d089386713a641e3f2d0da8d29ae3900c6a506765
Opcode Fuzzy Hash: ed807ab8961476e68ea704524ebfbcf774deb5263c7e241275663d26e9531209
Instruction Fuzzy Hash: 35517B7490060AEBCF109F6DE84C5ADBFB4FF45304F198186D881A63A4CB75CA29DF66

Function 00D42DC0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32 ref: 00D42DFC
GetUserDefaultLangID.KERNEL32 ref: 00D42E09
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00D42E1B
GetProcAddress.KERNEL32(00000000,GetSystemDefaultUILanguage), ref: 00D42E2F
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 00D42E44

Strings

GetUserDefaultUILanguage, xrefs: 00D42E3E
GetSystemDefaultUILanguage, xrefs: 00D42E29
kernel32.dll, xrefs: 00D42E12

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AddressDefaultLangProc$LibraryLoadSystemUser
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll
API String ID: 667524283-3528650308
Opcode ID: f427740db735ab0b0efb95829bc28076c5156186aebba9633e8983568430b69b
Instruction ID: 9235eb79bf7340fb5466c739d6ee5b89fc61e04e84a1d4a746f9bed4d8e0b5e9
Opcode Fuzzy Hash: f427740db735ab0b0efb95829bc28076c5156186aebba9633e8983568430b69b
Instruction Fuzzy Hash: 0E41B3306083519FC744EF29D8546BAB7E1EFA8311FD5082DF885D3241EB30D949CB62

Function 00C0D970 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 139COMMON

Download Yara Rule

Strings

Windows.Foundation.Uri, xrefs: 00C0DA3A
lD, xrefs: 00C0D91B, 00C0D925
.dll, xrefs: 00C0D766
combase.dll, xrefs: 00C0D608, 00C0D63E
CoIncrementMTAUsage, xrefs: 00C0D639
DllGetActivationFactory, xrefs: 00C0D7C2
RoGetActivationFactory, xrefs: 00C0D603

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID:
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$Windows.Foundation.Uri$combase.dll$lD
API String ID: 0-3109780881
Opcode ID: ed0eaef929fbe84dd7e2f12d7bf24c77e21d404745c72486d933c1ac8a30baf6
Instruction ID: ec10e25716e83670e7d09c328f181a5881514ba629dda930bc59da6d636f0d25
Opcode Fuzzy Hash: ed0eaef929fbe84dd7e2f12d7bf24c77e21d404745c72486d933c1ac8a30baf6
Instruction Fuzzy Hash: 65518DB1E01219DFDB04DF94CA45BEEBBB4FB05714F10452AE911A73C0CBB56A05DBA1

Function 00DB8400 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00DB8437
___except_validate_context_record.LIBVCRUNTIME ref: 00DB843F
_ValidateLocalCookies.LIBCMT ref: 00DB84C8
__IsNonwritableInCurrentImage.LIBCMT ref: 00DB84F3
_ValidateLocalCookies.LIBCMT ref: 00DB8548
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00DB855E
___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00DB8573

Strings

csm, xrefs: 00DB84DD

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record___vcrt_initialize_locks___vcrt_uninitialize_locks
String ID: csm
API String ID: 1385549066-1018135373
Opcode ID: 1c878cbbd92dc0619ff5560a4855cd5978f035da877899408700d57393f359ac
Instruction ID: 9a026ba1e35469d6bdeb8ee74ead8fd10a02eec4ae777067277f359978532b8c
Opcode Fuzzy Hash: 1c878cbbd92dc0619ff5560a4855cd5978f035da877899408700d57393f359ac
Instruction Fuzzy Hash: D941BF34A00249DFCF10DF68C895ADEBBE9EF45324F188095E916AB392DB319905DFB1

Function 00C45820 Relevance: 13.9, APIs: 9, Instructions: 431memorysynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

CreateThread.KERNEL32(00000000,00000000,00C45970,00E48DD8,00000000,?), ref: 00C458EA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00C45903
CloseHandle.KERNEL32(00000000), ref: 00C45919
CoInitializeEx.COMBASE(00000000,00000000), ref: 00C459C9
GetProcessHeap.KERNEL32(?,00000000), ref: 00C45ACB
HeapFree.KERNEL32(00000000,?,00000000), ref: 00C45AD1
GetProcessHeap.KERNEL32(?,00000000), ref: 00C45B4A
HeapFree.KERNEL32(00000000,?,00000000), ref: 00C45B50
CoUninitialize.COMBASE ref: 00C45CA7

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Heap$Process$FreeInit_thread_footer$CloseCreateHandleInitializeObjectSingleThreadUninitializeWait
String ID:
API String ID: 1993118014-0
Opcode ID: 82d3d30876c13cd54775fc3dacd237d9a188369cad5f4b4d69cae940c15e75e7
Instruction ID: 8d441e5d9f080c4c41729c59e4403f9a6450bf87571d8fde7f7b51a568bd5a73
Opcode Fuzzy Hash: 82d3d30876c13cd54775fc3dacd237d9a188369cad5f4b4d69cae940c15e75e7
Instruction Fuzzy Hash: 390280B0D00348DFDB14DFA4C985BEEBBB4FF45314F208269E515AB282DB749A45CBA0

Function 00C3DCC0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 153COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00C3DD0A
std::_Lockit::_Lockit.LIBCPMT ref: 00C3DD2C
std::_Lockit::~_Lockit.LIBCPMT ref: 00C3DD54
__Getctype.LIBCPMT ref: 00C3DE35
std::_Facet_Register.LIBCPMT ref: 00C3DE97
std::_Lockit::~_Lockit.LIBCPMT ref: 00C3DEC1

Strings

Pok, xrefs: 00C3DD1C, 00C3DEA6

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID: Pok
API String ID: 1102183713-2885171226
Opcode ID: 156cd45e73c118118cdbdc21cce2d279f3c5b1b02c806b05977b369f69bcb7d7
Instruction ID: 7df1efef9e201b16d934f86497e69cb7043b08b5589f27128d5c3cd180b317cf
Opcode Fuzzy Hash: 156cd45e73c118118cdbdc21cce2d279f3c5b1b02c806b05977b369f69bcb7d7
Instruction Fuzzy Hash: 7A61CDB1C04609CFDB10CF59D941BAEBBF0FF14310F148299D856AB392E771AA85CBA1

Function 00C18680 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 151threadCOMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000E,6C34C19C,?,?,00000000,?), ref: 00C186BE
GetCurrentThreadId.KERNEL32 ref: 00C186FF
EnterCriticalSection.KERNEL32(00EC957C), ref: 00C1871F
LeaveCriticalSection.KERNEL32(00EC957C), ref: 00C18743
CreateWindowExW.USER32(00000000,00000000,00000000,00EC957C,?,80000000,00000000,80000000,00000000,00000000,00000000), ref: 00C1879E

Part of subcall function 00DB4245: GetProcessHeap.KERNEL32(00000008,00000008,00000000,00D435FE,?,?,?,?,?,?), ref: 00DB424A
Part of subcall function 00DB4245: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?), ref: 00DB4251

Strings

v, xrefs: 00C18743
AXWIN UI Window, xrefs: 00C18815

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalHeapSection$AllocCreateCurrentEnterErrorLastLeaveProcessThreadWindow
String ID: v$AXWIN UI Window
API String ID: 213679520-2690018532
Opcode ID: e93d5fc08b5efb5208f8b0d2499835f8e9a2af2f04257729e9b0c427a7cdd42f
Instruction ID: ff06de40292eb995fa9b7fc64691d1c40c05e846e738c1b583159ce914b2a9fa
Opcode Fuzzy Hash: e93d5fc08b5efb5208f8b0d2499835f8e9a2af2f04257729e9b0c427a7cdd42f
Instruction Fuzzy Hash: 8D51E472604305AFDB10CF55DD05F9ABBF5FB49B10F104129F914A7281D772A919DBA0

Function 00C1C6D0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 150fileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00C1C7BF

Part of subcall function 00DB4B58: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B62
Part of subcall function 00DB4B58: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B95
Part of subcall function 00DB4B58: RtlWakeAllConditionVariable.NTDLL ref: 00DB4C0C

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,?,6C34C19E), ref: 00C1C813
CloseHandle.KERNEL32(00000000), ref: 00C1C870

Part of subcall function 00DB4BA2: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4BAD
Part of subcall function 00DB4BA2: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4BEA

WriteFile.KERNEL32(00000000,00000000,?,?,00000000,00000000,?), ref: 00C1C8D4
CloseHandle.KERNEL32(00000000,753CE610), ref: 00C1C8FA

Strings

html, xrefs: 00C1C7CC
aix, xrefs: 00C1C7D1

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$CloseEnterFileHandleLeave$ConditionCreateInit_thread_footerVariableWakeWrite
String ID: aix$html
API String ID: 2030708724-2369804267
Opcode ID: bfdd47898308420fcc0e003546ed1e948c774558f61f58f148bcd41934e33e1e
Instruction ID: 416531e931179ac71b7e156265c7d5aa3442465308cf572329975a0d285688e9
Opcode Fuzzy Hash: bfdd47898308420fcc0e003546ed1e948c774558f61f58f148bcd41934e33e1e
Instruction Fuzzy Hash: 4F618CB0900248DFEB15CF95D989B9EBBB4EB45708F10416DE001BB2C2DBB66949CF65

Function 00C02860 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00EC9358,00000000,6C34C19C,00000000,00E184A3,000000FF,?,6C34C19C), ref: 00C029D3
GetLastError.KERNEL32(?,6C34C19C), ref: 00C029DD

Strings

VolumeCostDifference, xrefs: 00C028B3
VolumeCostSize, xrefs: 00C02897
VolumeCostAvailable, xrefs: 00C028A0
VolumeCostVolume, xrefs: 00C0288D, 00C02945
VolumeCostRequired, xrefs: 00C028A9

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpin
String ID: VolumeCostAvailable$VolumeCostDifference$VolumeCostRequired$VolumeCostSize$VolumeCostVolume
API String ID: 439134102-34576578
Opcode ID: cb8baa6d874891111c75a3b3a9f72159f77dcf00bc64ba53de0b52812faa2997
Instruction ID: 8d7f97dc8f23969d2928a73552b144bc6ba46bed8dffa50002e9322b4dc28ad6
Opcode Fuzzy Hash: cb8baa6d874891111c75a3b3a9f72159f77dcf00bc64ba53de0b52812faa2997
Instruction Fuzzy Hash: C951BEB1900248DFCB10CF6AD90ABDEBBF4FB44710F104669E825B72D1E7765A09CB61

Function 00D60940 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,00000023,?,?), ref: 00D60950
LoadLibraryW.KERNEL32(Shell32.dll), ref: 00D60963
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 00D60973
SHGetPathFromIDListW.SHELL32(?,00000000), ref: 00D609FC
SHGetMalloc.SHELL32(?), ref: 00D60A3E

Strings

SHGetSpecialFolderPathW, xrefs: 00D6096D
Shell32.dll, xrefs: 00D6095E

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AddressFolderFromLibraryListLoadLocationMallocPathProcSpecial
String ID: SHGetSpecialFolderPathW$Shell32.dll
API String ID: 2352187698-2988203397
Opcode ID: ee72bf0733abeb82169676d974908d4e563f2fca91bf0445c393b15574675224
Instruction ID: 2a7669d21479418422dc4d14efd4b8dcfdf986f61fddb45b113e4ce391b8f9d1
Opcode Fuzzy Hash: ee72bf0733abeb82169676d974908d4e563f2fca91bf0445c393b15574675224
Instruction Fuzzy Hash: EE31D371A407019FEB249F24DC09B6B7EF6FF84711F4C842DE48597291EBB19849CAA1

Function 00CFA4D0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74libraryloaderwindowCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00CFA560

Part of subcall function 00DB4B58: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B62
Part of subcall function 00DB4B58: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B95
Part of subcall function 00DB4B58: RtlWakeAllConditionVariable.NTDLL ref: 00DB4C0C

GetProcAddress.KERNEL32(SetWindowTheme), ref: 00CFA59D
__Init_thread_footer.LIBCMT ref: 00CFA5B4
SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 00CFA5DF

Part of subcall function 00DB4BA2: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4BAD
Part of subcall function 00DB4BA2: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4BEA

Part of subcall function 00CD7A10: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00CD7A51

Strings

UxTheme.dll, xrefs: 00CFA531
SetWindowTheme, xrefs: 00CFA592
explorer, xrefs: 00CFA5C7

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AddressConditionDirectoryMessageProcSendSystemVariableWake
String ID: SetWindowTheme$UxTheme.dll$explorer
API String ID: 3410024541-3123591815
Opcode ID: a4b80d67ae8c53119bd7759bc4f15a7e35ae7e7b5355ac894fbfb52af999db15
Instruction ID: 199c0e179515f4fa973d0c8fd03dc8ab447e63a6103af0f22dd646352417f873
Opcode Fuzzy Hash: a4b80d67ae8c53119bd7759bc4f15a7e35ae7e7b5355ac894fbfb52af999db15
Instruction Fuzzy Hash: 6821D5B2A40704EFC714DF55DD06F99B7A0E702720F010225FA35B73E2D776AA458A66

Function 00DB191C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 45libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00DB1997,00DB18FA,00DB1B9B), ref: 00DB1933
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00DB1949
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00DB195E

Strings

ReleaseSRWLockExclusive, xrefs: 00DB1953
KERNEL32.DLL, xrefs: 00DB192E
AcquireSRWLockExclusive, xrefs: 00DB1943
0z, xrefs: 00DB196F

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: 0z$AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-61002706
Opcode ID: d65b75cd8ede301ed5ae86000ed0901852abf970e39b23dd305c5a869e0ad6a6
Instruction ID: c7ec24b93f60a935fe8f9278de4e9da091fd4e2523a8e99f65458a031c52e743
Opcode Fuzzy Hash: d65b75cd8ede301ed5ae86000ed0901852abf970e39b23dd305c5a869e0ad6a6
Instruction Fuzzy Hash: 61F0C8397092A1EF0F215FA15DB5AFA66DA5B017903481039D8A3F3600D791CD45DEF1

Function 00C1F720 Relevance: 12.1, APIs: 8, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C1F74A
GetWindow.USER32(?,00000005), ref: 00C1F757
GetWindow.USER32(00000000,00000002), ref: 00C1F892

Part of subcall function 00C1F5A0: GetWindowRect.USER32(?,?), ref: 00C1F5CC
Part of subcall function 00C1F5A0: GetWindowRect.USER32(?,?), ref: 00C1F5DC

GetWindowRect.USER32(?,?), ref: 00C1F7EB
GetWindowRect.USER32(00000000,?), ref: 00C1F7FB
GetWindowRect.USER32(00000000,?), ref: 00C1F815

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$Rect
String ID:
API String ID: 3200805268-0
Opcode ID: e81c9c02c5507d90f6f9add5a427f701a6bb6a9c3ac9ef7230238ca1758833fb
Instruction ID: 6eab4d88b8fe33867ec1a9ad537c9c0b7dff95f9382314a650d09f8bf2cbbcab
Opcode Fuzzy Hash: e81c9c02c5507d90f6f9add5a427f701a6bb6a9c3ac9ef7230238ca1758833fb
Instruction Fuzzy Hash: A4419E315047009FD321DF25C980AABF7E9BF9B704F504A2DF195935A1EB30E98ADB52

Function 00D1CF90 Relevance: 12.1, APIs: 8, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00D1CFD8
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00D1CFE5
GetLastError.KERNEL32 ref: 00D1CFEF
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,000000FF), ref: 00D1D019
GetLastError.KERNEL32 ref: 00D1D01F
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),000000FF,000000FF,000000FF,000000FF), ref: 00D1D045
CloseHandle.KERNEL32(00000000), ref: 00D1D0D0

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Token$ErrorInformationLastProcess$CloseCurrentHandleOpen
String ID:
API String ID: 883865835-0
Opcode ID: 8a6f8a9c7a5bc0b317f4dd6f0eb033241a7290d33e1bd49dce25e3a1a62b91b1
Instruction ID: 3adc27e13bc65a90203882c644122b9168395ad5db700627c3c3d4025d476123
Opcode Fuzzy Hash: 8a6f8a9c7a5bc0b317f4dd6f0eb033241a7290d33e1bd49dce25e3a1a62b91b1
Instruction Fuzzy Hash: 23411371904219AFDF14DFA5DC49BEEBBB9EF08710F144015E811B22A0DBB99949CFA4

Function 00DB40E3 Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB4107
HeapAlloc.KERNEL32(00000000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB410E

Part of subcall function 00DB41D9: IsProcessorFeaturePresent.KERNEL32(0000000C,00DB40F5,00000000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB41DB

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB411E
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB4145
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB4159
InterlockedPopEntrySList.KERNEL32(00000000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB416C
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00DB428D,?,?,?,?,?,?,?), ref: 00DB417F

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: 5d4afbd43fc0916c737babdc2846984b63c97e1f28e75948e8e5c19ae852f8b1
Instruction ID: bf75ffa679f9e0edfd8cee112f023a89554793fda2b3aef6a9f8d9942ae36c5e
Opcode Fuzzy Hash: 5d4afbd43fc0916c737babdc2846984b63c97e1f28e75948e8e5c19ae852f8b1
Instruction Fuzzy Hash: 5D115E71F01715FFE7219B6DAC88FAB3A68EB547D1F140024F986F6262DB61CC448AB0

Function 00D1EA80 Relevance: 10.9, APIs: 7, Instructions: 413fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,6C34C19C), ref: 00D1EBC9
ReadFile.KERNEL32(00000000,00000000,00001000,?,00000000,00001000), ref: 00D1EC3B
ReadFile.KERNEL32(?,00000000,00001000,00000000,00000000,?,00000000,00000000), ref: 00D1EEDC
CloseHandle.KERNEL32(?), ref: 00D1EF3A

Part of subcall function 00D1EA80: LoadStringW.USER32(000000A1,?,00000514,6C34C19C), ref: 00D1E9E6

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: File$Init_thread_footerRead$CloseCreateHandleHeapLoadProcessString
String ID:
API String ID: 1714711150-0
Opcode ID: 09d1557d5f81a4609f556611b698e658209dcf0e3fe0116fe0804d537cf02c44
Instruction ID: bd1e24d7109cb17f14acc39f028760dfd93cb8e9ee2d396929edcf4307c27025
Opcode Fuzzy Hash: 09d1557d5f81a4609f556611b698e658209dcf0e3fe0116fe0804d537cf02c44
Instruction Fuzzy Hash: 34F1A171D00318EBDB14CFA8D849BEEBBB5FF45314F24421DE815AB281DB74A985CBA0

Function 00C1C940 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 284registryCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,Caphyon.AI.ExtUI.IEClickSoundRemover,6C34C19C), ref: 00C1C9CE
GetLastError.KERNEL32 ref: 00C1C9ED
RegCloseKey.ADVAPI32(?,Function_0024446C,00000000,Function_0024446C,00000000,00000000,80000001,00000001,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033), ref: 00C1CC7D
CloseHandle.KERNEL32(00000005,6C34C19C,?,?,00000000,00DE0F5D,000000FF,?,Function_0024446C,00000000,Function_0024446C,00000000,00000000,80000001,00000001,00000000), ref: 00C1CD0E

Strings

Caphyon.AI.ExtUI.IEClickSoundRemover, xrefs: 00C1C9C3
AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 00C1CA35

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Close$CreateErrorEventHandleLast
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current$Caphyon.AI.ExtUI.IEClickSoundRemover
API String ID: 1253123496-2079760225
Opcode ID: d15c062acb7be46c2829392cf09c20a737187f9642ecbf7c8b3001065b86f638
Instruction ID: 203ae402142ae9e86b6706560f6f72a19a071bc9f080910761255add916f62f0
Opcode Fuzzy Hash: d15c062acb7be46c2829392cf09c20a737187f9642ecbf7c8b3001065b86f638
Instruction Fuzzy Hash: D2C1AC70A00348DFDB14CFA8C999BEEBBB4FF45304F24425DE459A7281D7746A88CBA1

Function 00C1AAC0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00EC9338,6C34C19C,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00DE0855), ref: 00C1AB2A
GetModuleFileNameW.KERNEL32(0000FFFF,00000104,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00DE0855), ref: 00C1ABAA
EnterCriticalSection.KERNEL32(00EC9354,?,?,?,?,?,?,?,?,?,?,?,00000000,00DE0855,000000FF), ref: 00C1AD63
LeaveCriticalSection.KERNEL32(00EC9354,?,?,?,?,?,?,?,?,?,?,00000000,00DE0855,000000FF), ref: 00C1AD84

Strings

v, xrefs: 00C1AD7D

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$Enter$FileLeaveModuleName
String ID: v
API String ID: 1807155316-3261393531
Opcode ID: 390cc16e1af397b20c27797d67848972f583c8df2c9bbf1e9312cc9152b0cf71
Instruction ID: c11bda3e320360e51790c2d5ce972b2f79363b02725703b694aa9065f7c38a05
Opcode Fuzzy Hash: 390cc16e1af397b20c27797d67848972f583c8df2c9bbf1e9312cc9152b0cf71
Instruction Fuzzy Hash: C5B1A370905248DFDB10DFA5D888FEEBBB4FF0A304F144098E414A7251DB76AE85DB61

Function 00D188D0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 212registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,?,6C34C19C), ref: 00D18ACE
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 00D18ADE
RegOpenKeyExW.ADVAPI32(?,?,00000000,000000FF,00000000,?,6C34C19C), ref: 00D18B13
RegCloseKey.ADVAPI32(00000000), ref: 00D18B27

Strings

RegOpenKeyTransactedW, xrefs: 00D18AD8
Advapi32.dll, xrefs: 00D18AC9

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: be902ca49a632bdd421407698bee1c70bf49e89afb336eb5a8b40d6915546720
Instruction ID: ffa1a1d73aef8f3121e262df2badbd557dc1cf63ea4c8aabde4464ad256bee09
Opcode Fuzzy Hash: be902ca49a632bdd421407698bee1c70bf49e89afb336eb5a8b40d6915546720
Instruction Fuzzy Hash: B0917CB0D04348EFDB14CFA8D949B9EBBF4FF44304F148659E815AB281DB75A944DBA0

Function 00C0F710 Relevance: 10.7, APIs: 7, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00C0F804
SysFreeString.OLEAUT32(00000000), ref: 00C0F879
GetProcessHeap.KERNEL32(?,?), ref: 00C0F8E9
HeapFree.KERNEL32(00000000,?,?), ref: 00C0F8EF
GetProcessHeap.KERNEL32(?,00000000,?,00000000,00000000,00000000,6C34C19C,00E5B768,00000000), ref: 00C0F91C
HeapFree.KERNEL32(00000000,?,00000000,?,00000000,00000000,00000000,6C34C19C,00E5B768,00000000), ref: 00C0F922
SysFreeString.OLEAUT32(00000000), ref: 00C0F93A

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Free$Heap$String$Process
String ID:
API String ID: 2680101141-0
Opcode ID: d715a9286fd9efc69d79ba8f0981ffa7fe9bda04f9614aaeacdae4ad202043d2
Instruction ID: a0fbb29f2e673ba8af5def6cd43902755574ba617fc965c745f46a35c1e3d792
Opcode Fuzzy Hash: d715a9286fd9efc69d79ba8f0981ffa7fe9bda04f9614aaeacdae4ad202043d2
Instruction Fuzzy Hash: EF814B74D0025ADFDF20DFA8C855BEEBBB4BF05310F244669E421A72C1D778AA45CBA1

Function 00C16950 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 194comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00E46214,00000000,00000001,Function_0024689C,?), ref: 00C16A20

Strings

:, xrefs: 00C16A0A
{, xrefs: 00C16A80

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CreateInstance
String ID: :${
API String ID: 542301482-3766677574
Opcode ID: d66d5d6b3d34cf0c44bb43adbe018ac9547f64f94a3d4e588c08be996447e696
Instruction ID: 3f1c89924006284b140cb44c6c063ffe1f3d538be1dfb118216662faa9ef6088
Opcode Fuzzy Hash: d66d5d6b3d34cf0c44bb43adbe018ac9547f64f94a3d4e588c08be996447e696
Instruction Fuzzy Hash: 1161A070A042159BDF248F59C845BFE77B4EF0A710F14806AE852FB280E776DE81EB65

Function 00CFB730 Relevance: 10.7, APIs: 7, Instructions: 189windowCOMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 00CFB7B6
SelectObject.GDI32(00000000,?), ref: 00CFB834
SetBkMode.GDI32(00000000,00000001), ref: 00CFB842
SetTextColor.GDI32(00000000), ref: 00CFB887
GetWindowLongW.USER32(00000000), ref: 00CFB89B
SendMessageW.USER32(00000000), ref: 00CFB8B9
SelectObject.GDI32(00000000,?), ref: 00CFB914

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ObjectSelectWindow$CallColorLongMessageModeProcSendText
String ID:
API String ID: 2603541667-0
Opcode ID: 455a84fb02bac4fe62d25ee08e90367a866b9874a69f0da3f51af4e88bd207e9
Instruction ID: d2d45a417555d3cb0df103b106b9231fc4054e36f862421c7433b9f1e0888a19
Opcode Fuzzy Hash: 455a84fb02bac4fe62d25ee08e90367a866b9874a69f0da3f51af4e88bd207e9
Instruction Fuzzy Hash: 91717A71A00248AFDB04DFA9CC48FADBBB5FF48310F108269F955AB2A5CB71A915DF50

Function 00D1C870 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 166synchronizationCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00D1C9E6
GetLastError.KERNEL32 ref: 00D1C9F7
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00D1CA13
GetExitCodeProcess.KERNEL32(00000000,00E1C5B7), ref: 00D1CA24
CloseHandle.KERNEL32(00000000), ref: 00D1CA32

Strings

open, xrefs: 00D1C907

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CloseCodeErrorExecuteExitHandleLastObjectProcessShellSingleWait
String ID: open
API String ID: 1481985272-2758837156
Opcode ID: 825791b22666c31a4a0000512c9ea3e357f811eb2aad9b05121123c04f18a215
Instruction ID: 1b13875fda5e69f5388c3c575dc1c9707be9d682881404f3ad5f99f43507207d
Opcode Fuzzy Hash: 825791b22666c31a4a0000512c9ea3e357f811eb2aad9b05121123c04f18a215
Instruction Fuzzy Hash: 0C618971D002499FDB10CFA9D84879EBBB4FF49324F188259E825AB391DB749D44CFA0

Function 00C18120 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00EC957C,6C34C19C,00000000,00EC9598), ref: 00C18193
LeaveCriticalSection.KERNEL32(00EC957C), ref: 00C181F8
LoadCursorW.USER32(00C00000,?), ref: 00C18254
LeaveCriticalSection.KERNEL32(00EC957C), ref: 00C182EB

Strings

ATL:%p, xrefs: 00C18274
v, xrefs: 00C181F8, 00C182EB

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$Leave$CursorEnterLoad
String ID: v$ATL:%p
API String ID: 2080323225-109518622
Opcode ID: e2ff7f311a228d7ba7400527cbe4c3ef592550f55128c5394096a13d751608d0
Instruction ID: 8176c4285d0d0ec8830170f201d06ee0ae0965abe95b69d25d6603bfbe0dde7c
Opcode Fuzzy Hash: e2ff7f311a228d7ba7400527cbe4c3ef592550f55128c5394096a13d751608d0
Instruction Fuzzy Hash: DC519071D04B448FDB21CF69C945BAAB7F4FF19710F00461DE8A6A3651EB71AA88CB50

Function 00C27950 Relevance: 10.6, APIs: 7, Instructions: 125COMMON

Download Yara Rule

APIs

GetWindowDC.USER32(?,6C34C19C,?,00000000,?,?,?,?,?,00000000,00DE2BE5,000000FF,?,00C27692,?,?), ref: 00C27992
GetWindowRect.USER32(?,?), ref: 00C279B1
IsWindowEnabled.USER32(?), ref: 00C279C0
SelectObject.GDI32(00000000,00000000), ref: 00C27A1E
SelectObject.GDI32(?,?), ref: 00C27A62
DeleteObject.GDI32(00000000), ref: 00C27A71
DeleteDC.GDI32(?), ref: 00C27A94

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ObjectWindow$DeleteSelect$EnabledRect
String ID:
API String ID: 2818206005-0
Opcode ID: 7a5367b937efd59f45ff1ecb3ddb5969d9a9ec6cab753d59b7da1f49e91eba1c
Instruction ID: b235638ad7b62adefb389b1cec0bf2b71cf9be8e8bc213fb7cdeb7c9b6fcd7f8
Opcode Fuzzy Hash: 7a5367b937efd59f45ff1ecb3ddb5969d9a9ec6cab753d59b7da1f49e91eba1c
Instruction Fuzzy Hash: 81418E71A04218AFDB00DFAADD88BEEBBB9FF88310F104269E945B3250C7756905CF60

Function 00D1C720 Relevance: 10.6, APIs: 7, Instructions: 108processsynchronizationCOMMON

Download Yara Rule

APIs

Wow64DisableWow64FsRedirection.KERNEL32(00000000,6C34C19C,00000010), ref: 00D1C767
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,6C34C19C,00E1C52D), ref: 00D1C7DF
GetLastError.KERNEL32 ref: 00D1C7F0
WaitForSingleObject.KERNEL32(00E1C52D,000000FF), ref: 00D1C80C
GetExitCodeProcess.KERNEL32(00E1C52D,00000000), ref: 00D1C81D
CloseHandle.KERNEL32(00E1C52D), ref: 00D1C827
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 00D1C842

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Wow64$ProcessRedirection$CloseCodeCreateDisableErrorExitHandleLastObjectRevertSingleWait
String ID:
API String ID: 1153077990-0
Opcode ID: c178ab557fe4e510b056f81b6e91f1537e012cf4930a6edcad5833a682e6076d
Instruction ID: bb91dd685fb8f841b54a0b4bdc9086f77c7c29b99f817e03188b57564459e2d3
Opcode Fuzzy Hash: c178ab557fe4e510b056f81b6e91f1537e012cf4930a6edcad5833a682e6076d
Instruction Fuzzy Hash: B1417E31E04389AFDB10CFA5DD487EEBBF8AF4A314F145259E824B6190DBB49944CFA0

Function 00D25290 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shlwapi.dll,?,?,?,?,00D30731,?,6C34C19C,?,?), ref: 00D252AB
GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 00D252C1
FreeLibrary.KERNEL32(00000000), ref: 00D252FA
FreeLibrary.KERNEL32(00000000,?,?,?,?,00D30731,?,6C34C19C,?,?), ref: 00D25316

Strings

DllGetVersion, xrefs: 00D252BB
Shlwapi.dll, xrefs: 00D252AA

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: DllGetVersion$Shlwapi.dll
API String ID: 1386263645-2240825258
Opcode ID: e8ebabf1a7dbb1538aaee37f170ee16bcff5c3cb83cc4553b6791821b667919e
Instruction ID: 0284a5dc3647e6cedc338c25fd620ac7c21c7f93c4efd2b1b8aa092d28f341c5
Opcode Fuzzy Hash: e8ebabf1a7dbb1538aaee37f170ee16bcff5c3cb83cc4553b6791821b667919e
Instruction Fuzzy Hash: C621C2726047158BC304EF29E845A6BB7E4FFEE704B80092DF445D3202EB7198088BB2

Function 00C3DAC0 Relevance: 9.1, APIs: 6, Instructions: 140COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00C3DAFD
std::_Lockit::_Lockit.LIBCPMT ref: 00C3DB1F
std::_Lockit::~_Lockit.LIBCPMT ref: 00C3DB47
__Getcoll.LIBCPMT ref: 00C3DC11
std::_Facet_Register.LIBCPMT ref: 00C3DC56
std::_Lockit::~_Lockit.LIBCPMT ref: 00C3DC8E

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID:
API String ID: 1184649410-0
Opcode ID: 4acddeb50a393753003089ca13a77c2235c3bf49f8aee427a496c150dd4f134e
Instruction ID: b616699df3d4d897a71cb8c5601a8566d850402602b9a49ae71b14ca48d9d1b5
Opcode Fuzzy Hash: 4acddeb50a393753003089ca13a77c2235c3bf49f8aee427a496c150dd4f134e
Instruction Fuzzy Hash: A951BEB1C11608DFCB01DF95E985BADFBB0FF40314F244169E816AB391DB75AA09CBA1

Function 00D51670 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 136COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00D516D1

Strings

GET, xrefs: 00D51859
Local Network Server, xrefs: 00D51E58, 00D51E6A, 00D51E74
HTTP/1.0, xrefs: 00D524C8
*/*, xrefs: 00D52450
FTP Server, xrefs: 00D520B8, 00D520CA, 00D520D4

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ErrorLast
String ID: */*$FTP Server$GET$HTTP/1.0$Local Network Server
API String ID: 1452528299-1822174798
Opcode ID: 789d148c23621c29455827643b62953e3951c6d9c8daaccb27adf286dc7ad896
Instruction ID: 1673028f318213ea6e62ad4624a68889c799f67a5abd54e656a9f7b78ffffae6
Opcode Fuzzy Hash: 789d148c23621c29455827643b62953e3951c6d9c8daaccb27adf286dc7ad896
Instruction Fuzzy Hash: 6141C275A01209EBDB10DFA8CC45FAEBBF8EF45311F144529ED11AB281DB749909CBB1

Function 00DB6303 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00DB62FA,00DB62C6,?,?,00C3AEBD,00D19A40,?,00000008), ref: 00DB6311
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00DB631F
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00DB6338
SetLastError.KERNEL32(00000000,00DB62FA,00DB62C6,?,?,00C3AEBD,00D19A40,?,00000008), ref: 00DB638A

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 37e02399ce71b51aa70fde86ca114a2cde6ae68db9715d5e32ffbbc421868bec
Instruction ID: 6a6571da439422dada6a2f0647cac4b192b1350c27a7b5ced220460ad6aeb150
Opcode Fuzzy Hash: 37e02399ce71b51aa70fde86ca114a2cde6ae68db9715d5e32ffbbc421868bec
Instruction Fuzzy Hash: 7601FC32109611DEA73517F67CD6EDA67D8DB02774328033DFA22612E2EF5ACC455570

Function 00C087E0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00C088C5
__Init_thread_footer.LIBCMT ref: 00C0893F

Strings

</a>, xrefs: 00C08A49
<a>, xrefs: 00C08AF1
<a href=", xrefs: 00C08887

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Init_thread_footer
String ID: </a>$<a href="$<a>
API String ID: 1385522511-4210067781
Opcode ID: 21577190b8ecc9440a17c1e32c99e729a4ee72d60613741e91a45b40660a44f9
Instruction ID: 83b22f2b4d71fe5966c1d41202a0a5c3931ed3d793239d0ab27321d960ca6311
Opcode Fuzzy Hash: 21577190b8ecc9440a17c1e32c99e729a4ee72d60613741e91a45b40660a44f9
Instruction Fuzzy Hash: B3A182B0A00704DFCB18DF64D959F9DB7B1FB44314F108269E425AB2D2EB71AA4ACB61

Function 00C362C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 182windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,SysTabControl32,?,46010000,?,?,?,?,00000000,00000309,00000000), ref: 00C363BD
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00C363D2
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00C363DA

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Part of subcall function 00C38190: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00C381D8

Strings

TabHost, xrefs: 00C36349, 00C3635B, 00C36365
SysTabControl32, xrefs: 00C363B5

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: MessageSend$AllocateCreateHeapWindow
String ID: SysTabControl32$TabHost
API String ID: 2359350451-2872506973
Opcode ID: bf12aa8cc5fa01fbf97216ed9140890ed8ccf4f539007addebce3baf0e4e35eb
Instruction ID: 4366434d4384b8a9f581b8104a2f8271a58f753df9da5a46dbc7597d26441ea1
Opcode Fuzzy Hash: bf12aa8cc5fa01fbf97216ed9140890ed8ccf4f539007addebce3baf0e4e35eb
Instruction Fuzzy Hash: B1518C75A00605AFDB14DF69C884FAEBBF4FF49310F108269E915A73A1DB71AD05CBA0

Function 00C22BA0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113timeCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C34C19C,6C34C19C,?), ref: 00C22BDF
EnterCriticalSection.KERNEL32(?,6C34C19C,?), ref: 00C22BEC
KillTimer.USER32(?,00000001), ref: 00C22C34
LeaveCriticalSection.KERNEL32(?,?,00000000,?), ref: 00C22CC3

Strings

v, xrefs: 00C22CC3

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$EnterInitializeKillLeaveTimer
String ID: v
API String ID: 3614119372-3261393531
Opcode ID: 73ce58efe0808c6ec68b7bad8a03904af263461f4bd9f5f1545ca01d0e0a1744
Instruction ID: 273ce06a2d81aefbc7134f92879f2d66a519a1e6f909d2cb3a90b9d43923c29b
Opcode Fuzzy Hash: 73ce58efe0808c6ec68b7bad8a03904af263461f4bd9f5f1545ca01d0e0a1744
Instruction Fuzzy Hash: 6D411534200751AFDB21DF39E840BAABBB1FF45310F104529E8A6D7792CB31A906DB90

Function 00D23C20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00DB4BA2: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4BAD
Part of subcall function 00DB4BA2: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4BEA

LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr), ref: 00D23C7E
GetProcAddress.KERNEL32(00000000), ref: 00D23C85
__Init_thread_footer.LIBCMT ref: 00D23C9C

Part of subcall function 00DB4B58: EnterCriticalSection.KERNEL32(00EC7FD8,?,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B62
Part of subcall function 00DB4B58: LeaveCriticalSection.KERNEL32(00EC7FD8,?,00C09DD7,00EC8C04,00E37520), ref: 00DB4B95
Part of subcall function 00DB4B58: RtlWakeAllConditionVariable.NTDLL ref: 00DB4C0C

Strings

SymFromAddr, xrefs: 00D23C74
Dbghelp.dll, xrefs: 00D23C79

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionInit_thread_footerLibraryLoadProcVariableWake
String ID: Dbghelp.dll$SymFromAddr
API String ID: 3268644551-642441706
Opcode ID: 1d3a9211fcb5b1078374ae576929aee5cd0067bfbcfd9dbcb2be887018be4a37
Instruction ID: 5a844976d84615d4ad5333ed6ccda91fc88c561ca96627e8f82cb1c30ec0d06e
Opcode Fuzzy Hash: 1d3a9211fcb5b1078374ae576929aee5cd0067bfbcfd9dbcb2be887018be4a37
Instruction Fuzzy Hash: 03017571944744DFC710CF69ED49F84F7E5E708720F100769E916B37D2DB79A5058A11

Function 00DB4C2A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00DB4BC7,00000064), ref: 00DB4C4D
LeaveCriticalSection.KERNEL32(00EC7FD8,?,?,00DB4BC7,00000064,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4C57
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00DB4BC7,00000064,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4C68
EnterCriticalSection.KERNEL32(00EC7FD8,?,00DB4BC7,00000064,?,00C09D66,00EC8C04,6C34C19C,?,?,00DDCC0D,000000FF,?,00D5985C,6C34C19C), ref: 00DB4C6F

Strings

v, xrefs: 00DB4C57

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: v
API String ID: 3269011525-3261393531
Opcode ID: 81534f636e671716451a25f65be793fb1ac10f2ee4f3c531d7de09ccdbfb8e9c
Instruction ID: deb00df4f48eaee169b27280bb0c8dbe238f0dbaa6e02dcd6b13343a73605287
Opcode Fuzzy Hash: 81534f636e671716451a25f65be793fb1ac10f2ee4f3c531d7de09ccdbfb8e9c
Instruction Fuzzy Hash: 89E0923164A22CBFCF011F42ED4DEDE3F28EB14B51B004028F94672171CBA248059FD4

Function 00C45970 Relevance: 7.8, APIs: 5, Instructions: 270memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000000), ref: 00C459C9
GetProcessHeap.KERNEL32(?,00000000), ref: 00C45ACB
HeapFree.KERNEL32(00000000,?,00000000), ref: 00C45AD1
GetProcessHeap.KERNEL32(?,00000000), ref: 00C45B4A
HeapFree.KERNEL32(00000000,?,00000000), ref: 00C45B50
CoUninitialize.COMBASE ref: 00C45CA7

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Heap$FreeProcess$InitializeUninitialize
String ID:
API String ID: 4239879612-0
Opcode ID: 7f3388fcc811811af10c884dcf0560b10826642f4aeff7a539b0bec572d51db1
Instruction ID: a4ee33bef5e321618321ae2f52fb5195df74a34516c6e61335ce2c6503cac12f
Opcode Fuzzy Hash: 7f3388fcc811811af10c884dcf0560b10826642f4aeff7a539b0bec572d51db1
Instruction Fuzzy Hash: A7B17EB0D00648DFDB14DFA5C985FEEBBB8FF45304F208259E415AB292DB749A45CBA0

Function 00C22650 Relevance: 7.7, APIs: 5, Instructions: 237windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000001), ref: 00C226C2
GetParent.USER32(00000001), ref: 00C226ED
SendMessageW.USER32(00000000,00000138,?,00000001), ref: 00C226FD
FillRect.USER32(?,?,00000000), ref: 00C2270B
ReleaseDC.USER32(00000001,00000000), ref: 00C228E1

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: FillMessageParentRectReleaseSend
String ID:
API String ID: 2215362955-0
Opcode ID: 936d41cd321ab6677c992a6b0fae676cd0e9e8e85df94038cd12cead7a798b14
Instruction ID: 6765dd640a889aca3120df40273ff2c5931598ac2f39a8ca46e750509c32368b
Opcode Fuzzy Hash: 936d41cd321ab6677c992a6b0fae676cd0e9e8e85df94038cd12cead7a798b14
Instruction Fuzzy Hash: 1F9159B2A04619EFDB15CFAADD04BAEBBB4FF08300F144129E915E7690D731A915CF90

Function 00CFB3E0 Relevance: 7.7, APIs: 5, Instructions: 151windowCOMMON

Download Yara Rule

APIs

GetWindowDC.USER32(?,6C34C19C,?,?,00000000,?,?,?,?,?,?,?,?,00000000,00E16F5D,000000FF), ref: 00CFB410
GetWindowRect.USER32(?,?), ref: 00CFB430
IsWindowEnabled.USER32(?), ref: 00CFB461
GetFocus.USER32 ref: 00CFB46F
DeleteDC.GDI32(?), ref: 00CFB585

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$DeleteEnabledFocusRect
String ID:
API String ID: 733580484-0
Opcode ID: c588740c0b0ac45c95f0a3fcf3d678c8684e6ede0c65359e97831a6cd7434cf2
Instruction ID: 2b60b69800fe5a0bd5896d5f9ca5fd376b29b0474dd25becdb343d8c5c1c61ef
Opcode Fuzzy Hash: c588740c0b0ac45c95f0a3fcf3d678c8684e6ede0c65359e97831a6cd7434cf2
Instruction Fuzzy Hash: B1513471A04209EFDB24DFA5D948BEEBBF8EF08300F144169E556B7290DB75AA45CF20

Function 00C1B240 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00C1B31C
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C1B32B
ReleaseDC.USER32(00000000), ref: 00C1B372

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CapsDeviceRelease
String ID:
API String ID: 127614599-0
Opcode ID: c66e7c444562c6d6bb78c2d20a30c82f626c23714b400db893ff5709ae742e21
Instruction ID: 99e3c7846423876a52a39c03d5595faf12937712245f236f46b28bea627a3059
Opcode Fuzzy Hash: c66e7c444562c6d6bb78c2d20a30c82f626c23714b400db893ff5709ae742e21
Instruction Fuzzy Hash: 41513AB5904249DFDB10DFA9C848BAEBBF4EF09310F104129F965E7290D7349954DF60

Function 00C15780 Relevance: 7.6, APIs: 5, Instructions: 125windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00C157DE
GetDlgItem.USER32(?,?), ref: 00C15803
SendMessageW.USER32(?,?,?,?), ref: 00C158CD

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ItemMessageSendWindow
String ID:
API String ID: 799199299-0
Opcode ID: 76e0b4c8fe450c2d55ecd490587d5f0fac92d55cfce6605a1c9a23eecfac2ae0
Instruction ID: e2380dc77d5bfdad1cb3e839a0d1f5a126fd63e06a459d7fe756569cf062ec80
Opcode Fuzzy Hash: 76e0b4c8fe450c2d55ecd490587d5f0fac92d55cfce6605a1c9a23eecfac2ae0
Instruction Fuzzy Hash: 29410232340901DFE7148F19D894EA6B7A9FBC6351F14852AE596CA1A0C732ED91EB60

Function 00CFB5B0 Relevance: 7.6, APIs: 5, Instructions: 124windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00CFB60E

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

IsWindowEnabled.USER32(?), ref: 00CFB644
GetFocus.USER32 ref: 00CFB654
GetDC.USER32(?), ref: 00CFB684

Part of subcall function 00D20B20: SelectObject.GDI32(?,?), ref: 00D20B83
Part of subcall function 00D20B20: SetTextColor.GDI32(?,?), ref: 00D20BCF
Part of subcall function 00D20B20: SelectObject.GDI32(?,?), ref: 00D20BF9

CallWindowProcW.USER32(?,?,?,?,?), ref: 00CFB6B3

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Init_thread_footerObjectSelectWindow$CallClientColorEnabledFocusHeapProcProcessRectText
String ID:
API String ID: 1237246694-0
Opcode ID: dda7a45ea337ebf638e9d484519862616af416f559758c905a2dc7c1c0fd09cd
Instruction ID: 210f871b5804fad2da4a13d2ed05ee668d4193adb0be7abd4195493a0e26572a
Opcode Fuzzy Hash: dda7a45ea337ebf638e9d484519862616af416f559758c905a2dc7c1c0fd09cd
Instruction Fuzzy Hash: 4F410871900209DFDB05DF65C985BEABBB4EF08310F148169E915AB2A2DB31AD54CF61

Function 00D15610 Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D15644
std::_Lockit::_Lockit.LIBCPMT ref: 00D15666
std::_Lockit::~_Lockit.LIBCPMT ref: 00D1568E
std::_Facet_Register.LIBCPMT ref: 00D15777
std::_Lockit::~_Lockit.LIBCPMT ref: 00D157A1

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 59bdc828ca72246045d1b6ce61238185c2bfbc49e89cf3bf1c69a585f02ff26e
Instruction ID: a6f2eefd3e544d820a8799b62a4ea4fa9c6d3d2ed2696df428c5439a0219a326
Opcode Fuzzy Hash: 59bdc828ca72246045d1b6ce61238185c2bfbc49e89cf3bf1c69a585f02ff26e
Instruction Fuzzy Hash: 7F51BF71900645DFDB10CF58E885BEEBBF0FB41314F244159E845AB381DB79AA45CBA0

Function 00C2EBA0 Relevance: 7.6, APIs: 5, Instructions: 109windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32(00000000,?,?), ref: 00C2EC18
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C2EC60
SendMessageW.USER32(?,0000102C,000000FF,0000F000), ref: 00C2EC7C
SendMessageW.USER32(?,0000102B,000000FF,?), ref: 00C2ECAE
SetFocus.USER32(00000000,?,?), ref: 00C2ECC1

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: MessageSend$Focus
String ID:
API String ID: 3982298024-0
Opcode ID: d38b8188b6606fe6534b8946cbf19f6ca5e816ecca6e902f4fb1528538eb8907
Instruction ID: 87d382601eb08f978a5390b24973a7fc0e651fd137dcccf81982649d7c3d58d6
Opcode Fuzzy Hash: d38b8188b6606fe6534b8946cbf19f6ca5e816ecca6e902f4fb1528538eb8907
Instruction Fuzzy Hash: 08417B74900608DFDB10DFA9CC84AAABBF4FF48710F20462DE866A77A1DB71A944CF50

Function 00C0F230 Relevance: 7.6, APIs: 5, Instructions: 60memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C0F27A
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00C0F280
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 00C0F2A3
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,00DDE1F6,000000FF), ref: 00C0F2CB
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,00DDE1F6,000000FF), ref: 00C0F2D1

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Heap$FreeProcess$FormatMessage
String ID:
API String ID: 1606019998-0
Opcode ID: 4fb6fc3eac808c07b1a73609485b659da707a0a7fe442a72a2f0df4caa490015
Instruction ID: eef7ca60156726a5ac903da6d5d71829ba442bc631f0725071a6a50ec0838c05
Opcode Fuzzy Hash: 4fb6fc3eac808c07b1a73609485b659da707a0a7fe442a72a2f0df4caa490015
Instruction Fuzzy Hash: 571160B1A44259EBEB10EF94CC42BAFBBBCEB04B04F100519F910AB2C1D7B59A4487F1

Function 00C271B0 Relevance: 7.6, APIs: 5, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00C271BB
SendMessageW.USER32(?,?,?,0000102B), ref: 00C27218
SendMessageW.USER32(?,?,?,0000102B), ref: 00C27267
SendMessageW.USER32(?,00001043,00000000,00000000), ref: 00C27278
SendMessageW.USER32(?,00001013,00000000,00000000), ref: 00C27285

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: db5176e01f26949e28ab8b4b029d11e6242ee9ead1ab9b994ff2183843b381e9
Instruction ID: ce5a7f7c5dcc92ff49cc1aacf9b9e76fdad968fe5ce1995c7d99d6e4c0fb9c8f
Opcode Fuzzy Hash: db5176e01f26949e28ab8b4b029d11e6242ee9ead1ab9b994ff2183843b381e9
Instruction Fuzzy Hash: EC215131918786AAD320DF15CD44B1ABBF1BFED758F206B1EF1D0211A4E7F195848E86

Function 00D3CC60 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 326COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,6C34C19C,?,00000010,?), ref: 00D3CF2A

Part of subcall function 00D1CF90: GetCurrentProcess.KERNEL32 ref: 00D1CFD8
Part of subcall function 00D1CF90: OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00D1CFE5
Part of subcall function 00D1CF90: GetLastError.KERNEL32 ref: 00D1CFEF
Part of subcall function 00D1CF90: CloseHandle.KERNEL32(00000000), ref: 00D1D0D0

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

Part of subcall function 00C092A0: FindResourceW.KERNEL32(00000000,?,00000006,?,?,*.*,8007000E,80004005,00C21134,00000000,?,00000010,?,*.*,?,80070057), ref: 00C092C3

Strings

\\?\, xrefs: 00D3CF37
[WindowsVolume], xrefs: 00D3CCF0, 00D3CD02, 00D3CD0C
Extraction path set to:, xrefs: 00D3CF7D

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Process$Init_thread_footer$CloseCurrentErrorFindHandleHeapLastOpenPathResourceToken
String ID: Extraction path set to:$[WindowsVolume]$\\?\
API String ID: 699919280-3538578949
Opcode ID: 11c3fd239f1bd5b88153dff9c2a747e986dc75e198fa40caeba2a338fae41114
Instruction ID: 23b1c81dfa735c875ed01e3c74b0d741ce9215fd401918557d00a00f760654bc
Opcode Fuzzy Hash: 11c3fd239f1bd5b88153dff9c2a747e986dc75e198fa40caeba2a338fae41114
Instruction Fuzzy Hash: 0DC1E230A016459FDB14DF6CC884BAEFBB5EF44314F1882A9E811AB2D2DB70DD45CBA0

Function 00C33570 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 319windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,RichEdit20W,?,?,?,?,?,?,00000000,00000000,00000000), ref: 00C3371C
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00C33731
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00C33739

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Strings

RichEdit20W, xrefs: 00C33714

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: MessageSend$AllocateCreateHeapWindow
String ID: RichEdit20W
API String ID: 2359350451-4173859555
Opcode ID: d163bd3a0ee8a1c30df7fed12c5c18bc2523afe3dd325de5f97a3226916ec1a6
Instruction ID: 8eafa88eb6ea1f57eb0b1a9736309b060c00b7717e1739500894216bc937c5aa
Opcode Fuzzy Hash: d163bd3a0ee8a1c30df7fed12c5c18bc2523afe3dd325de5f97a3226916ec1a6
Instruction Fuzzy Hash: 67B18871A01209DFDB14CFA8C895BAEBBF4FF48710F144169E815AB391DB71AE00CBA0

Function 00C2D870 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 226windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Part of subcall function 00CFA0B0: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,00C266F8,00000000,80004005), ref: 00CFA118
Part of subcall function 00CFA0B0: RedrawWindow.USER32(?,00000000,00000000,00000541,?,?,?,000000EF,?,00C266F8,00000000,80004005), ref: 00CFA129
Part of subcall function 00CFA0B0: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00CFA148

SendMessageW.USER32(?,00001036,00000004,00000004), ref: 00C2DA2D
SendMessageW.USER32(?,00001036,00000400,00000400), ref: 00C2DA44
SendMessageW.USER32(?,00001061,00000000,?), ref: 00C2DAA0

Strings

QuickSelectionList, xrefs: 00C2D962, 00C2D974, 00C2D97E

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: MessageSend$Window$AllocateHeapRedraw
String ID: QuickSelectionList
API String ID: 884508843-3633591268
Opcode ID: ccf6615d6923976e20ed8b28f0c931de50e5a6826d477e69c77fbb2086e06938
Instruction ID: 6c42a9dbbb91209f8c347d8fa18ea5dd1853d084193d853a2888d53ddc1a217f
Opcode Fuzzy Hash: ccf6615d6923976e20ed8b28f0c931de50e5a6826d477e69c77fbb2086e06938
Instruction Fuzzy Hash: A081AB71A002099FDB04DF69D884BAAF7F4FF88314F108259F566A7291DB71AE44CFA1

Function 00D4E3A0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 172COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,6C34C19C,74DEF530,00000000), ref: 00D4E3F2
CloseHandle.KERNEL32(?,6C34C19C,00000000,?,00000000,00E25F93,000000FF,?), ref: 00D4E570
CloseHandle.KERNEL32(?,6C34C19C,00000000,?,00000000,00E25F93,000000FF,?), ref: 00D4E59F

Strings

LOG, xrefs: 00D4E45A

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CloseHandle$FileModuleName
String ID: LOG
API String ID: 3884789274-429402703
Opcode ID: 6d5e5bb5fe7efa85816e1df4e50f93bac17cf64ea727690a8b88bd64e0687b0b
Instruction ID: 384a2f7053c1d1ed6fce04f03f1050e64e0c1d43308fbedf22b5f156aa481ef9
Opcode Fuzzy Hash: 6d5e5bb5fe7efa85816e1df4e50f93bac17cf64ea727690a8b88bd64e0687b0b
Instruction Fuzzy Hash: D851C371A00244EFDB24DF68C905BAAB7F5FF44710F144669E81ADB781E774DA04CBA0

Function 00C0F600 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoOriginateLanguageException), ref: 00C0F642
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00C0F648

Strings

combase.dll, xrefs: 00C0F63D
RoOriginateLanguageException, xrefs: 00C0F638

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoOriginateLanguageException$combase.dll
API String ID: 2574300362-3996158991
Opcode ID: 1f10378c4509f2342be127c8d27c60a021a76897cb68b92e6064f463b1d54291
Instruction ID: d3279c212ae3875ede150ad38c386c52a86c446309c94592cebaa1964abcc98b
Opcode Fuzzy Hash: 1f10378c4509f2342be127c8d27c60a021a76897cb68b92e6064f463b1d54291
Instruction Fuzzy Hash: 09314C71900209DFDB20DFA8C955BEEB7B4EB14314F10423AE825A76D0DB755B85CBA1

Function 00D514E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,00D4F23A,?,6C34C19C,?,?,?,?,00E262A5,000000FF), ref: 00D514ED
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00D4F23A,?,6C34C19C,?,?,?,?,00E262A5,000000FF,?), ref: 00D5150E
GetLastError.KERNEL32(?,6C34C19C,?,?,?,?,00E262A5,000000FF,?,00D4EB6D,?,?,00000000,?,?), ref: 00D5156E

Strings

AdvancedInstaller, xrefs: 00D51556

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CreateEvent$ErrorLast
String ID: AdvancedInstaller
API String ID: 1131763895-1372594473
Opcode ID: 4cb24094f40d93912ca34bb2daca6451306914b5797857da535533f2baf4b68a
Instruction ID: 6817b3dd1ce7894d4efedb39541dcae42c846f8a731268c0c14f25aff2c35e70
Opcode Fuzzy Hash: 4cb24094f40d93912ca34bb2daca6451306914b5797857da535533f2baf4b68a
Instruction Fuzzy Hash: BE113A75340606AFDB24DB31CD89F16BBB4FB84706F204524F9069B290D7B1E819CBA0

Function 00C18320 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00EC957C), ref: 00C1835C
GetCurrentThreadId.KERNEL32 ref: 00C18370
LeaveCriticalSection.KERNEL32(00EC957C), ref: 00C183AF

Strings

v, xrefs: 00C183AF

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: 2589233014a003af3a64874945bf35eaf4f76e1628f22701c74e291cbb4a97ab
Instruction ID: bb02dcad4294d9d2dcd1e9be008f60781df8f62303296606ac630311f6356904
Opcode Fuzzy Hash: 2589233014a003af3a64874945bf35eaf4f76e1628f22701c74e291cbb4a97ab
Instruction Fuzzy Hash: 4811D331D08354CFCB11CF1AD908B5ABBE4FB45B10F15465DD866A3391C7B159098BA0

Function 00C27710 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

GetParent.USER32(00000005), ref: 00C27784

Strings

C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 00C27759
DX, xrefs: 00C2779A
d, xrefs: 00C27750

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Parent
String ID: C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h$DX$d
API String ID: 975332729-1206192860
Opcode ID: f534e6099db57aa0850e12b3179b8b4c107201b4304f9e6ee184dcf42f344e28
Instruction ID: 15b3b0f7f77b3b1c92edd87017f9cbc9056cbe23419d37d18b9bd688e4398d3a
Opcode Fuzzy Hash: f534e6099db57aa0850e12b3179b8b4c107201b4304f9e6ee184dcf42f344e28
Instruction Fuzzy Hash: 95215970D05298EFDF04CFE4E958BDDBBB1AF45304F108158E401BB295DBB96A08DB50

Function 00C1266B Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00C126D9

Strings

d, xrefs: 00C126AB
C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00C126B4
DX, xrefs: 00C126EF

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$DX$d
API String ID: 2558294473-825145886
Opcode ID: c94f67dee034e2864a6aa51a07490660e07b63fd240008bd20c2cca4d33b68f8
Instruction ID: 3664de855646e62a45517f7a9e5503d57790f507e4c1faf1a4a621fce0265dba
Opcode Fuzzy Hash: c94f67dee034e2864a6aa51a07490660e07b63fd240008bd20c2cca4d33b68f8
Instruction Fuzzy Hash: C1216574D05288EFCF04CBE4E958BDDBBB1AF46304F508098E001BB295EBB51A08DB91

Function 00C12A59 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00C12ACA

Strings

d, xrefs: 00C12A99
C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00C12AA5
DX, xrefs: 00C12AE0

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$DX$d
API String ID: 2558294473-825145886
Opcode ID: 1bec655cd52667c648ea97b246ddefe08c1674e4360b320f517fbfd4787b3a5a
Instruction ID: 605d8411575fa70cc59e8ecb5f03516626233eb0ff3c05438232f28e918d34d0
Opcode Fuzzy Hash: 1bec655cd52667c648ea97b246ddefe08c1674e4360b320f517fbfd4787b3a5a
Instruction Fuzzy Hash: B6216570D05288EFCB04CFE4E9587DDBBB0AF45304F608098E001BB295DBB96A09DB91

Function 00C277EB Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 53COMMON

Download Yara Rule

APIs

GetParent.USER32(0000000D), ref: 00C2785C

Strings

d, xrefs: 00C27826
DX, xrefs: 00C27872
C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 00C2782F

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Parent
String ID: C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h$DX$d
API String ID: 975332729-1206192860
Opcode ID: 159bd247b3bc05bc99e715e23049cb0a47a38682ed309f2e5cdebf3372176046
Instruction ID: 7dababf6cc388d72b3eb2fda81ac2f29fd00d13b7b5ced9d4d28f840b1fe51eb
Opcode Fuzzy Hash: 159bd247b3bc05bc99e715e23049cb0a47a38682ed309f2e5cdebf3372176046
Instruction Fuzzy Hash: 47215430D05288EEDF04CFE4E998BDDBBB0AF45308F208158E001BB2A5DBB95A09DB51

Function 00C12740 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00C127AB

Strings

C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00C12784
d, xrefs: 00C1277B
DX, xrefs: 00C127C1

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$DX$d
API String ID: 2558294473-825145886
Opcode ID: e7d792910a7469b32e7c0aabcb37a84e2b9ba220da1bb18cf0484d8390906f41
Instruction ID: 1f58ef0ef14d7bc723ccb9a2aea1db6561a99ec3e5cd99a8bac91d3782b4d366
Opcode Fuzzy Hash: e7d792910a7469b32e7c0aabcb37a84e2b9ba220da1bb18cf0484d8390906f41
Instruction Fuzzy Hash: 31216730D05288EEDF04CFE4E9587DDBBB0AF55308F608058E0017B295DBB55A49EB61

Function 00C12B31 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00C12B9F

Strings

C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00C12B78
DX, xrefs: 00C12BB5
d, xrefs: 00C12B6C

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$DX$d
API String ID: 2558294473-825145886
Opcode ID: e36a94ddefe15294fe3aeb869c7e8d3a107b4cf533d3255b80f589058af6374a
Instruction ID: baeabff6313522255674d1bc7f658d9792f233fd8bf982e0f872c5524eb246cc
Opcode Fuzzy Hash: e36a94ddefe15294fe3aeb869c7e8d3a107b4cf533d3255b80f589058af6374a
Instruction Fuzzy Hash: 97215630D05288EFDF04CFE4E968BDDBBB0AF95308F608198E0017B295DBB55A49EB51

Function 00DB2220 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00DB222C
__Mtx_unlock.LIBCPMT ref: 00DB226B
__Cnd_broadcast.LIBCPMT ref: 00DB2273

Strings

Pz, xrefs: 00DB2227

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Cnd_broadcastCurrentMtx_unlockThread
String ID: Pz
API String ID: 2021000804-2390790901
Opcode ID: a990a2d1653c08c1abf2f8eac8a79ca66cf3801afb0942659d0e4f04832d0f29
Instruction ID: cf9ccef72d7fc7bfafbfaeaf62c3f8bfa80147f398120c5524afbc21229abca8
Opcode Fuzzy Hash: a990a2d1653c08c1abf2f8eac8a79ca66cf3801afb0942659d0e4f04832d0f29
Instruction Fuzzy Hash: 38019A32600702DBDB269BA5C852AFAB3A5EF41351F590439E557AB200DB31EC009BB0

Function 00DB942C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000800,?,00DB93DD,?,?,00000000,?,?,?,00DB9507,00000002,FlsGetValue,00E3B154,00E3B15C), ref: 00DB9439
GetLastError.KERNEL32(?,00DB93DD,?,?,00000000,?,?,?,00DB9507,00000002,FlsGetValue,00E3B154,00E3B15C,?,?,00DB6324), ref: 00DB9443
LoadLibraryExW.KERNEL32(?,00000000,00000000), ref: 00DB946B

Strings

api-ms-, xrefs: 00DB9450

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: 92cfa07fa128d4e7d48eb81cd24b8d4730466156c3c7efb9c5df9a76f033a35a
Instruction ID: ba9893aa200c752da57f7693f66aa8eeb029d4d77bb90dbf41d5f2e5287de1ca
Opcode Fuzzy Hash: 92cfa07fa128d4e7d48eb81cd24b8d4730466156c3c7efb9c5df9a76f033a35a
Instruction Fuzzy Hash: 09E04F3038024CFBEF201F61FC2AB987F599B10B40F148020FB4EB80E1E7A5EA159969

Function 00C26560 Relevance: 6.3, APIs: 4, Instructions: 320windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001037,00000000,00000000), ref: 00C266A8
SendMessageW.USER32(?,00001036,00000000,00000000), ref: 00C266BD

Part of subcall function 00C09980: RtlAllocateHeap.NTDLL(?,00000000,?,6C34C19C,00000000,00DDC6B0,000000FF,?,?,00EBC42C,?,00D598B8,80004005,6C34C19C), ref: 00C099CA

Part of subcall function 00CFA0B0: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,00C266F8,00000000,80004005), ref: 00CFA118
Part of subcall function 00CFA0B0: RedrawWindow.USER32(?,00000000,00000000,00000541,?,?,?,000000EF,?,00C266F8,00000000,80004005), ref: 00CFA129
Part of subcall function 00CFA0B0: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00CFA148

SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 00C267F3
SendMessageW.USER32(?,00001061,00000000,00000005), ref: 00C268EF

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: MessageSend$Window$AllocateHeapRedraw
String ID:
API String ID: 884508843-0
Opcode ID: 4b13c82f100290636bf30392c5299e48c6a711aa626fe38fe1425eda53d94e4f
Instruction ID: 35b37f29ed97dc2ba4d087a61da3f2022553d04acb89523829a96fa870d2d6e9
Opcode Fuzzy Hash: 4b13c82f100290636bf30392c5299e48c6a711aa626fe38fe1425eda53d94e4f
Instruction Fuzzy Hash: 9BC1D071A00219DFDB18DFA8D885BEEFBB5FF48314F104219E425AB6D0DB75A944CBA0

Function 00C149D0 Relevance: 6.3, APIs: 4, Instructions: 269memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 00C14A9A
SysFreeString.OLEAUT32(00000000), ref: 00C14AE6
SysFreeString.OLEAUT32(00000000), ref: 00C14B08
SysFreeString.OLEAUT32(00000000), ref: 00C14C63

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 8b79801662401c8c20ff6a65cadbc6209d6388c7cb621121ae7f9ce0bfcd4491
Instruction ID: d8ecd8a79ad975935aeac00c484f2270bef7d0d471d98aa012947c7ffa0dbc6a
Opcode Fuzzy Hash: 8b79801662401c8c20ff6a65cadbc6209d6388c7cb621121ae7f9ce0bfcd4491
Instruction Fuzzy Hash: 54A1A171A0460ADFDB18CFA9CC48FEEBBB8EF45314F104119E525E7280E7749A45DBA1

Function 00C30050 Relevance: 6.2, APIs: 4, Instructions: 246windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000001,0000110A,00000004,?), ref: 00C30125
SendMessageW.USER32(00000001,0000110A,00000001,00000000), ref: 00C30157
SendMessageW.USER32(?,0000110A,00000004,?), ref: 00C302CE
SendMessageW.USER32(?,0000110A,00000001,00000000), ref: 00C302F6

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f2614734757628b3d3a79e59bdbc18c83c4159a7004d2fe2ecff9c3a1a5c4296
Instruction ID: fdefc3e36580dc0633272b9bdce103535532956187a77833730d0a86a7af8adb
Opcode Fuzzy Hash: f2614734757628b3d3a79e59bdbc18c83c4159a7004d2fe2ecff9c3a1a5c4296
Instruction Fuzzy Hash: 9891AF72A10208DFCB25CF68D894FEEB7F5FF49710F244169E411AB291D731A945CBA0

Function 00D2AAD0 Relevance: 6.2, APIs: 4, Instructions: 199COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00D2AC21
GetForegroundWindow.USER32(?,00D330B9), ref: 00D2AC31
SetForegroundWindow.USER32(00000000), ref: 00D2AC6B

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

OutputDebugStringW.KERNEL32(?,6C34C19C,?,?,?,000000FF,?,00D330B9,?), ref: 00D2ACBF

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Window$ForegroundInit_thread_footer$ActiveDebugHeapOutputProcessString
String ID:
API String ID: 1401059542-0
Opcode ID: b6bee503964c9f99bfee140ffba1900fd1b64fcd1de4da38bf0c5a161df0223b
Instruction ID: 2eba14361eed11148136a8b24c928f0173b95568e89365600a7d29fe9daf4ead
Opcode Fuzzy Hash: b6bee503964c9f99bfee140ffba1900fd1b64fcd1de4da38bf0c5a161df0223b
Instruction Fuzzy Hash: 95613475A006158FDB04CB6CC808BAEBBB5EF45324F1882ADE815A73D2DB359D00DBA1

Function 00C1F260 Relevance: 6.2, APIs: 4, Instructions: 183windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,00000000), ref: 00C1F2F9
GetParent.USER32(?), ref: 00C1F319
SendMessageW.USER32(00000000,00000135,?,?), ref: 00C1F329
FillRect.USER32(?,00000000,00000000), ref: 00C1F337

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Rect$ClientFillMessageParentSend
String ID:
API String ID: 425900729-0
Opcode ID: 495b919b7da97e3f40e4001f1773329008ba6dd42d16629bc89cefd66d1c870e
Instruction ID: 1226a8f2aaf24997720f48886a7efd2621508a5d0a8bc1f1904c2ef497acd1e5
Opcode Fuzzy Hash: 495b919b7da97e3f40e4001f1773329008ba6dd42d16629bc89cefd66d1c870e
Instruction Fuzzy Hash: 64816B70A00219EFDB25CF64C948BDEBBB4FF09304F1081A9E559A7251DB71AE85DF50

Function 00C1D470 Relevance: 6.2, APIs: 4, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00C1D5A8
SysAllocString.OLEAUT32(00000000), ref: 00C1D5BB
VariantClear.OLEAUT32(00000000), ref: 00C1D5DD
VariantClear.OLEAUT32(?), ref: 00C1D60E

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ClearVariant$AllocString
String ID:
API String ID: 2502263055-0
Opcode ID: 666f63b4bd0b037483aee81bf20df5a37713a49b04fbaa93ce12ed1bea287d04
Instruction ID: ad51d729d1297baefa360465c447b8c1aa58c902b5a4f9a164b5e272918ab0a2
Opcode Fuzzy Hash: 666f63b4bd0b037483aee81bf20df5a37713a49b04fbaa93ce12ed1bea287d04
Instruction Fuzzy Hash: 6651A3B5A00218DFCB20CF64CC40BDAB7B5EF49714F1085A9EA19E7241D735EA85CF94

Function 00D32010 Relevance: 6.2, APIs: 4, Instructions: 164COMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNEL32(6C34C19C,00000000,00000000), ref: 00D32070
GetShortPathNameW.KERNEL32(?,80004005,?), ref: 00D320DE
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,00000000,00000000,?), ref: 00D3212E
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,00000000,00000000), ref: 00D32164

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ByteCharMultiNamePathShortWide
String ID:
API String ID: 3379522384-0
Opcode ID: 2701d5e8c3e07a7d3c4f5989e11a7cf75aaf66994661ab1150d780bc992de86a
Instruction ID: f48a676071a932d1c4abf5068193e735661f439ee75c3a4ff848f84377f0a0ea
Opcode Fuzzy Hash: 2701d5e8c3e07a7d3c4f5989e11a7cf75aaf66994661ab1150d780bc992de86a
Instruction Fuzzy Hash: D951AC71A00606AFDB14CF68DD89B6EF7B5FF84320F10866CF525AB291DB71A800CB60

Function 00D4ACF0 Relevance: 6.2, APIs: 4, Instructions: 157registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,6C34C19C), ref: 00D4AD66
_wcsrchr.LIBVCRUNTIME ref: 00D4AD90
RegQueryValueExW.ADVAPI32(00000000,6C34C19C,00000000,00000000,00000000,00000000,6C34C19C,00000001,?,00000000,00000000), ref: 00D4AE13
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00D4AE5F

Part of subcall function 00D4AC10: RegOpenKeyExW.ADVAPI32(00000000,6C34C19C,00000000,00020019,00000002,6C34C19C,00000001,00000010,00000002,00D49F3C,6C34C19C,00000000,00000000), ref: 00D4ACAC

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Close$OpenQueryValue_wcsrchr
String ID:
API String ID: 213811329-0
Opcode ID: 128de120def85a01d15f92db757feed461ec353ce44f57292f65957369bfb119
Instruction ID: c38b9ccc9c926f8f93b019b4f95b0b905e2893b79f850333f49b2dbb8cd0746b
Opcode Fuzzy Hash: 128de120def85a01d15f92db757feed461ec353ce44f57292f65957369bfb119
Instruction Fuzzy Hash: 5751F471A413499FDB10CF68C945B9EBBB8EF85720F14826AEC21A73D0D7759A04CBA0

Function 00C337F0 Relevance: 6.1, APIs: 4, Instructions: 107windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000C5,?,00000000), ref: 00C3383B
GetClientRect.USER32(?,?), ref: 00C3386D
GetDC.USER32(?), ref: 00C33880
GetDeviceCaps.GDI32(00000000), ref: 00C33887

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CapsClientDeviceMessageRectSend
String ID:
API String ID: 3507044913-0
Opcode ID: a89ef037d5c44f45b438785cf2c09276c455dc03e26a4a8d0137c5ae060d1e52
Instruction ID: 5f47c37ee6fc307dfeb3117e26fc280817b6deca4bdc3be6335d25c832470bff
Opcode Fuzzy Hash: a89ef037d5c44f45b438785cf2c09276c455dc03e26a4a8d0137c5ae060d1e52
Instruction Fuzzy Hash: 8341AF312143449FE721DF39CC06F9AB7E4BF88300F004A29F599E71A1DB71A959CB92

Function 00C1FD50 Relevance: 6.1, APIs: 4, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00C1FDA9
GetLastError.KERNEL32 ref: 00C1FDDD
SendMessageW.USER32(?,00000317,00000000,00000006), ref: 00C1FE09
SendMessageW.USER32(?,00000318,?,00000006), ref: 00C1FE67

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: MessageSend$ClientErrorLastRect
String ID:
API String ID: 2591167063-0
Opcode ID: f305c55868967cd4afd3fb768d5913b2d00c968404bf8b0a8917dc7f26f3151b
Instruction ID: 4bb095c15d4b2556702be9014dd8c2835d300874c069c947f92575c3bc166bc2
Opcode Fuzzy Hash: f305c55868967cd4afd3fb768d5913b2d00c968404bf8b0a8917dc7f26f3151b
Instruction Fuzzy Hash: EA31B130504708AFE721DF25CC49BEABBF4EF05710F10466DF562A62E1C775A986DB10

Function 00D64C50 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00D64C9A
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D64CAD
GetDC.USER32(00000000), ref: 00D64D07
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D64D1A

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CapsDevice
String ID:
API String ID: 328075279-0
Opcode ID: d97d8f66f63908b06391a345f7d7e4a953fbe953c579e6e2a85733a5e7854446
Instruction ID: 1c631f1bdee70bd1388ba06c55e53bbbca9e3d7ee0b1fa6ea570524d07c9983e
Opcode Fuzzy Hash: d97d8f66f63908b06391a345f7d7e4a953fbe953c579e6e2a85733a5e7854446
Instruction Fuzzy Hash: 1731AFB2914A14AFD702DF75DC46B5ABBB8FF093A5F108326E425F3291EB705805CB60

Function 00C15660 Relevance: 6.1, APIs: 4, Instructions: 84windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00C15714
IsChild.USER32(?,00000000), ref: 00C1571E
GetWindow.USER32(?,00000005), ref: 00C1572D
SetFocus.USER32(00000000), ref: 00C15734

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Focus$ChildWindow
String ID:
API String ID: 501040988-0
Opcode ID: 9703d36806f3f82568c7354e82ea2f80785cd776e9d9b751061041111affc023
Instruction ID: c61028f4879cfda51cfb2cd9913747139440b2cd5ca6ce00998ee927e56fcdd8
Opcode Fuzzy Hash: 9703d36806f3f82568c7354e82ea2f80785cd776e9d9b751061041111affc023
Instruction Fuzzy Hash: 4F31AC70600A06EFDB14CF64CD4AFAAB7B9FF4A710F108269E425D72D0DB75A954CB90

Function 00C229D0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,6C34C19C), ref: 00C22A3A
EnterCriticalSection.KERNEL32(?,6C34C19C), ref: 00C22A47
LeaveCriticalSection.KERNEL32(?), ref: 00C22A98

Strings

v, xrefs: 00C22A98

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: cf7687befe59f513a69ed9d36ca286ae30c2e7c1ab7460618496042a47ac1f80
Instruction ID: 21a81254d232f89f45cb179baabf15a386bd1b95c25a0152584f21c558298b65
Opcode Fuzzy Hash: cf7687befe59f513a69ed9d36ca286ae30c2e7c1ab7460618496042a47ac1f80
Instruction Fuzzy Hash: 8221B176900254AFDF11CF64D844BD9BBB4EF16324F5001A9E855AB782C732590ADB60

Function 00C22AC0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,6C34C19C), ref: 00C22B2A
EnterCriticalSection.KERNEL32(?,6C34C19C), ref: 00C22B37
LeaveCriticalSection.KERNEL32(?), ref: 00C22B7E

Strings

v, xrefs: 00C22B7E

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: a24f4df19b2552fdf432aee215de3eb11109e1565d8c7037005f91ff54b3d485
Instruction ID: f98b9c98d1ee80f7b1100030c8722ac94ddd7b2a6d333d1fc81f4f40bf31a076
Opcode Fuzzy Hash: a24f4df19b2552fdf432aee215de3eb11109e1565d8c7037005f91ff54b3d485
Instruction Fuzzy Hash: 7021C1769002449FDF11CF24DC44BD9BBB4FF16324F1005A9EC59AB382D7326A0ACBA0

Function 00D52FF0 Relevance: 6.1, APIs: 4, Instructions: 62synchronizationCOMMON

Download Yara Rule

APIs

ResetEvent.KERNEL32(?,?,?,00D52422,?,?,?,?,?,00000003,00000000,6C34C19C,00000000), ref: 00D53002
GetLastError.KERNEL32(?,?,?,00D52422,?,?,?,?,?,00000003,00000000,6C34C19C,00000000), ref: 00D5302F
WaitForSingleObject.KERNEL32(?,0000000A,?,?,?,00D52422,?,?,?,?,?,00000003,00000000,6C34C19C,00000000), ref: 00D53065
SetEvent.KERNEL32(?,?,?,?,00D52422,?,?,?,?,?,00000003,00000000,6C34C19C,00000000), ref: 00D53088

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Event$ErrorLastObjectResetSingleWait
String ID:
API String ID: 708712559-0
Opcode ID: 43ed6ba30ccf74b20e99bbd51aa05308f85366d1a0b2f7ca05d623fff3d37ab9
Instruction ID: ec0fdf98001968666c63082993fce2cbacce3862942996d440c7d4810fadd83b
Opcode Fuzzy Hash: 43ed6ba30ccf74b20e99bbd51aa05308f85366d1a0b2f7ca05d623fff3d37ab9
Instruction Fuzzy Hash: 281191312047448FDF319F2ED948B57BBE1AB50362F08481DEC82935A6C3A1ED99CB60

Function 00C22910 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,6C34C19C,?), ref: 00C2296D
EnterCriticalSection.KERNEL32(?,6C34C19C,?), ref: 00C2297A
LeaveCriticalSection.KERNEL32(?), ref: 00C229A2

Strings

v, xrefs: 00C229A2

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: b8979666e5ff4349fe5129ffec9adbc7acf3e14b4809ebfaabf6791b45ee923c
Instruction ID: 31486d299ce8e6378fd3d741636cac88d8c78b22135f4a48317ba725ddfe15f7
Opcode Fuzzy Hash: b8979666e5ff4349fe5129ffec9adbc7acf3e14b4809ebfaabf6791b45ee923c
Instruction Fuzzy Hash: FA21E4769043989FCF01DF24D844BE9BF74EB56324F1001A9D865A7382C7325A09CBA0

Function 00D5EDB0 Relevance: 6.0, APIs: 4, Instructions: 44threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,?,6C34C19C,?,?,00000000,00DDC4E0,000000FF,00000000,00D5ED98,00000000,C000008C,00000001,00000000,?), ref: 00D5EDE7
GetExitCodeThread.KERNEL32(00000000,6C34C19C,?,?,00000000,00DDC4E0,000000FF,00000000,00D5ED98,00000000,C000008C,00000001,00000000,?,?,?), ref: 00D5EE01
TerminateThread.KERNEL32(00000000,00000000,?,?,00000000,00DDC4E0,000000FF,00000000,00D5ED98,00000000,C000008C,00000001,00000000,?,?,?), ref: 00D5EE19
CloseHandle.KERNEL32(00000000,?,?,00000000,00DDC4E0,000000FF,00000000,00D5ED98,00000000,C000008C,00000001,00000000,?,?,?,80004005), ref: 00D5EE22

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Thread$CloseCodeExitHandleObjectSingleTerminateWait
String ID:
API String ID: 3774109050-0
Opcode ID: 8df121a469de7b63f4ef6a1c5238db263436db86e17f19ef2d51aa92ec2eb54e
Instruction ID: 632e42430453aa8e70564e8ce19d38b0a018e653459298c87de9288414f06225
Opcode Fuzzy Hash: 8df121a469de7b63f4ef6a1c5238db263436db86e17f19ef2d51aa92ec2eb54e
Instruction Fuzzy Hash: 7B01D231500619DFCB288F55CD09B66BBF8FB04711F004629FC26E26A0D7B0A914CE60

Function 00C0AF20 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 455synchronizationCOMMON

Download Yara Rule

APIs

CreateEventExW.KERNEL32(00000000,00000000,00000001,001F0003,?,?,?,6C34C19C), ref: 00C0B448
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00C0B49E

Strings

.appinstaller, xrefs: 00C0AF7D

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CreateEventObjectSingleWait
String ID: .appinstaller
API String ID: 2678385144-3071040812
Opcode ID: 836f5b98a44e7cccb41383d3de114d35f9d9daf26d8004db67853c21a06115b1
Instruction ID: 478e158d4b0256db19fbf2f6d948cfb3741ed3a4ca69dce164532f43e6725e90
Opcode Fuzzy Hash: 836f5b98a44e7cccb41383d3de114d35f9d9daf26d8004db67853c21a06115b1
Instruction Fuzzy Hash: C2227CB080128CDEDF05DFA8C9587DD7BB4AF11308F248199E911672D2DBB99F48EB51

Function 00C13060 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 231windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AtlAxWin140,?,?,?,80000000,00000000,00000000,?,00000000,00000000), ref: 00C130D6
SendMessageW.USER32(?,00000000,00000000), ref: 00C131D2

Part of subcall function 00C14BC0: SysFreeString.OLEAUT32(00000000), ref: 00C14C63

Strings

AtlAxWin140, xrefs: 00C130CE

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CreateFreeMessageSendStringWindow
String ID: AtlAxWin140
API String ID: 4045344427-3842940177
Opcode ID: b1bb2e8cdb584e7a10b130982dd2cb8dea0fbbd430642ce42b3b7b45a89a77fe
Instruction ID: 9248bebc8d6d5891d10dcdb7aa128be5a5bcb8cf969f88369cf1b32e3de0b0af
Opcode Fuzzy Hash: b1bb2e8cdb584e7a10b130982dd2cb8dea0fbbd430642ce42b3b7b45a89a77fe
Instruction Fuzzy Hash: 8D913774600204EFDB14DF68C888F9ABBB9FF49714F2085A8F8299B391C771EA45DB50

Function 00DC871D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMONLIBRARYCODE

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00DC87AD

Strings

pow, xrefs: 00DC8785, 00DC87A2

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 31b6c0a103ef520e36e2beebd547a002949384708aa0d645ad6f300fd4b95c0c
Instruction ID: f56e9038b987da85c92b67f8ee69436f0c10407317985c820fcb4e4df62a490d
Opcode Fuzzy Hash: 31b6c0a103ef520e36e2beebd547a002949384708aa0d645ad6f300fd4b95c0c
Instruction Fuzzy Hash: 635109719082079ACB217714DD05F7A6B94DB60700F38496EE0E5433E9FE35CC95AA76

Function 00D0D5D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 192COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,6C34C19C), ref: 00D0D671

Strings

\\?\UNC\, xrefs: 00D0D698, 00D0D6F9
\\?\, xrefs: 00D0D7B3, 00D0D7DE

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Path
String ID: \\?\$\\?\UNC\
API String ID: 2875597873-3019864461
Opcode ID: 97e2414d3221f96afda021b1a2156e516d23ed221f956e794b215a119fc6985f
Instruction ID: d6870e7cc9c426c3faa5b0c01d1eaade353c5c06d3e76fc54489e61038fbc6b0
Opcode Fuzzy Hash: 97e2414d3221f96afda021b1a2156e516d23ed221f956e794b215a119fc6985f
Instruction Fuzzy Hash: 4861D3B09002049BDB14DFA8D885BAEB7F6FF84304F10851DE45AA72C1DB75A944CBB1

Function 00D4CB90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

CloseHandle.KERNEL32(?,6C34C19C,000000C9,00000000), ref: 00D4CD13
DeleteCriticalSection.KERNEL32(?,6C34C19C,000000C9,00000000), ref: 00D4CDA1

Strings

<< Advanced Installer (x86) Log >>, xrefs: 00D4CC7F

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Init_thread_footer$CloseCriticalDeleteHandleHeapProcessSection
String ID: << Advanced Installer (x86) Log >>
API String ID: 3699736680-396061572
Opcode ID: 7df96e9f9ccd58a03a7d6e6f601fc3efbde28b90269d8c3cc792adb07a8ae67c
Instruction ID: 6343d5312d737f52e3784574a05fba790b13f9a621a97bda52fb43933bc38d3e
Opcode Fuzzy Hash: 7df96e9f9ccd58a03a7d6e6f601fc3efbde28b90269d8c3cc792adb07a8ae67c
Instruction Fuzzy Hash: AB61CF70901685DFDB01CF6DC949B5EBBF0EF85314F1482ADE404AB792DB769A09CB90

Function 00D53110 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00C09CC0: GetProcessHeap.KERNEL32 ref: 00C09D15
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09D47
Part of subcall function 00C09CC0: __Init_thread_footer.LIBCMT ref: 00C09DD2

GetLastError.KERNEL32(?,00000000,FTP Server,0000000A), ref: 00D53194
WaitForSingleObject.KERNEL32(?,0000000A,?,00000000,FTP Server,0000000A), ref: 00D531CD

Strings

REST %u, xrefs: 00D53161

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Init_thread_footer$ErrorHeapLastObjectProcessSingleWait
String ID: REST %u
API String ID: 1670056567-3183379045
Opcode ID: ab03ee1290c8acad1b63cd37f27a9449692cae768dd5e5b959a3f3187b28b535
Instruction ID: 4acbd2fbed5ad92c2339bbf3718097c6edabb5ef0f02f279ef305136281f6400
Opcode Fuzzy Hash: ab03ee1290c8acad1b63cd37f27a9449692cae768dd5e5b959a3f3187b28b535
Instruction Fuzzy Hash: BF510431600B049FDB20CB69CC44B5AB7E4FF41365F184628EC56DB6A1DB71EE48CB60

Function 00D6F900 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 147COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00000000,00000000,00000000,_pbl_evt,00000008,?,?,00E5BE58,00000001,6C34C19C,00000000), ref: 00D6F9AE
CreateEventW.KERNEL32(00000000,00000001,00000001,?), ref: 00D6F9CB

Strings

_pbl_evt, xrefs: 00D6F982

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Event$CreateOpen
String ID: _pbl_evt
API String ID: 2335040897-4023232351
Opcode ID: 87c541d18a3d402566fa42773fea2df89fe33013dcde4b3420597ce6bdcd90cd
Instruction ID: 131796fd8468344a20f50b30e02840941cfdf87a0f6cde97efe05e4f410dc944
Opcode Fuzzy Hash: 87c541d18a3d402566fa42773fea2df89fe33013dcde4b3420597ce6bdcd90cd
Instruction Fuzzy Hash: D5517C71D10618EFDB14DFA8D946BEEB7B4EF09714F108269E915B72C0EB746A04CBA0

Function 00D4DEE0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,6C34C19C,?,?,00EC9384), ref: 00D4DF1F
CreateDirectoryW.KERNEL32(?,00000000,?,00EC9384), ref: 00D4DF80

Strings

ADVINST_LOGS, xrefs: 00D4DF58

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CreateDirectoryPathTemp
String ID: ADVINST_LOGS
API String ID: 2885754953-2492584244
Opcode ID: ade88abf570244316147a5cebcfa069ac3654d2903609c25283d6d620371dd0b
Instruction ID: 340720b4416ba12dd1a312c553a5c4ee4b1935a684d5997536139ba230a8f82a
Opcode Fuzzy Hash: ade88abf570244316147a5cebcfa069ac3654d2903609c25283d6d620371dd0b
Instruction Fuzzy Hash: 5D51E675900259DBCF309F28C8447BAB3F4FF14714F1846AEE85A97291EB749D85CBA0

Function 00D23620 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000013FF,00000000,?,00000000,00000000,00000000,00000000,6C34C19C,00E5B190), ref: 00D23678
LocalFree.KERNEL32(00000000,00000000,-00000002), ref: 00D23782

Part of subcall function 00D13110: std::locale::_Init.LIBCPMT ref: 00D131ED

Part of subcall function 00D10BA0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00D10C75

Strings

Failed to get Windows error message [win32 error 0x, xrefs: 00D23696

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: FormatFreeInitIos_base_dtorLocalMessagestd::ios_base::_std::locale::_
String ID: Failed to get Windows error message [win32 error 0x
API String ID: 1983821583-3373098694
Opcode ID: 5d42f561fed21a83cca09630a53d3a4b16ee16ecb471ee194fc423fa114aaf73
Instruction ID: 108482dcb871549371fe970e9d90c27c7b9ca3c83e619d4f58f8a41b3d1bad75
Opcode Fuzzy Hash: 5d42f561fed21a83cca09630a53d3a4b16ee16ecb471ee194fc423fa114aaf73
Instruction Fuzzy Hash: 114191B0A003199BDB10DF68D909BAFBBF8FF44704F144559E455EB290D7B8AB48CBA1

Function 00C45300 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00C4532B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00C4538E

Strings

bad locale name, xrefs: 00C453B1

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 90433fd7cb829464312b5cb687e3c755582a6c39aa6a44780f70f3bc3702b312
Instruction ID: 67848f022ee868655eacac11279da2b0c50b94fbac42e4023aebdeefc468c842
Opcode Fuzzy Hash: 90433fd7cb829464312b5cb687e3c755582a6c39aa6a44780f70f3bc3702b312
Instruction Fuzzy Hash: 7621E070A05B84DFD720CF69C90475ABBF4AF15300F14869DE45597B82D3B5AA08C7A1

Function 00C278C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

GetParent.USER32(00000013), ref: 00C278F6

Strings

Unknown exception, xrefs: 00C278CB
C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 00C278DB

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: Parent
String ID: C:\ReleaseAI\stubs\setup\controls\generic\VisualStyleBorder.h$Unknown exception
API String ID: 975332729-9186675
Opcode ID: b5f9c342cb469abedd440cc6068ea99955296f8ffbca4a496fa3d83f502edc3a
Instruction ID: b39c9011b31806e31c16dbd89a5513ef47958f35ce1d884f37dcca08e7a6ccc1
Opcode Fuzzy Hash: b5f9c342cb469abedd440cc6068ea99955296f8ffbca4a496fa3d83f502edc3a
Instruction Fuzzy Hash: 0E016130D05348EFDF04DBE4D919ADDBBB0AF55300F548198E4017B296DBB55E08EB91

Function 00C12C06 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00C12C36

Strings

Unknown exception, xrefs: 00C12C0E
C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00C12C21

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-2631306498
Opcode ID: f861ec29a5f277ad928f24053154c661c099a3eb95e568fff0756bd04dca1086
Instruction ID: c10ec7cd216d710800fce3b29cdaea8cbb62aed2605bd82762d22379ede727e6
Opcode Fuzzy Hash: f861ec29a5f277ad928f24053154c661c099a3eb95e568fff0756bd04dca1086
Instruction Fuzzy Hash: 83018030D05388EBDF05EBE8C9156DDBFB0AF56304F548198D0017B296DBB45A08E792

Function 00C12812 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00C1283F

Strings

Unknown exception, xrefs: 00C1281A
C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00C1282A

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\ReleaseAI\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-2631306498
Opcode ID: 74fb2ae507ecb4ede91fcef38779dd3bdc404ea2723f934cf29531a22e7a8207
Instruction ID: ee9504b8b929c4a304fca6c13145c85c225b07f47433ab74e1251f3484723b40
Opcode Fuzzy Hash: 74fb2ae507ecb4ede91fcef38779dd3bdc404ea2723f934cf29531a22e7a8207
Instruction Fuzzy Hash: A5019E30D05388EBDF05DBE8D9196DDBFB0AF56304F548198E0027B2C6DBB45A08E7A2

Function 00DB3EC1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00C19260: InitializeCriticalSectionAndSpinCount.KERNEL32(00EC7F5C,00000000,6C34C19C,00C00000,Function_001DC6B0,000000FF,?,00DB3EF0,?,?,?,00C06508), ref: 00C19285
Part of subcall function 00C19260: GetLastError.KERNEL32(?,00DB3EF0,?,?,?,00C06508), ref: 00C1928F

IsDebuggerPresent.KERNEL32(?,?,?,00C06508), ref: 00DB3EF4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00C06508), ref: 00DB3F03

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00DB3EFE

Memory Dump Source

Source File: 00000000.00000002.2085031859.0000000000C01000.00000020.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.2085004449.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085230046.0000000000E39000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085306807.0000000000EC1000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085447770.0000000000EC6000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085475566.0000000000EC7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2085507674.0000000000ECA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_Installer eSPT Masa PPh versi 2.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 450123788-631824599
Opcode ID: 55c4248777a1e745d76bd79433532323051402e5a086f9e36d60b71d0d82b866
Instruction ID: 737b2104dfae78afeaec477cdf0e8b3418df811a8e7b8ce19c8f536f710e30b6
Opcode Fuzzy Hash: 55c4248777a1e745d76bd79433532323051402e5a086f9e36d60b71d0d82b866
Instruction Fuzzy Hash: B6E06D706007118FC7209F2AE509792BEF4AF08304F04886CE486E3651EBB5D588DBB2

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\5a2ae3.rbs

C:\Program Files (x86)\BtDDIFUEHLCR\7z.dll

C:\Program Files (x86)\BtDDIFUEHLCR\Gme.dll

C:\Program Files (x86)\BtDDIFUEHLCR\GmeApi.dll

C:\Program Files (x86)\BtDDIFUEHLCR\GmeApi64.dll

C:\Program Files (x86)\BtDDIFUEHLCR\HackPatch.dll

C:\Program Files (x86)\BtDDIFUEHLCR\Hamster.dll

C:\Program Files (x86)\BtDDIFUEHLCR\HipsLogCenter.dll

C:\Program Files (x86)\BtDDIFUEHLCR\HotfixCommon.dll

C:\Program Files (x86)\BtDDIFUEHLCR\HotfixCommon64.dll

C:\Program Files (x86)\BtDDIFUEHLCR\ImAVEng.dll

C:\Program Files (x86)\BtDDIFUEHLCR\LeakFixHelper.dll

C:\Program Files (x86)\BtDDIFUEHLCR\LeakFixHelper64.dll

C:\Program Files (x86)\BtDDIFUEHLCR\LiveUpd360.dll

C:\Program Files (x86)\BtDDIFUEHLCR\MiniUI.dll

Windows Analysis Report
Installer eSPT Masa PPh versi 2.0#U007e26022009.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre