Edit tour

Windows Analysis Report
NkMMNoILv9.exe

Overview

General Information

Sample name:	NkMMNoILv9.exe renamed because original name is a hash value
Original sample name:	94722be5aa4e12860a09965f78ee60aa.exe
Analysis ID:	1583337
MD5:	94722be5aa4e12860a09965f78ee60aa
SHA1:	2cfa52ca0545d9880eff2d1b7bafb5e65773b810
SHA256:	0b00372bfe0e6acd0cb66e8fd916168886052cccc50b9bf47c725f492f88dd61
Tags:	exeuser-abuse_ch
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Machine Learning detection for dropped file

Tries to detect virtualization through RDTSC time measurements

AV process strings found (often used to terminate AV products)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to read the PEB

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Use Short Name Path in Command Line

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

NkMMNoILv9.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\NkMMNoILv9.exe" MD5: 94722BE5AA4E12860A09965F78EE60AA)

NkMMNoILv9.tmp (PID: 7336 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp" /SL5="$2044A,4113998,776192,C:\Users\user\Desktop\NkMMNoILv9.exe" MD5: F7500A6E24D1453EDC7080EDE00360E9)

AviDVDCopy.exe (PID: 7708 cmdline: "C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe" MD5: DA7C7C802E2164A70B460B5163AFDEC4)

WerFault.exe (PID: 7844 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7708 -s 848 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Sigma Signatures

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp" /SL5="$2044A,4113998,776192,C:\Users\user\Desktop\NkMMNoILv9.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp" /SL5="$2044A,4113998,776192,C:\Users\user\Desktop\NkMMNoILv9.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp, NewProcessName: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp, OriginalFileName: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp, ParentCommandLine: "C:\Users\user\Desktop\NkMMNoILv9.exe", ParentImage: C:\Users\user\Desktop\NkMMNoILv9.exe, ParentProcessId: 7284, ParentProcessName: NkMMNoILv9.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp" /SL5="$2044A,4113998,776192,C:\Users\user\Desktop\NkMMNoILv9.exe" , ProcessId: 7336, ProcessName: NkMMNoILv9.tmp

Suricata Signatures

ETPRO MALWARE FinderBot Loader - CnC Activity M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T13:54:13.367176+0100	2840690	1	Malware Command and Control Activity Detected	192.168.2.7	49699	103.224.212.212	443	TCP

ETPRO MALWARE FinderBot Loader - CnC Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T13:54:14.519026+0100	2840691	1	Malware Command and Control Activity Detected	192.168.2.7	49700	103.224.212.212	443	TCP

ETPRO MALWARE Observed FinderBot CnC Domain in TLS SNI

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-02T13:54:13.141411+0100	2844648	1	Domain Observed Used for C2 Detected	192.168.2.7	49699	103.224.212.212	443	TCP
2025-01-02T13:54:14.271490+0100	2844648	1	Domain Observed Used for C2 Detected	192.168.2.7	49700	103.224.212.212	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: NkMMNoILv9.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://ww25.mastergamenameper.club/installers/pp?subid1=20250102-2354-13c6-af36-174aa28c07b8	Avira URL Cloud: Label: malware
Source: http://ww25.mastergamenameper.club/log?subid1=20250102-2354-145f-aab7-442a1121e9f0	Avira URL Cloud: Label: malware
Source: https://mastergamenameper.club/installers/pp	Avira URL Cloud: Label: malware
Source: http://ww25.mastergamenameper.club/ins	Avira URL Cloud: Label: malware
Source: https://mastergamenameper.club/log	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Program Files (x86)\YCI Copy\is-IAPSA.tmp

Avira: detection malicious, Label: HEUR/AGEN.1317240

Multi AV Scanner detection for dropped file

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe (copy)	ReversingLabs: Detection: 79%
Source: C:\Program Files (x86)\YCI Copy\is-IAPSA.tmp	ReversingLabs: Detection: 79%

Multi AV Scanner detection for submitted file

Source: NkMMNoILv9.exe	Virustotal: Detection: 54%			Perma Link
Source: NkMMNoILv9.exe	ReversingLabs: Detection: 42%

Machine Learning detection for dropped file

Source: C:\Program Files (x86)\YCI Copy\is-IAPSA.tmp

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Code function: 2_2_10001000 ISCryptGetVersion,		2_2_10001000
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Code function: 2_2_10001130 ArcFourCrypt,		2_2_10001130

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe

Unpacked PE file: 8.2.AviDVDCopy.exe.400000.0.unpack

Source: NkMMNoILv9.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 103.224.212.212:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.224.212.212:443 -> 192.168.2.7:49700 version: TLS 1.2

Source: NkMMNoILv9.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2844648 - Severity 1 - ETPRO MALWARE Observed FinderBot CnC Domain in TLS SNI : 192.168.2.7:49699 -> 103.224.212.212:443
Source: Network traffic	Suricata IDS: 2844648 - Severity 1 - ETPRO MALWARE Observed FinderBot CnC Domain in TLS SNI : 192.168.2.7:49700 -> 103.224.212.212:443
Source: Network traffic	Suricata IDS: 2840690 - Severity 1 - ETPRO MALWARE FinderBot Loader - CnC Activity M1 : 192.168.2.7:49699 -> 103.224.212.212:443
Source: Network traffic	Suricata IDS: 2840691 - Severity 1 - ETPRO MALWARE FinderBot Loader - CnC Activity M2 : 192.168.2.7:49700 -> 103.224.212.212:443

Source: Joe Sandbox View

IP Address: 103.224.212.212 103.224.212.212

Source: Joe Sandbox View

ASN Name: TRELLIAN-AS-APTrellianPtyLimitedAU TRELLIAN-AS-APTrellianPtyLimitedAU

Source: Joe Sandbox View

JA3 fingerprint: fd80fa9c6120cdeea8520510f3c644ac

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mastergamenameper.club

Source: unknown

HTTP traffic detected: POST /installers/pp HTTP/1.1Host: mastergamenameper.clubUser-Agent: undefinedContent-Type: application/jsonAccept: application/jsonX-Data: {"cid":1,"ibc":"64bit","idid":"","iid":"1735822451","it":"","iv":500.0,"ivm":"0","pid":7708,"wkv":"10.0.19041.1889","wpv":"10.0.19041.1889"}Content-Length: 10380

Source: Amcache.hve.11.dr	String found in binary or memory: http://upx.sf.net
Source: AviDVDCopy.exe, 00000008.00000003.1308864776.0000000001767000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1491532365.0000000001769000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1309022282.0000000001767000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.mastergamenameper.club/ins
Source: AviDVDCopy.exe, 00000008.00000003.1299676858.000000000175B000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1299459575.0000000001764000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1298004915.000000000175F000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1299571396.000000000175B000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1299676858.0000000001766000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1298004915.000000000175B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.mastergamenameper.club/installers/pp?subid1=20250102-2354-13c6-af36-174aa28c07b8
Source: AviDVDCopy.exe, 00000008.00000002.1491404846.000000000172F000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1308864776.0000000001767000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1491532365.000000000175B000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1309022282.0000000001767000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ww25.mastergamenameper.club/log?subid1=20250102-2354-145f-aab7-442a1121e9f0
Source: is-H0QO1.tmp.2.dr	String found in binary or memory: http://www.WinAVI.com
Source: is-H0QO1.tmp.2.dr	String found in binary or memory: http://www.WinAVI.comKSLIBCREATOR_SHARE_MEMORYSoftware
Source: is-H0QO1.tmp.2.dr	String found in binary or memory: http://www.WinAVI.comhelp
Source: is-H0QO1.tmp.2.dr	String found in binary or memory: http://www.WinAVI.comhttp://www.WinAVI.comAffiliateNow.dll_OpenAffiliatePage
Source: is-H0QO1.tmp.2.dr	String found in binary or memory: http://www.WinAVI.comopenhttp://www.WinAVI.comTMenuTWinControlOpenMediaMenu..HintTWinControlTForm.Fo
Source: is-H0QO1.tmp.2.dr	String found in binary or memory: http://www.WinAVI.comopenhttp://www.WinAVI.comopenhttps://sshop.element5.com/esales/checkout.html?PR
Source: is-H0QO1.tmp.2.dr	String found in binary or memory: http://www.WinAVI.comopenhttps://sshop.element5.com/esales/checkout.html?PRODUCT
Source: is-H0QO1.tmp.2.dr	String found in binary or memory: http://www.WinAVI.comopenmailto:support
Source: NkMMNoILv9.exe, 00000000.00000003.1259298076.0000000002510000.00000004.00001000.00020000.00000000.sdmp, NkMMNoILv9.exe, 00000000.00000003.1259638971.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp, NkMMNoILv9.tmp, 00000002.00000000.1261152615.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-OE9O8.tmp.2.dr, NkMMNoILv9.tmp.0.dr	String found in binary or memory: http://www.innosetup.com/
Source: AviDVDCopy.exe, 00000008.00000002.1491668952.0000000003110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: NkMMNoILv9.exe, 00000000.00000003.1259298076.0000000002510000.00000004.00001000.00020000.00000000.sdmp, NkMMNoILv9.exe, 00000000.00000003.1259638971.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp, NkMMNoILv9.tmp, 00000002.00000000.1261152615.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-OE9O8.tmp.2.dr, NkMMNoILv9.tmp.0.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: is-T33OF.tmp.2.dr	String found in binary or memory: http://www.winavi.com
Source: is-2BLD0.tmp.2.dr	String found in binary or memory: http://www.winavi.com.
Source: NkMMNoILv9.tmp, 00000002.00000002.1493771634.0000000002413000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.winavi.com03A
Source: is-H0QO1.tmp.2.dr	String found in binary or memory: http://www.winavi.comhttp://www.winavi.com
Source: NkMMNoILv9.exe, 00000000.00000003.1496765420.0000000002264000.00000004.00001000.00020000.00000000.sdmp, NkMMNoILv9.tmp, 00000002.00000002.1493771634.0000000002404000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.yci.com
Source: NkMMNoILv9.exe, 00000000.00000003.1258414186.0000000002510000.00000004.00001000.00020000.00000000.sdmp, NkMMNoILv9.tmp, 00000002.00000003.1262734153.0000000003400000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.yci.com$http://www.yci.com$http://www.yci.com
Source: NkMMNoILv9.exe, 00000000.00000003.1496765420.0000000002264000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.yci.com9P&
Source: AviDVDCopy.exe, AviDVDCopy.exe, 00000008.00000002.1491916716.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, AviDVDCopy.exe, 00000008.00000002.1491668952.0000000003110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: AviDVDCopy.exe, 00000008.00000002.1491916716.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, AviDVDCopy.exe, 00000008.00000002.1491668952.0000000003110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crxversion6.1.6needs_syncnever_activated_since_loadedpat
Source: NkMMNoILv9.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: is-H0QO1.tmp.2.dr	String found in binary or memory: https://sshop.element5.com/esales/checkout.html?PRODUCT
Source: AviDVDCopy.exe, AviDVDCopy.exe, 00000008.00000002.1491916716.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, AviDVDCopy.exe, 00000008.00000002.1491668952.0000000003110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://test.com/
Source: AviDVDCopy.exe, 00000008.00000002.1491916716.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, AviDVDCopy.exe, 00000008.00000002.1491668952.0000000003110000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://test.com/session.restore_on_startupsession.startup_urlssuper_mac

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443

Source: unknown	HTTPS traffic detected: 103.224.212.212:443 -> 192.168.2.7:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 103.224.212.212:443 -> 192.168.2.7:49700 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Windows\is-O6HFG.tmp			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Windows\SysWOW64\is-60UJ3.tmp			Jump to behavior

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_0040321D	8_2_0040321D
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_609660FA	8_2_609660FA
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6092114F	8_2_6092114F
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6091F2C9	8_2_6091F2C9
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6096923E	8_2_6096923E
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6093323D	8_2_6093323D
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6095C314	8_2_6095C314
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60950312	8_2_60950312
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6094D33B	8_2_6094D33B
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6093B368	8_2_6093B368
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6096748C	8_2_6096748C
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6093F42E	8_2_6093F42E
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60954470	8_2_60954470
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_609615FA	8_2_609615FA
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6096A5EE	8_2_6096A5EE
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6096D6A4	8_2_6096D6A4
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_609606A8	8_2_609606A8
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60932654	8_2_60932654
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60955665	8_2_60955665
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6094B7DB	8_2_6094B7DB
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6092F74D	8_2_6092F74D
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60964807	8_2_60964807
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6094E9BC	8_2_6094E9BC
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60937929	8_2_60937929
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6093FAD6	8_2_6093FAD6
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6096DAE8	8_2_6096DAE8
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6094DA3A	8_2_6094DA3A
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60936B27	8_2_60936B27
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60954CF6	8_2_60954CF6
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60950C6B	8_2_60950C6B
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60966DF1	8_2_60966DF1
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60963D35	8_2_60963D35
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60909E9C	8_2_60909E9C
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60951E86	8_2_60951E86
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60912E0B	8_2_60912E0B
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60954FF8	8_2_60954FF8

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7708 -s 848

Source: NkMMNoILv9.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-OE9O8.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: is-60UJ3.tmp.2.dr

Static PE information: Number of sections : 19 > 10

Source: NkMMNoILv9.exe, 00000000.00000003.1496765420.0000000002238000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs NkMMNoILv9.exe
Source: NkMMNoILv9.exe, 00000000.00000003.1259298076.0000000002510000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs NkMMNoILv9.exe
Source: NkMMNoILv9.exe, 00000000.00000003.1259638971.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs NkMMNoILv9.exe
Source: NkMMNoILv9.exe, 00000000.00000000.1258103757.00000000004C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs NkMMNoILv9.exe
Source: NkMMNoILv9.exe	Binary or memory string: OriginalFileName vs NkMMNoILv9.exe

Source: NkMMNoILv9.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: is-IAPSA.tmp.2.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.evad.winEXE@6/69@1/1

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp

File created: C:\Program Files (x86)\YCI Copy

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Mutant created: \Sessions\1\BaseNamedObjects\WinAVIDVDCopy64345326
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7708

Source: C:\Users\user\Desktop\NkMMNoILv9.exe

File created: C:\Users\user~1\AppData\Local\Temp\is-QMENT.tmp

Jump to behavior

Source: C:\Users\user\Desktop\NkMMNoILv9.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\NkMMNoILv9.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Borland\Delphi\RTL	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\NkMMNoILv9.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: NkMMNoILv9.tmp, 00000002.00000002.1495476850.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, AviDVDCopy.exe, 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-60UJ3.tmp.2.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: NkMMNoILv9.tmp, 00000002.00000002.1495476850.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-60UJ3.tmp.2.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: NkMMNoILv9.tmp, 00000002.00000002.1495476850.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, AviDVDCopy.exe, 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-60UJ3.tmp.2.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: NkMMNoILv9.tmp, 00000002.00000002.1495476850.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-60UJ3.tmp.2.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: NkMMNoILv9.tmp, 00000002.00000002.1495476850.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-60UJ3.tmp.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: NkMMNoILv9.tmp, 00000002.00000002.1495476850.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-60UJ3.tmp.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: NkMMNoILv9.tmp, 00000002.00000002.1495476850.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-60UJ3.tmp.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: NkMMNoILv9.tmp, 00000002.00000002.1495476850.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-60UJ3.tmp.2.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: NkMMNoILv9.tmp, 00000002.00000002.1495476850.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-60UJ3.tmp.2.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: NkMMNoILv9.tmp, 00000002.00000002.1495476850.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-60UJ3.tmp.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: NkMMNoILv9.tmp, 00000002.00000002.1495476850.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-60UJ3.tmp.2.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: NkMMNoILv9.tmp, 00000002.00000002.1495476850.0000000005D80000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, AviDVDCopy.exe, 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-60UJ3.tmp.2.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: NkMMNoILv9.exe	Virustotal: Detection: 54%
Source: NkMMNoILv9.exe	ReversingLabs: Detection: 42%

Source: AviDVDCopy.exe	String found in binary or memory: /installers/pp
Source: AviDVDCopy.exe	String found in binary or memory: set-addPolicy
Source: AviDVDCopy.exe	String found in binary or memory: Accept-Additions
Source: AviDVDCopy.exe	String found in binary or memory: List-Help
Source: AviDVDCopy.exe	String found in binary or memory: MMHS-Exempted-Address
Source: AviDVDCopy.exe	String found in binary or memory: Originator-Return-Address
Source: AviDVDCopy.exe	String found in binary or memory: id-cmc-addExtensions
Source: NkMMNoILv9.exe	String found in binary or memory: /LOADINF="filename"

Source: C:\Users\user\Desktop\NkMMNoILv9.exe

File read: C:\Users\user\Desktop\NkMMNoILv9.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\NkMMNoILv9.exe "C:\Users\user\Desktop\NkMMNoILv9.exe"
Source: C:\Users\user\Desktop\NkMMNoILv9.exe	Process created: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp "C:\Users\user~1\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp" /SL5="$2044A,4113998,776192,C:\Users\user\Desktop\NkMMNoILv9.exe"
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Process created: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe "C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe"
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7708 -s 848
Source: C:\Users\user\Desktop\NkMMNoILv9.exe	Process created: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp "C:\Users\user~1\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp" /SL5="$2044A,4113998,776192,C:\Users\user\Desktop\NkMMNoILv9.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Process created: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe "C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe"	Jump to behavior

Source: C:\Users\user\Desktop\NkMMNoILv9.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\NkMMNoILv9.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\NkMMNoILv9.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\NkMMNoILv9.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\NkMMNoILv9.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: YCI Copy.lnk.2.dr

LNK file: ..\..\..\..\..\..\Program Files (x86)\YCI Copy\AviDVDCopy.exe

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: NkMMNoILv9.exe

Static file information: File size 4816166 > 1048576

Source: NkMMNoILv9.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe

Unpacked PE file: 8.2.AviDVDCopy.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.fxm:ER;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe

Unpacked PE file: 8.2.AviDVDCopy.exe.400000.0.unpack

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe

Code function: 8_2_6096CF94 _winmajor,LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,

8_2_6096CF94

Source: NkMMNoILv9.exe	Static PE information: section name: .didata
Source: NkMMNoILv9.tmp.0.dr	Static PE information: section name: .didata
Source: is-OE9O8.tmp.2.dr	Static PE information: section name: .didata
Source: is-IAPSA.tmp.2.dr	Static PE information: section name: .fxm
Source: is-60UJ3.tmp.2.dr	Static PE information: section name: /4
Source: is-60UJ3.tmp.2.dr	Static PE information: section name: /19
Source: is-60UJ3.tmp.2.dr	Static PE information: section name: /35
Source: is-60UJ3.tmp.2.dr	Static PE information: section name: /51
Source: is-60UJ3.tmp.2.dr	Static PE information: section name: /63
Source: is-60UJ3.tmp.2.dr	Static PE information: section name: /77
Source: is-60UJ3.tmp.2.dr	Static PE information: section name: /89
Source: is-60UJ3.tmp.2.dr	Static PE information: section name: /102
Source: is-60UJ3.tmp.2.dr	Static PE information: section name: /113
Source: is-60UJ3.tmp.2.dr	Static PE information: section name: /124

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_00402390 push 89084589h; iretd	8_2_00402395
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60983000 pushad ; iretd	8_2_60983031
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6096D990 push eax; ret	8_2_6096D9C0
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60911F9E push ecx; mov dword ptr [esp], ebx	8_2_60911FD3
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60987F71 pushad ; iretd	8_2_60987F74

Source: is-IAPSA.tmp.2.dr	Static PE information: section name: .text entropy: 7.906210569528669
Source: is-IAPSA.tmp.2.dr	Static PE information: section name: .fxm entropy: 7.026716033297952

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Windows\SysWOW64\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\is-0I6OU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\DVDCopy.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\VideoBurn.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\DVD2one.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\FileIO.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J26FF.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\is-OE9O8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\is-FLDF5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\is-H0QO1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\is-IAPSA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Users\user\AppData\Local\Temp\is-J26FF.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\ASPI.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\is-64DNJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\is-J9NT4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Windows\SysWOW64\is-60UJ3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\MPEG2VideoTranslator.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\is-K70RL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Program Files (x86)\YCI Copy\is-ER9BI.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\NkMMNoILv9.exe	File created: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Windows\SysWOW64\sqlite3.dll (copy)			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\Windows\SysWOW64\is-60UJ3.tmp			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YCI Copy			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YCI Copy\YCI Copy.lnk			Jump to behavior

Source: C:\Users\user\Desktop\NkMMNoILv9.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NkMMNoILv9.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect virtualization through RDTSC time measurements

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	RDTSC instruction interceptor: First address: 13CC5CA second address: 13CC5F4 instructions: 0x00000000 rdtsc 0x00000002 btr edi, edx 0x00000005 cwde 0x00000006 not ebp 0x00000008 rol ebp, 02h 0x0000000b btr si, FF8Dh 0x00000010 sub dx, di 0x00000013 lea ebp, dword ptr [ebp-22EA42E3h] 0x00000019 sbb bx, 5703h 0x0000001e lea ebp, dword ptr [ebp+ecx+00h] 0x00000022 cdq 0x00000023 cbw 0x00000025 adc dx, si 0x00000028 mov edi, esp 0x0000002a rdtsc
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	RDTSC instruction interceptor: First address: 13B053D second address: 13D7D29 instructions: 0x00000000 rdtsc 0x00000002 bswap eax 0x00000004 mov edi, 02126D2Ah 0x00000009 pop edx 0x0000000a pop ebp 0x0000000b movzx edi, si 0x0000000e pop eax 0x0000000f pop edi 0x00000010 ret 0x00000011 jmp dword ptr [77211490h] 0x00000017 mov eax, dword ptr [766BE774h] 0x0000001c ret 0x0000001d push 359F5B5Bh 0x00000022 call 00007F5EF06884E1h 0x00000027 push edx 0x00000028 movsx edx, cx 0x0000002b xchg dx, dx 0x0000002e push ecx 0x0000002f xchg ch, ch 0x00000031 cdq 0x00000032 push eax 0x00000033 cwde 0x00000034 sets ah 0x00000037 push ebx 0x00000038 jmp 00007F5EF06D7D1Eh 0x0000003d pushfd 0x0000003e push edi 0x0000003f btr ax, si 0x00000043 xchg ecx, edi 0x00000045 cwde 0x00000046 push esi 0x00000047 adc eax, 0F2C2C17h 0x0000004c rdtsc

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe

Code function: 8_2_004011E0 rdtsc

8_2_004011E0

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\DVDCopy.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\VideoBurn.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\is-0I6OU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\DVD2one.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\FileIO.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J26FF.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\is-FLDF5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\is-OE9O8.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\is-H0QO1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\Core.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-J26FF.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\ASPI.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\is-64DNJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\is-J9NT4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Windows\SysWOW64\is-60UJ3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\MPEG2VideoTranslator.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\is-K70RL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\YCI Copy\is-ER9BI.tmp	Jump to dropped file

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe

API coverage: 0.4 %

Source: Amcache.hve.11.dr	Binary or memory string: VMware
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.11.dr	Binary or memory string: VMware, Inc.
Source: NkMMNoILv9.tmp, 00000002.00000003.1492755427.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\N
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.11.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.11.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.11.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: AviDVDCopy.exe, 00000008.00000002.1491404846.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.11.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.11.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.11.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.11.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.11.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.11.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.11.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.11.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: NkMMNoILv9.tmp, 00000002.00000003.1492755427.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: Amcache.hve.11.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.11.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.11.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.11.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe

Code function: 8_2_004011E0 rdtsc

8_2_004011E0

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe

Code function: 8_2_0054E71C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_0054E71C

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe

Code function: 8_2_6096CF94 _winmajor,LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,

8_2_6096CF94

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_00560011 mov eax, dword ptr fs:[00000030h]	8_2_00560011
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_00560055 mov eax, dword ptr fs:[00000030h]	8_2_00560055
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_00556F24 mov eax, dword ptr fs:[00000030h]	8_2_00556F24

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_0054E71C IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		8_2_0054E71C
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_00496311 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		8_2_00496311

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe

Code function: 8_2_00497248 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

8_2_00497248

Source: C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp

Code function: 2_2_10001000 ISCryptGetVersion,

2_2_10001000

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.11.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.11.dr	Binary or memory string: MsMpEng.exe

Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_609660FA sqlite3_finalize,sqlite3_free,sqlite3_value_numeric_type,sqlite3_value_numeric_type,sqlite3_value_text,sqlite3_value_int,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_mprintf,sqlite3_malloc,sqlite3_free,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,	8_2_609660FA
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6090C1D6 sqlite3_clear_bindings,sqlite3_mutex_enter,sqlite3_mutex_leave,	8_2_6090C1D6
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60963143 sqlite3_stricmp,sqlite3_bind_int64,sqlite3_mutex_leave,	8_2_60963143
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6096A2BD sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	8_2_6096A2BD
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6096923E sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_malloc,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_realloc,sqlite3_realloc,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,	8_2_6096923E
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6096A38C sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,	8_2_6096A38C
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6096748C sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_reset,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_bind_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_reset,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_realloc,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,	8_2_6096748C
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_609254B1 sqlite3_bind_zeroblob,sqlite3_mutex_leave,	8_2_609254B1
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6094B407 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	8_2_6094B407
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6090F435 sqlite3_bind_parameter_index,	8_2_6090F435
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_609255D4 sqlite3_mutex_leave,sqlite3_bind_text16,	8_2_609255D4
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_609255FF sqlite3_bind_text,	8_2_609255FF
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6096A5EE sqlite3_value_text,sqlite3_value_bytes,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_malloc,sqlite3_column_int,sqlite3_column_int64,sqlite3_column_text,sqlite3_column_bytes,sqlite3_finalize,sqlite3_step,sqlite3_free,sqlite3_finalize,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_column_int64,sqlite3_column_int,sqlite3_column_text,sqlite3_column_bytes,sqlite3_step,sqlite3_finalize,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_malloc,sqlite3_bind_null,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_value_text,sqlite3_value_bytes,sqlite3_free,	8_2_6096A5EE
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6094B54C sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,memmove,	8_2_6094B54C
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60925686 sqlite3_bind_int64,sqlite3_mutex_leave,	8_2_60925686
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6094A6C5 sqlite3_bind_int64,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_malloc,sqlite3_reset,sqlite3_free,	8_2_6094A6C5
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_609256E5 sqlite3_bind_int,sqlite3_bind_int64,	8_2_609256E5
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6094B6ED sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,	8_2_6094B6ED
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6092562A sqlite3_bind_blob,	8_2_6092562A
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60925655 sqlite3_bind_null,sqlite3_mutex_leave,	8_2_60925655
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6094C64A sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	8_2_6094C64A
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_609687A7 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_column_int64,sqlite3_reset,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,	8_2_609687A7
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6095F7F7 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	8_2_6095F7F7
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6092570B sqlite3_bind_double,sqlite3_mutex_leave,	8_2_6092570B
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6095F772 sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	8_2_6095F772
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60925778 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_blob,	8_2_60925778
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6090577D sqlite3_bind_parameter_name,	8_2_6090577D
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6094B764 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,	8_2_6094B764
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6090576B sqlite3_bind_parameter_count,	8_2_6090576B
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6094A894 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	8_2_6094A894
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6095F883 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	8_2_6095F883
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6094C8C2 sqlite3_value_int,sqlite3_value_int,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_null,sqlite3_bind_null,sqlite3_step,sqlite3_reset,	8_2_6094C8C2
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6096281E sqlite3_mprintf,sqlite3_vtab_config,sqlite3_malloc,sqlite3_mprintf,sqlite3_mprintf,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_exec,sqlite3_free,sqlite3_prepare_v2,sqlite3_bind_text,sqlite3_step,sqlite3_column_int64,sqlite3_finalize,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_errmsg,sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_free,sqlite3_declare_vtab,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,	8_2_6096281E
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6096583A memcmp,sqlite3_realloc,qsort,sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_step,sqlite3_reset,	8_2_6096583A
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6095F9AD sqlite3_bind_int,sqlite3_step,sqlite3_column_type,sqlite3_reset,	8_2_6095F9AD
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6094A92B sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	8_2_6094A92B
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6090EAE5 sqlite3_transfer_bindings,	8_2_6090EAE5
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6095FB98 sqlite3_value_int,sqlite3_bind_int,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	8_2_6095FB98
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6095ECA6 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,	8_2_6095ECA6
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6095FCCE sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	8_2_6095FCCE
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6095FDAE sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,	8_2_6095FDAE
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60966DF1 sqlite3_value_text,sqlite3_mprintf,sqlite3_free,strcmp,sqlite3_free,sqlite3_malloc,sqlite3_bind_int64,sqlite3_step,sqlite3_column_type,sqlite3_reset,sqlite3_column_blob,sqlite3_reset,sqlite3_malloc,sqlite3_free,sqlite3_reset,sqlite3_result_error_code,sqlite3_result_blob,	8_2_60966DF1
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_60969D75 sqlite3_bind_int,sqlite3_step,sqlite3_column_int,sqlite3_reset,	8_2_60969D75
Source: C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe	Code function: 8_2_6095FFB2 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	8_2_6095FFB2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Process Injection	22 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	2 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Software Packing	NTDS	2 System Owner/User Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	114 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
NkMMNoILv9.exe	54%	Virustotal		Browse
NkMMNoILv9.exe	42%	ReversingLabs	Win32.Trojan.CrthRazy
NkMMNoILv9.exe	100%	Avira	TR/AD.CrthRazy.byk

Dropped Files

Source	Detection	Scanner	Label
C:\Program Files (x86)\YCI Copy\is-IAPSA.tmp	100%	Avira	HEUR/AGEN.1317240
C:\Program Files (x86)\YCI Copy\is-IAPSA.tmp	100%	Joe Sandbox ML
C:\Program Files (x86)\YCI Copy\ASPI.DLL (copy)	0%	ReversingLabs
C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe (copy)	79%	ReversingLabs	Win32.Trojan.Ulise
C:\Program Files (x86)\YCI Copy\Core.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\YCI Copy\DVD2one.DLL (copy)	0%	ReversingLabs
C:\Program Files (x86)\YCI Copy\DVDCopy.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\YCI Copy\FileIO.DLL (copy)	0%	ReversingLabs
C:\Program Files (x86)\YCI Copy\MPEG2VideoTranslator.DLL (copy)	0%	ReversingLabs
C:\Program Files (x86)\YCI Copy\VideoBurn.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\YCI Copy\is-0I6OU.tmp	0%	ReversingLabs
C:\Program Files (x86)\YCI Copy\is-64DNJ.tmp	0%	ReversingLabs
C:\Program Files (x86)\YCI Copy\is-ER9BI.tmp	0%	ReversingLabs
C:\Program Files (x86)\YCI Copy\is-FLDF5.tmp	0%	ReversingLabs
C:\Program Files (x86)\YCI Copy\is-H0QO1.tmp	0%	ReversingLabs
C:\Program Files (x86)\YCI Copy\is-IAPSA.tmp	79%	ReversingLabs	Win32.Trojan.Ulise
C:\Program Files (x86)\YCI Copy\is-J9NT4.tmp	0%	ReversingLabs
C:\Program Files (x86)\YCI Copy\is-K70RL.tmp	0%	ReversingLabs
C:\Program Files (x86)\YCI Copy\is-OE9O8.tmp	2%	ReversingLabs
C:\Program Files (x86)\YCI Copy\unins000.exe (copy)	2%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-J26FF.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-J26FF.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp	2%	ReversingLabs
C:\Windows\SysWOW64\is-60UJ3.tmp	0%	ReversingLabs
C:\Windows\SysWOW64\sqlite3.dll (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label
https://sshop.element5.com/esales/checkout.html?PRODUCT	0%	Avira URL Cloud	safe
http://ww25.mastergamenameper.club/installers/pp?subid1=20250102-2354-13c6-af36-174aa28c07b8	100%	Avira URL Cloud	malware
http://www.WinAVI.comopenhttp://www.WinAVI.comopenhttps://sshop.element5.com/esales/checkout.html?PR	0%	Avira URL Cloud	safe
http://www.winavi.com.	0%	Avira URL Cloud	safe
http://www.yci.com$http://www.yci.com$http://www.yci.com	0%	Avira URL Cloud	safe
http://ww25.mastergamenameper.club/log?subid1=20250102-2354-145f-aab7-442a1121e9f0	100%	Avira URL Cloud	malware
http://www.winavi.com03A	0%	Avira URL Cloud	safe
https://mastergamenameper.club/installers/pp	100%	Avira URL Cloud	malware
http://www.WinAVI.com	0%	Avira URL Cloud	safe
http://www.WinAVI.comKSLIBCREATOR_SHARE_MEMORYSoftware	0%	Avira URL Cloud	safe
http://www.WinAVI.comhelp	0%	Avira URL Cloud	safe
http://www.WinAVI.comopenhttp://www.WinAVI.comTMenuTWinControlOpenMediaMenu..HintTWinControlTForm.Fo	0%	Avira URL Cloud	safe
http://www.yci.com	0%	Avira URL Cloud	safe
http://ww25.mastergamenameper.club/ins	100%	Avira URL Cloud	malware
http://www.WinAVI.comhttp://www.WinAVI.comAffiliateNow.dll_OpenAffiliatePage	0%	Avira URL Cloud	safe
http://www.WinAVI.comopenmailto:support	0%	Avira URL Cloud	safe
http://www.WinAVI.comopenhttps://sshop.element5.com/esales/checkout.html?PRODUCT	0%	Avira URL Cloud	safe
http://www.winavi.comhttp://www.winavi.com	0%	Avira URL Cloud	safe
https://mastergamenameper.club/log	100%	Avira URL Cloud	malware
http://www.yci.com9P&	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mastergamenameper.club	103.224.212.212	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://mastergamenameper.club/installers/pp	true	Avira URL Cloud: malware	unknown
https://mastergamenameper.club/log	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	NkMMNoILv9.exe, 00000000.00000003.1259298076.0000000002510000.00000004.00001000.00020000.00000000.sdmp, NkMMNoILv9.exe, 00000000.00000003.1259638971.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp, NkMMNoILv9.tmp, 00000002.00000000.1261152615.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-OE9O8.tmp.2.dr, NkMMNoILv9.tmp.0.dr	false		high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	NkMMNoILv9.exe	false		high
http://ww25.mastergamenameper.club/installers/pp?subid1=20250102-2354-13c6-af36-174aa28c07b8	AviDVDCopy.exe, 00000008.00000003.1299676858.000000000175B000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1299459575.0000000001764000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1298004915.000000000175F000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1299571396.000000000175B000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1299676858.0000000001766000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1298004915.000000000175B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.WinAVI.com	is-H0QO1.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://www.WinAVI.comopenhttp://www.WinAVI.comopenhttps://sshop.element5.com/esales/checkout.html?PR	is-H0QO1.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://www.winavi.com.	is-2BLD0.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://ww25.mastergamenameper.club/log?subid1=20250102-2354-145f-aab7-442a1121e9f0	AviDVDCopy.exe, 00000008.00000002.1491404846.000000000172F000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1308864776.0000000001767000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1491532365.000000000175B000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1309022282.0000000001767000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://sshop.element5.com/esales/checkout.html?PRODUCT	is-H0QO1.tmp.2.dr	false	Avira URL Cloud: safe	unknown
https://test.com/session.restore_on_startupsession.startup_urlssuper_mac	AviDVDCopy.exe, 00000008.00000002.1491916716.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, AviDVDCopy.exe, 00000008.00000002.1491668952.0000000003110000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.WinAVI.comKSLIBCREATOR_SHARE_MEMORYSoftware	is-H0QO1.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://www.yci.com$http://www.yci.com$http://www.yci.com	NkMMNoILv9.exe, 00000000.00000003.1258414186.0000000002510000.00000004.00001000.00020000.00000000.sdmp, NkMMNoILv9.tmp, 00000002.00000003.1262734153.0000000003400000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winavi.com03A	NkMMNoILv9.tmp, 00000002.00000002.1493771634.0000000002413000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://upx.sf.net	Amcache.hve.11.dr	false		high
http://www.WinAVI.comhelp	is-H0QO1.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	AviDVDCopy.exe, 00000008.00000002.1491668952.0000000003110000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.yci.com	NkMMNoILv9.exe, 00000000.00000003.1496765420.0000000002264000.00000004.00001000.00020000.00000000.sdmp, NkMMNoILv9.tmp, 00000002.00000002.1493771634.0000000002404000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ww25.mastergamenameper.club/ins	AviDVDCopy.exe, 00000008.00000003.1308864776.0000000001767000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1491532365.0000000001769000.00000004.00000020.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000003.1309022282.0000000001767000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://test.com/	AviDVDCopy.exe, AviDVDCopy.exe, 00000008.00000002.1491916716.00000000034E0000.00000004.00001000.00020000.00000000.sdmp, AviDVDCopy.exe, 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, AviDVDCopy.exe, 00000008.00000002.1491668952.0000000003110000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.WinAVI.comopenhttp://www.WinAVI.comTMenuTWinControlOpenMediaMenu..HintTWinControlTForm.Fo	is-H0QO1.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://www.winavi.com	is-T33OF.tmp.2.dr	false		unknown
http://www.WinAVI.comopenmailto:support	is-H0QO1.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://www.WinAVI.comhttp://www.WinAVI.comAffiliateNow.dll_OpenAffiliatePage	is-H0QO1.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/ps	NkMMNoILv9.exe, 00000000.00000003.1259298076.0000000002510000.00000004.00001000.00020000.00000000.sdmp, NkMMNoILv9.exe, 00000000.00000003.1259638971.000000007FBD0000.00000004.00001000.00020000.00000000.sdmp, NkMMNoILv9.tmp, 00000002.00000000.1261152615.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-OE9O8.tmp.2.dr, NkMMNoILv9.tmp.0.dr	false		high
http://www.WinAVI.comopenhttps://sshop.element5.com/esales/checkout.html?PRODUCT	is-H0QO1.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://www.yci.com9P&	NkMMNoILv9.exe, 00000000.00000003.1496765420.0000000002264000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.winavi.comhttp://www.winavi.com	is-H0QO1.tmp.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.224.212.212	mastergamenameper.club	Australia		133618	TRELLIAN-AS-APTrellianPtyLimitedAU	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583337
Start date and time:	2025-01-02 13:53:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	NkMMNoILv9.exe renamed because original name is a hash value
Original Sample Name:	94722be5aa4e12860a09965f78ee60aa.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@6/69@1/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92, 40.126.31.73, 13.107.246.45, 4.245.163.56
Excluded domains from analysis (whitelisted): onedsblobprdeus17.eastus.cloudapp.azure.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target NkMMNoILv9.tmp, PID 7336 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:48:35	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
103.224.212.212	AxgZVzUv8m.exe	Get hash	malicious	Pony	Browse	dillion0mill.favcc1.com/gate.php
	RFQ31072024_August order_pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.startable.online/ss24/?Vt=zMEVcHBGt47G6KX5esEX8dtG6+lnOeOio8+YHkIF/aeZvdpFgNK9qxVPP7cqFgvwi0y6&Rxl=8pdPF640TxI0Gb
	po8909893299832.exe	Get hash	malicious	FormBook	Browse	www.trexendofparadise.club/hd05/?mJBXxJ=86lIbpVB0TF+ypCCh2xJS80hbaRwufvG1BxjW4BS/DAeytVMDvWI/cAJk8pGccQXRyse&_hrl=jxopsZ
	Details of Your Etisalat Summary Bill for the Month of May 2024.exe	Get hash	malicious	FormBook	Browse	www.vietcadao.com/da29/?6l=Q7am8il/nsWle9qVrlpo40N7hUEpDQa8XY45vE38HJwrUpInQsvntdacZL4kVj7U+7+N&2dqhl=R2MlVxP8ert
	jqPZZhDmjh.exe	Get hash	malicious	FormBook	Browse	www.theanhedonia.com/gy14/?Szu8Zp=sJB9xXDMLUearYsOJfMPyoOL09k0Ht7qJDXT7N+Z0c0oohLZUl68J6Fs60bzmHjgtnYtuzz0MQ==&3fzlqX=DtjxV
	z2______________________________.exe	Get hash	malicious	FormBook	Browse	www.theanhedonia.com/gy14/?MRmX=sJB9xXC4L0bq2ox6VvMPyoOL09k0Ht7qJDXT7N+Z0c0oohLZUl68J6Fs633JlGPbuQ58&J61h=CBZhCFnx-
	file.exe	Get hash	malicious	LummaC, Glupteba, PureLog Stealer, RisePro Stealer, SmokeLoader, Stealc, zgRAT	Browse	soclaiebn.xyz/PhpMyAdmin/
	22#U0415.exe	Get hash	malicious	FormBook	Browse	www.theanhedonia.com/gy14/?8pB8=qN98lNP8T4bXSv70&NBZlJ=sJB9xXC4L0bq2ox6VvMPyoOL09k0Ht7qJDXT7N+Z0c0oohLZUl68J6Fs633JlGPbuQ58
	RFQ-T56797W_1.xlsx	Get hash	malicious	FormBook, NSISDropper	Browse	www.narrativepages.com/ge06/?6l58L2=/ya+08xkyOEL3z3mbFI+CcZs6Ll5ZIz+eS70dlN8tW9HOdaiVOhFBqrIR4wo06Sw4yKSnA==&BL3=KP-PB41
	GCeHcfCef8.exe	Get hash	malicious	FormBook	Browse	www.fhstbanknigeria.com/rs10/?s0=3hcrZOpg0bcnkhh15AgNBYOBAaFzA2w39b7OLOTzLX17gT7vmmZNER029cGGSq2teP1k&CB_=7nEpdJs

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TRELLIAN-AS-APTrellianPtyLimitedAU	http://www.finanzamthessen.de	Get hash	malicious	Unknown	Browse	103.224.182.245
	https://tfsroanoke.com/home/tfs/public_html/new/ckfinder/userfiles/files/12719803849.pdf	Get hash	malicious	PDFPhish	Browse	103.224.182.253
	PO1341489LTB GROUP.vbs	Get hash	malicious	FormBook	Browse	103.224.182.242
	http://www.firsthealthbp.com	Get hash	malicious	Unknown	Browse	103.224.212.254
	PO2412010.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	http://divisioninfo.net/	Get hash	malicious	Unknown	Browse	103.224.182.251
	Document_084462.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse	103.224.182.242
	Pp7OXMFwqhXKx5Y.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	New Purchase Order.exe	Get hash	malicious	FormBook	Browse	103.224.182.242
	Purchase Order..exe	Get hash	malicious	FormBook	Browse	103.224.182.242

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fd80fa9c6120cdeea8520510f3c644ac	Phoenix Service Tool V5.6.exe	Get hash	malicious	Unknown	Browse	103.224.212.212
	sistema_2_1_1_build2.zip	Get hash	malicious	Unknown	Browse	103.224.212.212
	SecuriteInfo.com.W32.PossibleThreat.9762.18095.exe	Get hash	malicious	Unknown	Browse	103.224.212.212
	winaudio.exe	Get hash	malicious	Unknown	Browse	103.224.212.212
	l.out.elf	Get hash	malicious	Unknown	Browse	103.224.212.212
	RT.msi	Get hash	malicious	Unknown	Browse	103.224.212.212
	Ac372JNTO6.exe	Get hash	malicious	Amadey	Browse	103.224.212.212
	6v8QbANftP.exe	Get hash	malicious	Unknown	Browse	103.224.212.212
	6v8QbANftP.exe	Get hash	malicious	Unknown	Browse	103.224.212.212
	spjYwLgrAT.exe	Get hash	malicious	Unknown	Browse	103.224.212.212

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	5.159573737733904
Encrypted:	false
SSDEEP:	1536:TT3OYTOOZyjVVbiCT1K4dTPN18SPWoYxEh:neV5BpiCT1K4xPT82WoYxq
MD5:	A962DA75BA5D9AB697F20DD8A57E440B
SHA1:	BE0CC8BFFFA757076FC7C0C4C6FCDB715EDC1543
SHA-256:	3C4AE73B75C5A1F298198F9CAB9ECF1CB2A5A4A039F8BD68BDB1B9EF04C02AF5
SHA-512:	5404994F2443FA4AFF89CCE0FE17E0F1DF38922784D2A4244B81F8D58C194EB5D44B278789318FEF80BBB27096048A70141378BF22DE182230A577DB9BE4920D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............K...K...K..K...K;..K...K..K..K..K...K...K.K.K...KG..K...KRich...K................PE..L.....\B...........!.................!.......................................`..........................................Q.......<............................@.......................................................... ............................text...z........................... ..`.rdata..!........ ..................@..@.data...0M.......@..................@....reloc.......@... ...0..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2329088
Entropy (8bit):	7.7722221954842245
Encrypted:	false
SSDEEP:	49152:j1xHIBA+NltzC+4ij8QAF4CO4DX2US9s0RI3+ThdRB:uA4lNAi2gHi+T
MD5:	DA7C7C802E2164A70B460B5163AFDEC4
SHA1:	16899726E571A5CD3C686888EB6FDEB2EE21A61B
SHA-256:	2A99537198B8D97B067CC3C3A9C17B2EB396435AF9E1756D6025FF563032BE46
SHA-512:	D74C04E0EEB2273F46BF38A3B8ECE0CC5C0C57094A942EFE29B6193092DF1A5DE8D8D122F0F3F8C84E88FB60D4289846925CFE5A82B16951DF6FFA026109EFE4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_.....................$......`R............@.........................................................................X...............................................................0........................................................text...T........................... ..`.rdata..j+.......,..................@..@.data..../.......,..................@....tls................................@....fxm.... ...........................`..`.rsrc.................".............@..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\Core.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	200704
Entropy (8bit):	4.881978838245314
Encrypted:	false
SSDEEP:	3072:BAdGrwHfH1hauadHSloeLuRd0EhoHHMkH:6bvl8SKeyRFYs
MD5:	C2329E1092D9061409B539CA84ED5245
SHA1:	1A6E4F44B4A7964582C24FC38B427B5AB062B5A4
SHA-256:	C58539D4F38D8033F24359A4224B58F30484FA4EA02D71186632F81BFE900773
SHA-512:	0EFA395B1C2492CD565709EDB0E9BF403FDE725CC4B12228256F2FEBD9ACEBE070A39315ACA9FD6B67DDB7846C77FEC30E8A96DDB370D55CC4644AC7C05AEFF9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.y.7..J7..J7..JX..J6..JX..J0..JL..J5..J...J ..J...JE..J7..J>..JU..J0..J7..JU..J...J-..J...J6..JRich7..J........PE..L...T..B...........!.....`... ...............p..........................................................................Q...`...x............................p.......................................................p...............................text...f[.......`.................. ..`.rdata..a$...p...0...p..............@..@.data...4........P..................@....reloc.......p... ..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\DVD2one.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.667262138418869
Encrypted:	false
SSDEEP:	1536:ream20MuBpo4VeKNYTkeiLyeHjUFTevbfO1BYbb90ruzWQiGoB5iwnfFF:vOymRBj0godGoHJ
MD5:	41E7BC59744793C3A4796183274FC636
SHA1:	B16A4D725A7B336C1F88A6C46DAECEBD8B0E5D75
SHA-256:	509EE2C151EA02878E8FAC24D37176700DB64B1529EC863928B8A08BD71BDAC5
SHA-512:	2292A31F8DF978E3411F9892F9F5B0157AAAA8F26B1ECEFFC7D55D2766E4C1948ABE318E346CB17EF8B4232C8E6F35936A2C73C1850B1C17B4E5F4C61AE7767A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-t.i...i...i.......m.......u..._3......i...m.......l...i...6..._3..f...5..h...Richi...................PE..L......B...........!.....p..........K........................................@.........................................T.......P............................ ..........................................................`............................text....e.......p.................. ..`.rdata..$........ ..................@..@.data............p..................@....reloc....... ... ..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\DVDCopy.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	946688
Entropy (8bit):	6.590259013061352
Encrypted:	false
SSDEEP:	12288:Jo/c4LjEojQ4iz87llSwKjlvrHRvBgcL3gWOZZ4oW9n+suuEk1Mfw+X7r:JofLIhDSmDlvjRvBLglDvi+rG+Lr
MD5:	872A4D2C6BC01ACE5C2A8B95EE2EAE2D
SHA1:	331C7A54DE34F1FA206296BC859362C61AABECAC
SHA-256:	22EBB7A2064F833D1B25D14E5D152FBD924D0B17B3ABC4851059894CEBE46793
SHA-512:	EFD48386EED6ECF2B6DFC197F9202A6727F3219975DEC5E8B467FB604AC6A4D9337FCABB925E1252E24156C7E7B6226AA22BA10651A4A6574DD10FC5E3DD60F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L.....B...........#.....`... ......$........p....@.....................................................................&z.......+...P....................... ..@....................................................................................text....`.......\.................. ..`.data.... ...p.......b..............@....tls.................2..............@....idata...0.......,...4..............@..@.edata...........\|...`..............@..@.rsrc........P......................@..@

C:\Program Files (x86)\YCI Copy\FileIO.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.984301218238288
Encrypted:	false
SSDEEP:	1536:5Vfv9SkK89JZKSbGcwTfJS7YkS14oFb2BoBpRApzP7lQuVNOd0:5x9SI9PKeGcG/xinBoBpWpzP7lQuVNI
MD5:	167566A7781E7E0C4A70A01591A9FA9C
SHA1:	342D2C172E52FAFE64E693EE201E1487474A78E8
SHA-256:	A7C711845D3B80547A3004767D0E575E9F8A8DB077E3CA1B477931DCCD4F861B
SHA-512:	CEB4317082D05CDA2F42EBE23E707732BEE02B1BE7A8F4CCC679CA75A8A8280BD0E308DDAD54658AAC96E73CF89C602C76CE5F671260C4EE2DED4081F4DB4921
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..._..._..._..S..._...U..._...Q..._..._..._...L..._...^.._...T..._...[..._.Rich.._.........PE..L... ..B...........!.........p......XA....................................... .........................................S...$...P....................................................................................................................text...v........................... ..`.rdata..C...........................@..@.data...<M.......@..................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\Help\WinAVI DVD Copy help.chm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	115583
Entropy (8bit):	7.816087706478958
Encrypted:	false
SSDEEP:	3072:kWEpNrBupdTiRQx9rJqXpzNuN9OnP1D+q2okf:kWEpyTlxWXpR0otiq21
MD5:	077395C81CD9E0369CC3F27A3657F79F
SHA1:	D4E1C8F984D04929102669647495D825F1F3863F
SHA-256:	6A5190D9FD4A94F9406B145596CB01EC532BEF49D99B6851F321860F5D9C6681
SHA-512:	A6266ECA0E5DC5E9100381323CCAF929F95BFBE0969BFDDC135A69018A9808925532A750188FECBB06B0150DB91EA3F90F5BC5FBD08E72BA7A008034B2573DEE
Malicious:	false
Reputation:	low
Preview:	ITSF....`.......2.FI.......\|.{.......".....\|.{......."..`...............x.......T.......................................ITSP....T...........................................j..].!......."..T...............PMGLx................/..../#IDXHDR...i.../#ITBITS..../#STRINGS...S.2./#SYSTEM..V.K./#TOPICS...i.P./#URLSTR...U.~./#URLTBL...9.../$FIftiMain..../$OBJINST...*.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...&../$WWKeywordLinks/..../$WWKeywordLinks/Property..."../about.htm....L./burnvcd.htm.....S./Copyburn.htm...=.3./images/..../images/1.gif...h+./images/arrow.gif...Q@./images/burn.gif...M..F./images/Copying.gif...d.B./images/helpnext1.gif..U.e./images/helppre1.gif..:.d./images/main.gif...R..../images/menu.gif...{.m./images/option.gif...y.8./images/registration_1.gif.....f./images/right.gif...1.../images/setting.gif.....B./images/top_menu_2.gif...p.../images/xiala.gif.....?./images/ZJ-logo.jpg.....j./Index.hhk....K./lisence.htm...S.<./menu.htm..S.-./option.htm...T.,./order.htm.

C:\Program Files (x86)\YCI Copy\Help\is-KSBU7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	115583
Entropy (8bit):	7.816087706478958
Encrypted:	false
SSDEEP:	3072:kWEpNrBupdTiRQx9rJqXpzNuN9OnP1D+q2okf:kWEpyTlxWXpR0otiq21
MD5:	077395C81CD9E0369CC3F27A3657F79F
SHA1:	D4E1C8F984D04929102669647495D825F1F3863F
SHA-256:	6A5190D9FD4A94F9406B145596CB01EC532BEF49D99B6851F321860F5D9C6681
SHA-512:	A6266ECA0E5DC5E9100381323CCAF929F95BFBE0969BFDDC135A69018A9808925532A750188FECBB06B0150DB91EA3F90F5BC5FBD08E72BA7A008034B2573DEE
Malicious:	false
Preview:	ITSF....`.......2.FI.......\|.{.......".....\|.{......."..`...............x.......T.......................................ITSP....T...........................................j..].!......."..T...............PMGLx................/..../#IDXHDR...i.../#ITBITS..../#STRINGS...S.2./#SYSTEM..V.K./#TOPICS...i.P./#URLSTR...U.~./#URLTBL...9.../$FIftiMain..../$OBJINST...*.?./$WWAssociativeLinks/..../$WWAssociativeLinks/Property...&../$WWKeywordLinks/..../$WWKeywordLinks/Property..."../about.htm....L./burnvcd.htm.....S./Copyburn.htm...=.3./images/..../images/1.gif...h+./images/arrow.gif...Q@./images/burn.gif...M..F./images/Copying.gif...d.B./images/helpnext1.gif..U.e./images/helppre1.gif..:.d./images/main.gif...R..../images/menu.gif...{.m./images/option.gif...y.8./images/registration_1.gif.....f./images/right.gif...1.../images/setting.gif.....B./images/top_menu_2.gif...p.../images/xiala.gif.....?./images/ZJ-logo.jpg.....j./Index.hhk....K./lisence.htm...S.<./menu.htm..S.-./option.htm...T.,./order.htm.

C:\Program Files (x86)\YCI Copy\Language\English.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	11139
Entropy (8bit):	5.278913278963833
Encrypted:	false
SSDEEP:	192:U/2Z4o85QF8up740AO/CT6jEv/GYmL66SiOFHw418lLfXxMpR6AOLJwXbn6MhAlB:U/2Z4o85QF8up74s6T6jEv/G1L66SiOW
MD5:	4B72C5172FBA060D843B0055362D67A8
SHA1:	A4C4EDAD1A5F57D5DACE87F3BC0B29297C5EAB46
SHA-256:	36A2DD5793B0FE230D5D9C0BA713A8EE8A33006DFC2F736A0B7EB4CBDCCC374B
SHA-512:	E1BBFCEE304CAD855C312DB6D6D62904C3B0E60D96FC9E7C18A832DA246D579AF9C23A6FCF2DDFB8F218216F4230F3FE110268859F33628BD1F0E2CD97F6F54A
Malicious:	false
Preview:	[Strings]..STR_1AED3F="Source file does not exist or is not a DVD file!"..STR_105F67="Failure in creating Save component!"..STR_105FB6="Failure in creating Burn component!"..STR_0C3C5D="Failure in opening disc"..STR_0A2BE2="Illegal disk symbol"..STR_18F16F="Please insert a blank DVDR/RW then click Yes to continue, or No to exit."..STR_0E5328="Failure in inserting source file!"..STR_081BD8="Failure in burning!"..STR_287A01="Not enough disk space for the temporary folder, please reselect the directory."..STR_1169B6="DVD file structure is incorrect or incomplete."..STR_0C401B="Burning file"..STR_0C348B="Copying file"..STR_0B18B8="Select Path"..STR_0D3D4E="Failure in reading the skin!"..STR_081704="Failure in Copying!"..STR_17CB99="The program will close to apply the register code!"..STR_13891D="Please put your registration name and code in the appropriate blanks!"..STR_1030D5="Failure in burning!"..STR_1C90D2="Please select file(s) to burn."..STR_134417="Please insert the disc."..STR_1EA8

C:\Program Files (x86)\YCI Copy\Language\is-T33OF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	11139
Entropy (8bit):	5.278913278963833
Encrypted:	false
SSDEEP:	192:U/2Z4o85QF8up740AO/CT6jEv/GYmL66SiOFHw418lLfXxMpR6AOLJwXbn6MhAlB:U/2Z4o85QF8up74s6T6jEv/G1L66SiOW
MD5:	4B72C5172FBA060D843B0055362D67A8
SHA1:	A4C4EDAD1A5F57D5DACE87F3BC0B29297C5EAB46
SHA-256:	36A2DD5793B0FE230D5D9C0BA713A8EE8A33006DFC2F736A0B7EB4CBDCCC374B
SHA-512:	E1BBFCEE304CAD855C312DB6D6D62904C3B0E60D96FC9E7C18A832DA246D579AF9C23A6FCF2DDFB8F218216F4230F3FE110268859F33628BD1F0E2CD97F6F54A
Malicious:	false
Preview:	[Strings]..STR_1AED3F="Source file does not exist or is not a DVD file!"..STR_105F67="Failure in creating Save component!"..STR_105FB6="Failure in creating Burn component!"..STR_0C3C5D="Failure in opening disc"..STR_0A2BE2="Illegal disk symbol"..STR_18F16F="Please insert a blank DVDR/RW then click Yes to continue, or No to exit."..STR_0E5328="Failure in inserting source file!"..STR_081BD8="Failure in burning!"..STR_287A01="Not enough disk space for the temporary folder, please reselect the directory."..STR_1169B6="DVD file structure is incorrect or incomplete."..STR_0C401B="Burning file"..STR_0C348B="Copying file"..STR_0B18B8="Select Path"..STR_0D3D4E="Failure in reading the skin!"..STR_081704="Failure in Copying!"..STR_17CB99="The program will close to apply the register code!"..STR_13891D="Please put your registration name and code in the appropriate blanks!"..STR_1030D5="Failure in burning!"..STR_1C90D2="Please select file(s) to burn."..STR_134417="Please insert the disc."..STR_1EA8

C:\Program Files (x86)\YCI Copy\MPEG2VideoTranslator.DLL (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	4.84171345916617
Encrypted:	false
SSDEEP:	768:U96Xm6aUW88ijA697M1hWxTxPQumVi4wf8z8ngwsWDkE0Kmao4hqF02nhaW:XXm6tF8is69sUTlP6lVfizoui02nhaW
MD5:	462E5732075713653B121B1819606F45
SHA1:	50D20651D1EA29333582FEAE246221F212D3284F
SHA-256:	F64D390A0816E33ECF0A992738D565C8627970163B22902FE8D5004A472F6D5A
SHA-512:	989E362CB05DABBD2F466A70B655A87EE9E96F738581B3ED5AB111762B6062C9EB84FCB5E3CEA1C1805958B1DF27D560AE6D76060E7EB969C7DAF60717367159
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8.4MY.gMY.gMY.g"F.gEY.g.E.gXY.g"F.gpY.gMY.g.Y.g/F.gNY.g.z.gLY.g.z.gDY.g.{.gLY.g.y.gLY.gRichMY.g................PE..L....jrB...........!..........A......`........................................B.........................................a.......(............................PB.H....................................................................................text............................... ..`.rdata..............................@..@.data....sA......P..................@....reloc..&?...PB..@... ..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\Skins\0\CopyNow.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 390 x 59 x 16, image size 46022, resolution 2834 x 2834 px/m, cbSize 46076, bits offset 54
Category:	dropped
Size (bytes):	46076
Entropy (8bit):	5.590224163777783
Encrypted:	false
SSDEEP:	384:nSvGr998Fv8AFRUhHfe5hFT86t6ATHcKZmExFc7CC4mPpmi1uVcLr8mwzxD1No:Sv89SFk8RUhm5MgFON4mpmi1uVIyNU
MD5:	8084AA277E5867E6F509CE32FEEAC738
SHA1:	B20719D3A8D63184D89870F1EBF51E5A5992C448
SHA-256:	F864347DD3D32408E1CCE4265BBDE9E37046637FD0822C5EA1C4E8C508035E52
SHA-512:	FFBA32EA08AAF5615E8E4FAC7A524C6F9448FDDB0FA59A8B3D7D9E16545F0FA3C607F45B43F90712095E954F3AD08D1EC4DE77612D3675E373E34AF4AB2FBD9B
Malicious:	false
Preview:	BM........6...(.......;..............................hQ.Y.m.m.m Y.M.MCM.M.H.H.H.H.H.H.@.@.@.@.8.8.8.8.4.4.4.4.4`,`,`,`,`,@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@(@$@$@$@$@$@$@$@$@(@(@$@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(`,.8.@.@.@.@.<J5J5J5.I.a.i.i.i U.I MDM.I.I.I.I.D.D.D.@.@.<.<.8.8.8.8.4.4.4.4`,`,`,`,`,`,@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@(@$@$@$@$@$@$@$@$@(@(@$@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(`,.4.<.<.<.<.@(9.1.1.I.a.m.m.m@].I MCM.I.I.I.I.H.H.D.D.D.<.<.8.8.8.8.0.0.0.0.0`,`,`,`,`,@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@(@$@$@$@$@$@$@$@$@(@(@$@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@$@(@(`,.8.@.@.@.<.@(9.1.1.i.m.m`i.M.MCM.M.H.H.H.H.H.@.@.@.@.8.8.8.4.4.4.8.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.X.`.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L

C:\Program Files (x86)\YCI Copy\Skins\0\Down.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 51 x 17 x 16, image size 1770, resolution 2834 x 2834 px/m, cbSize 1824, bits offset 54
Category:	dropped
Size (bytes):	1824
Entropy (8bit):	4.799241586593005
Encrypted:	false
SSDEEP:	24:9l0QuB6RuCqhRYIfaniLxOoFDdlBDxWLjCw/zTQzN:H0Qu0uCqhRNiWVFRjxqjCw/Q
MD5:	B495B2F7D809C1777F0C77DA87A144D8
SHA1:	ED8DF7F99846EBA1C89D69EA46C1D60DEF91A2D3
SHA-256:	DC4C8E98CAC6069650E1BDDCC9F4188DCA77F1AE5119629786248F3ACB868447
SHA-512:	F513168E85E704E4F0FE39E667BB08F732D53D113E0C13FB552E374CE3EA6A2B8EF4123D110E2EA2763E2B5A9F694E2A18A60050B75B26605DD4E2046E6A5274
Malicious:	false
Preview:	BM .......6...(...3....................................X@H`8`0`0`0`0`0`0`0`0`0`0`0`8@H.X.X@H`8`0`0`0`0`0`0`0`0`0`0`0`8@H.X.X@H`8`0`0`0`0`0`0`0`0`0`0`0`8@H.X.. H.0.H.T.] a e e e e e e e e@].0 H H.0@U.i.u.y.}.}.}.}.}.}.}.~ n.4 H H.0.H.T.] a e e e e e e e e@].0 H..`8.D`H.L.T.X.\.\.X.\.\.\.\ \.`@Y`8`8.M.` l.t.x.\|.\|.\|.\|.\|.\|.\| \|.}.j`8`8.D`H.L.T.X.\.\.X.\.\.\.\ \.`@Y`8..`0.H.H.P.X.\.\.\.\.\.\.\.\.\ \ e`0`0.Y `.l.t.x.\|.\|.\|.\|.\|.\|.\|.\| \|.y`0`0.H.H.P.X.\.\.\.\.\.\.\.\.\ \ e`0..`0.H.H.P.X.\.`.`.`.`.`.`.`.`.` e`0`0.X.`.l.t.x.\|.\|.\|.\|.\|.\|.\|.\|.\|.y`0`0.H.H.P.X.\.`.`.`(..`.`.`.`.` e`0..`0.H.L.T.\.`.`.`(..`.`.`.`.`.` i`0`0.X.`.l.t.x.\|.\|(..\|.\|.\|.\|.\|.\|.y`0`0.H.L.T.\.`.`.`(.(.(..`.`.`.` i`0..`0.L.L.T.\.`.d(.(.(..d.d.d.d.d i`0`0.X.`.l.t.x.\|(.(.(..\|.\|.\|.\|.\|.y`0`0.L.L.T.\.`.d(.(.(.(.(..d.d.d i`0..`0.L.P.X.`.d(.(.(.(.(..h.h.h.h m`0`0.X.`.l.t.x(.(.(.(.(..\|.\|.\|.\|.y`0`0.L.P.X.`.d(.(.(..D(.(.(..h.h m`0..`0.L.P.X.`(.(.(..D(.(.(..h.h.h m`0`0.X.`.l.t(.(.(..D(.(.(..\|.\|.\|.y`0`0.L.P.X.`(.(.(..D.D.h(.(.(..h m`0..`0.L.`.d..

C:\Program Files (x86)\YCI Copy\Skins\0\Setting.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 204 x 24 x 16, image size 9794, resolution 2834 x 2834 px/m, cbSize 9848, bits offset 54
Category:	dropped
Size (bytes):	9848
Entropy (8bit):	4.51614322719702
Encrypted:	false
SSDEEP:	24:phjzYxpYHYqYgy1O2cDKaUNmFWZoEjR6ngY4cQXTMfoUMsqonHQQfkoF1:phlWZoEknP4cMTMfoUMsqQv5P
MD5:	3C3632BDE50FA5F1DBBC7E918BD6A5CA
SHA1:	BF806CD682A3E8B40CED2FE3245F3E0E617A5E44
SHA-256:	FD009AD2E470115E99BCB56A4B6063341F8744E54C50C266D6DE93610425490A
SHA-512:	132EDB9BFF32F034C259F52A7FD29B73070E9CB6C056E05A10BC07E89540E16C0010EF661F018D6595484529391B6F4F695FE4B4B540AB07E44C68E698A8E3FB
Malicious:	false
Preview:	BMx&......6...(...................B&...................<.<.<.<.<.8.4.0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.0.4.8.<.<.<.<.<.<.<.<.<.<.4.0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.0.4.<.<.<.<.<.<.<.<.<.<.0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.0.<.<.<.<.<.<.<.<.8`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.8.<.<.<.<.<.<.4`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.4.<.<.<.<.<.<.4`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.4.<.<.<.<.<.4`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0

C:\Program Files (x86)\YCI Copy\Skins\0\Splash.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 340 x 224 x 24, resolution 2834 x 2834 px/m, cbSize 228536, bits offset 54
Category:	dropped
Size (bytes):	228536
Entropy (8bit):	3.9222343230790093
Encrypted:	false
SSDEEP:	1536:b+b4UzRbBVkabpmRH1zN2hhaZVYRNWs39Y2/bMzVn7z7wmMvUHhjb6f1PuSLyaz7:b+b4UzRbLkabsp15EI+eydUXXXgXto
MD5:	215F26873F9D872BDA8AACA9EB2EB6D5
SHA1:	5264C7FB1B5D42B184EB7D8468EAC1C1D23813A8
SHA-256:	B52C93CD2F14571108EE954D0AFC9561E6AFB0233937B56BAFF9C6C83BADCD3D
SHA-512:	058401EE5499D22ADF8000E81AFE3E92F5F30D8F091F77816755B7B422041D569297F6CBEAD079E59F712461028CF3C0A84C791FFFF10CC962244E89D7471436
Malicious:	false
Preview:	BM.\|......6...(...T.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\Skins\0\Web.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 504 x 39 x 16, image size 39314, resolution 2834 x 2834 px/m, cbSize 39368, bits offset 54
Category:	dropped
Size (bytes):	39368
Entropy (8bit):	5.464490993756563
Encrypted:	false
SSDEEP:	768:As0jROsaLYXeLFTolMRkHD+0wbc/mn/eHW888888888888888888888888888882:As0jROsaLYXeLFTolMRkHD+0wbc/mn/N
MD5:	21C83105ECC098CF6AB8F9EEE69C7F26
SHA1:	B30DB3A27843447D3A669EACECCB350FB141C368
SHA-256:	603FB6F80D5318808365564528584A8AEF1AB297DC4C57DE9CBDAE90F4C98102
SHA-512:	E039CCD557ADE8238F3ECF42875F0489EA10580091D7D89323E1431B5A1C88DD9FCFE6E01D6ED330BF388C2F0922349C1D190C0F24820535E03213AD10E4BA83
Malicious:	false
Preview:	BM.......6...(.......'............................... , , ,@L.\.\.`.`.e.e.e.e.e.e.e.e.e.e.e.e.e.d.e.d.d.e.e.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.e.d.d.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.`.`.\AX.H.H.H@,@,@8 ``p.p.p.p.q.q.q.q.q.q.q.q.q.q.q.q.q.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.p.p`p h.P.H.H@,@,@,.`.h.h.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l

C:\Program Files (x86)\YCI Copy\Skins\0\animation.gif (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	GIF image data, version 89a, 210 x 40
Category:	dropped
Size (bytes):	30091
Entropy (8bit):	7.803870213417715
Encrypted:	false
SSDEEP:	768:aDURxy09fZZEAauyPa5g008RG3WWJr11WDz:a3+Lauyi5g09G3JB1C
MD5:	597AC51A7BF2A5E5132E9468A1562777
SHA1:	CD55E3649E98E4C5377F570C999411053766C92D
SHA-256:	83EF37B5904A1C96D14C8E15C7CBF32460FE4B46A2D9E53FA0C52612287BC0E6
SHA-512:	F7C473F141407C6DACCAF2E853F4D078D576B98DB1730D9EF2885DD92910182DC21AC61297FE4AA927B46EFCCA630FC8B283E7922C6F2DA779343AA785B8A4B8
Malicious:	false
Preview:	GIF89a..(...........................z........2.7....................q....R..K..........P..."........Z..c.......[Y......N...................B..........t......5.k.......>=.$.....x.Y........................s...........................{..........Qir...{........d..y...+J..+.,.gy.T....L......H............%.................@.z...<0.................H.....m..5...r.........j........&........6.....51k......].\s\|.".:........:..........gi.......J..D..........n......v.....o\|..s...........r....:...w....................... ...............T..........H..k....J2..7.....v....A..4...^.H?y."....o{..:......{/.......22B...Ih....+.j..............P...W...................{.........JI.Ov..~...................~.........y..vZ............................p3:......!..NETSCAPE2.0.....!.......,......(........H.`..y...P....{..)H....3j.... Cr.. ..AIJ....(..&..I...8s.R....t.r.qU...d.\|.S2...G"rJ.J....P....W.G..X.[...Eux(c."J wQ..K.................`.....]....W.@#..L.2M2{...u....

C:\Program Files (x86)\YCI Copy\Skins\0\background.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 445 x 448 x 24, image size 598530, resolution 39 x 39 px/m, cbSize 598584, bits offset 54
Category:	dropped
Size (bytes):	598584
Entropy (8bit):	6.385544671312291
Encrypted:	false
SSDEEP:	6144:2SP7bwYzFLFUMRaE3Kn17sLXWSpgtnVV0dGGUIxr3Cew8Kvk8OE8ZO:2KbwYzvVKn17sLX9gtb0dGe3Cew82kc
MD5:	51052CFFA3B10856AA74C9E0E4962848
SHA1:	3C3633EF9AFE89CDF6E17D3A0E3018B66B6CED68
SHA-256:	CF910EF7223494FFC726E2B416E08D1D3E22A5D380DB1ECB2385D67FCE2EEF94
SHA-512:	1D42570502590C7FBA4ED0F56B096C5D2C1BEBFEE10E0E325C3199009C546CBE14A47182FCB78C3F0B211BDB093260B5D4FB3D989BC2CC22408448DC02B23695
Malicious:	false
Preview:	BM8"......6...(...................."..'...'.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\Skins\0\buynow.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 504 x 39 x 16, image size 39314, resolution 2834 x 2834 px/m, cbSize 39368, bits offset 54
Category:	dropped
Size (bytes):	39368
Entropy (8bit):	5.526214712530171
Encrypted:	false
SSDEEP:	768:ACEqpgekLNpIOgxQhavI5Se9QScfSKfhi888888888a888Af888888x+8FDixn4/:ACXpgekLNpIOgxQhavI5Se9QScfSK5iN
MD5:	419F6F155C68E4D52B797CCBB252E61B
SHA1:	BBBD691846820953D246C3A25F7B0150AC374F2E
SHA-256:	93C19A459DB12E52E98FF5E5B75CC5299913746D5754227403CEB80F62A9ABC7
SHA-512:	0C688F516D4E35FAE561FEB941462B8EA1CB4AC39886CA47043726203FC893CD1342B87EE57B429D7E2CAAE3C7937709D2D7B3BC3C0948D688C16B0E4923579E
Malicious:	false
Preview:	BM.......6...(.......'............................... , , ,@L.\.\.`.`.e.e.e.e.e.e.e.e.e.e.e.e.e.d.e.d.d.e.e.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.e.d.d.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.`.`.\AX.H.H.H@,@,@8 ``p.p.p.p.q.q.q.q.q.q.q.q.q.q.q.q.q.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.p.p`p h.P.H.H@,@,@,.`.h.h.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l

C:\Program Files (x86)\YCI Copy\Skins\0\close.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 78 x 24 x 16, image size 3746, resolution 2834 x 2834 px/m, cbSize 3800, bits offset 54
Category:	dropped
Size (bytes):	3800
Entropy (8bit):	5.7978909836269485
Encrypted:	false
SSDEEP:	96:zg6EHs+F+N7g2TARqG+4oZQlGD4fyjd8fDsE:zgB/FqTUwZQlGMa6fDsE
MD5:	A25C3E03B522C612ADC1C1B8C1936B53
SHA1:	A7EBB6CC919C2616CC9A04D965E2B5B0B13ED9E5
SHA-256:	3392338331EA57DA0DC3111AA6C2E4B7FDDAA67A162518DADD8D380AD07CA1F6
SHA-512:	B2BD246CDA52ED5E92EACD4D1E2579A9FE178C823C2B251CC51A4AD1D9CE42ED16137C51F10B781BBE574DD35D96946920546535DB3C834655F3C1CFCFD4813C
Malicious:	false
Preview:	BM........6...(...N....................................P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P@P.L.P.U#U#UCYC]ca.\ P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P@P.L.P.U#U#UCYC]C].X P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P@P.L.P#U#Y#YCYC]ca.X P.P.P.P.P.P.P.L.L.L.L.L.L.L.P H.H.e.v.~.~.~.~.zhr.e.aaT.L.L.L.L.L.L.L.L.L.L.L.L.P H.H.e.v..).).)..{.r.e.aaT.L.L.L.L.L.L.L.L.L.L.L.L.P H.@.aFr.z.z.~.~.zhr.ecaaT.L.L.L.L.L.L.L.L.L.L.L.H.@.Q.v.z.~.~.~.~.~.~.~.~Gn.e.X L.L.L.L.L.L.L.L.L.L.H.@.Q.v.~.~.~.~.~.~....*.Gn.e.X L.L.L.L.L.L.L.L.L.L.H.D.H.rDvcz.~.~.~.~.~.~.~Gn.a.X L.L.L.L.H.H.H.H.H.D <.e.z.~.~.~.~.~.~.~.~.~.~.~.v.e.X.H.H.H.H.H.H.H.H.D <.f.z..................%.H..v.e.X.H.H.H.H.H.H.H.H.H 8#Y.q"vBz.~.~.~.~.~.~.~.~.~.v.e.X.H.H.H.H.H.H.H.H.8.e.z.z.~.~.~.~.~.~.~.~.~.~.~.~.v.a.P.H.H.H.H.H.H.H.8.f.z.{#.#.$.$.$.$.$.$.$.$.$.G..{.a.P.H.H.H.H.H.H.H.8!].m.uBz.{...~.~.~.~.~.....~...v.a.P.H.H.H.H.H.H.<

C:\Program Files (x86)\YCI Copy\Skins\0\help.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 81 x 24 x 16, image size 3938, resolution 2834 x 2834 px/m, cbSize 3992, bits offset 54
Category:	dropped
Size (bytes):	3992
Entropy (8bit):	5.78690827623497
Encrypted:	false
SSDEEP:	96:Y3S3dVxZ9bf9Eic35eZaV79vY4n0FWfLmJTXE4g:Y3mT9VEvVdhYO0QjmK
MD5:	139C52B6C601D75A066AD37114AF56BE
SHA1:	E079FCA0883DF17E9B4179D263AF9253DE4BC9EA
SHA-256:	84D842E9783A5042DAA452C0E230DFA37DAC69685218B60CACC9A48170807A50
SHA-512:	754CEBB5361E70E38480BA12799FF6082A4A3F352D5FF43E482329F8701AB519C8A42B3C6ED4887D15849547D4F5423A172B9B65790274298DC09F62564AF50E
Malicious:	false
Preview:	BM........6...(...Q...............b...................tZ.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.PtZ.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.PtZ.P.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T...P.P.P.P.P.P.P P@P.L.P.U#U#UCYC]ca.X T.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P P@P.P.P.U#U#UCYC]ca.X T.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P P@P.P.P#U#Y#YCYC]ca.X T.P.P.P.P.P.P.P.P...L.L.L.L.L.L.P H.H.e.v.~.~.~.~.zhr.e.aaT.L.L.L.L.L.L.L.L.L.L.L.L.L.P H.H.e.v..).).)..{.r.ecaaT.L.L.L.L.L.L.L.L.L.L.L.L.L.P H.@.aFr.z.z.~.~.zhr.ecaaT.L.L.L.L.L.L.L...L.L.L.L.L.H.@.Q.v.z.~.~.~.~.~.~.~.~Gn.e.X L.L.L.L.L.L.L.L.L.L.L.H.@.Q.v.~.~.~.~.~.~....*.Gn.e.X L.L.L.L.L.L.L.L.L.L.L.H.D.H.rDvcz.z.~.~.~.~.~.~Gn.a.X L.L.L.L.L.L...H.H.H.H.D <.e.z.~.~.~.~.~.~.~.~.~.~.~.v.e.X.H.H.H.H.H.H.H.H.H.D <.f.z..................%.H..v.e.X.H.H.H.H.H.H.H.H.H.D 8#Y.q"vBz.z.~.....~.~.~.~.~.v.e.X.H.H.H.H.H...H.H.H.H.8.e.z.z.~.~.~.....~.~.~.~.~.~.~.v.a.P.H.H.H.H.H.H.H.H.8.f.z.{#.#.$.....$.$.$.$.$.$.G..{.a.P.H.H.H.H.H.H.H.H.8!].q.uBz

C:\Program Files (x86)\YCI Copy\Skins\0\is-040UV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 78 x 24 x 16, image size 3746, resolution 2834 x 2834 px/m, cbSize 3800, bits offset 54
Category:	dropped
Size (bytes):	3800
Entropy (8bit):	5.7978909836269485
Encrypted:	false
SSDEEP:	96:zg6EHs+F+N7g2TARqG+4oZQlGD4fyjd8fDsE:zgB/FqTUwZQlGMa6fDsE
MD5:	A25C3E03B522C612ADC1C1B8C1936B53
SHA1:	A7EBB6CC919C2616CC9A04D965E2B5B0B13ED9E5
SHA-256:	3392338331EA57DA0DC3111AA6C2E4B7FDDAA67A162518DADD8D380AD07CA1F6
SHA-512:	B2BD246CDA52ED5E92EACD4D1E2579A9FE178C823C2B251CC51A4AD1D9CE42ED16137C51F10B781BBE574DD35D96946920546535DB3C834655F3C1CFCFD4813C
Malicious:	false
Preview:	BM........6...(...N....................................P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P@P.L.P.U#U#UCYC]ca.\ P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P@P.L.P.U#U#UCYC]C].X P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P@P.L.P#U#Y#YCYC]ca.X P.P.P.P.P.P.P.L.L.L.L.L.L.L.P H.H.e.v.~.~.~.~.zhr.e.aaT.L.L.L.L.L.L.L.L.L.L.L.L.P H.H.e.v..).).)..{.r.e.aaT.L.L.L.L.L.L.L.L.L.L.L.L.P H.@.aFr.z.z.~.~.zhr.ecaaT.L.L.L.L.L.L.L.L.L.L.L.H.@.Q.v.z.~.~.~.~.~.~.~.~Gn.e.X L.L.L.L.L.L.L.L.L.L.H.@.Q.v.~.~.~.~.~.~....*.Gn.e.X L.L.L.L.L.L.L.L.L.L.H.D.H.rDvcz.~.~.~.~.~.~.~Gn.a.X L.L.L.L.H.H.H.H.H.D <.e.z.~.~.~.~.~.~.~.~.~.~.~.v.e.X.H.H.H.H.H.H.H.H.D <.f.z..................%.H..v.e.X.H.H.H.H.H.H.H.H.H 8#Y.q"vBz.~.~.~.~.~.~.~.~.~.v.e.X.H.H.H.H.H.H.H.H.8.e.z.z.~.~.~.~.~.~.~.~.~.~.~.~.v.a.P.H.H.H.H.H.H.H.8.f.z.{#.#.$.$.$.$.$.$.$.$.$.G..{.a.P.H.H.H.H.H.H.H.8!].m.uBz.{...~.~.~.~.~.....~...v.a.P.H.H.H.H.H.H.<

C:\Program Files (x86)\YCI Copy\Skins\0\is-66CFI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	GIF image data, version 89a, 210 x 40
Category:	dropped
Size (bytes):	30091
Entropy (8bit):	7.803870213417715
Encrypted:	false
SSDEEP:	768:aDURxy09fZZEAauyPa5g008RG3WWJr11WDz:a3+Lauyi5g09G3JB1C
MD5:	597AC51A7BF2A5E5132E9468A1562777
SHA1:	CD55E3649E98E4C5377F570C999411053766C92D
SHA-256:	83EF37B5904A1C96D14C8E15C7CBF32460FE4B46A2D9E53FA0C52612287BC0E6
SHA-512:	F7C473F141407C6DACCAF2E853F4D078D576B98DB1730D9EF2885DD92910182DC21AC61297FE4AA927B46EFCCA630FC8B283E7922C6F2DA779343AA785B8A4B8
Malicious:	false
Preview:	GIF89a..(...........................z........2.7....................q....R..K..........P..."........Z..c.......[Y......N...................B..........t......5.k.......>=.$.....x.Y........................s...........................{..........Qir...{........d..y...+J..+.,.gy.T....L......H............%.................@.z...<0.................H.....m..5...r.........j........&........6.....51k......].\s\|.".:........:..........gi.......J..D..........n......v.....o\|..s...........r....:...w....................... ...............T..........H..k....J2..7.....v....A..4...^.H?y."....o{..:......{/.......22B...Ih....+.j..............P...W...................{.........JI.Ov..~...................~.........y..vZ............................p3:......!..NETSCAPE2.0.....!.......,......(........H.`..y...P....{..)H....3j.... Cr.. ..AIJ....(..&..I...8s.R....t.r.qU...d.\|.S2...G"rJ.J....P....W.G..X.[...Eux(c."J wQ..K.................`.....]....W.@#..L.2M2{...u....

C:\Program Files (x86)\YCI Copy\Skins\0\is-70TUQ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	852
Entropy (8bit):	4.941995219252514
Encrypted:	false
SSDEEP:	24:Atfp8/Hp4Hkl33GTTln1mOnfeHpAGmDwKFOAO+:At68mHvH+NDwKFOAO+
MD5:	A898D6AFA05106F47E901E02A29B17B2
SHA1:	E71F95D9DEB1BDC93B826780ECD8AD280F5D9EB4
SHA-256:	B3CDF6933634825D7B9BE31FD9FE2D4BBEFF44EBFD74A2FBAFD31F009B55C4CE
SHA-512:	A322CDCF77B5C6844D26885807825C72CABBC5D5240783C7363D1F6025C02DB9F416BBB47DD874320FA71DC3657A55D606ED331F78A622B57BC6B2D9DB10317F
Malicious:	false
Preview:	[MainWnd]..MainWnd = background.bmp..MenuButtonSkin = menu.bmp, 3..MenuButtonPos = 20, 19..BuyNowButtonSkin = buynow.bmp, 3..BuyNowButtonPos = 134, 21..WebButtonSkin = Web.bmp, 3..WebButtonPos = 134, 20..HelpButtonSkin = help.bmp, 3..HelpButtonPos = 355, 5..MinButtonSkin = min.bmp, 3..MinButtonPos = 381, 5..ExitButtonSkin = close.bmp, 3..ExitButtonPos = 410, 5..SelectSourceButtonSkin = select.bmp, 3..SelectSourceButtonPos = 336, 211..SettingButtonSkin = Setting.bmp, 3..SettingButtonPos = 336, 294..CopyNowButtonSkin = CopyNow.bmp, 3..CopyNowButtonPos = 279, 355..SelectDistinationButtonSkin = select.bmp, 3..SelectDistinationButtonPos = 336, 262..DownButton1Skin = Down.bmp, 3..DownButton1Pos = 305, 296..DownButton2Skin = Down.bmp, 3..DownButton2Pos = 305, 241..DownButton3Skin = Down.bmp, 3..DownButton3Pos = 305, 184..Image1Skin =wizard.bmp....

C:\Program Files (x86)\YCI Copy\Skins\0\is-7G1ON.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 445 x 448 x 24, image size 598530, resolution 39 x 39 px/m, cbSize 598584, bits offset 54
Category:	dropped
Size (bytes):	598584
Entropy (8bit):	6.385544671312291
Encrypted:	false
SSDEEP:	6144:2SP7bwYzFLFUMRaE3Kn17sLXWSpgtnVV0dGGUIxr3Cew8Kvk8OE8ZO:2KbwYzvVKn17sLX9gtb0dGe3Cew82kc
MD5:	51052CFFA3B10856AA74C9E0E4962848
SHA1:	3C3633EF9AFE89CDF6E17D3A0E3018B66B6CED68
SHA-256:	CF910EF7223494FFC726E2B416E08D1D3E22A5D380DB1ECB2385D67FCE2EEF94
SHA-512:	1D42570502590C7FBA4ED0F56B096C5D2C1BEBFEE10E0E325C3199009C546CBE14A47182FCB78C3F0B211BDB093260B5D4FB3D989BC2CC22408448DC02B23695
Malicious:	false
Preview:	BM8"......6...(...................."..'...'.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\Skins\0\is-F77EH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 390 x 59 x 16, image size 46022, resolution 2834 x 2834 px/m, cbSize 46076, bits offset 54
Category:	dropped
Size (bytes):	46076
Entropy (8bit):	5.590224163777783
Encrypted:	false
SSDEEP:	384:nSvGr998Fv8AFRUhHfe5hFT86t6ATHcKZmExFc7CC4mPpmi1uVcLr8mwzxD1No:Sv89SFk8RUhm5MgFON4mpmi1uVIyNU
MD5:	8084AA277E5867E6F509CE32FEEAC738
SHA1:	B20719D3A8D63184D89870F1EBF51E5A5992C448
SHA-256:	F864347DD3D32408E1CCE4265BBDE9E37046637FD0822C5EA1C4E8C508035E52
SHA-512:	FFBA32EA08AAF5615E8E4FAC7A524C6F9448FDDB0FA59A8B3D7D9E16545F0FA3C607F45B43F90712095E954F3AD08D1EC4DE77612D3675E373E34AF4AB2FBD9B
Malicious:	false
Preview:	BM........6...(.......;..............................hQ.Y.m.m.m Y.M.MCM.M.H.H.H.H.H.H.@.@.@.@.8.8.8.8.4.4.4.4.4`,`,`,`,`,@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@(@$@$@$@$@$@$@$@$@(@(@$@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(`,.8.@.@.@.@.<J5J5J5.I.a.i.i.i U.I MDM.I.I.I.I.D.D.D.@.@.<.<.8.8.8.8.4.4.4.4`,`,`,`,`,`,@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@(@$@$@$@$@$@$@$@$@(@(@$@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(`,.4.<.<.<.<.@(9.1.1.I.a.m.m.m@].I MCM.I.I.I.I.H.H.D.D.D.<.<.8.8.8.8.0.0.0.0.0`,`,`,`,`,@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@$@(@$@$@$@$@$@$@$@$@(@(@$@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@$@(@(`,.8.@.@.@.<.@(9.1.1.i.m.m`i.M.MCM.M.H.H.H.H.H.@.@.@.@.8.8.8.4.4.4.8.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.X.`.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L

C:\Program Files (x86)\YCI Copy\Skins\0\is-H1AF8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 198 x 27 x 16, image size 10694, resolution 2834 x 2834 px/m, cbSize 10748, bits offset 54
Category:	dropped
Size (bytes):	10748
Entropy (8bit):	5.574494951933628
Encrypted:	false
SSDEEP:	192:kGXzPXx3XAeMaLkPL0RBB44OVuWAxvIsWWdi:kGXzv5XAeHL3v44xWAxnWWdi
MD5:	CAAF5EC446552532BEC48AABB5DB27F8
SHA1:	46D061CC12BA6DBF28611F3D1F8DF407FB0FF695
SHA-256:	082CB4D2CED2F50A87B5CFF9EADEA49489024D47F0D54EEB160AA84F6E21A06D
SHA-512:	10190DB5393CBAC6FAFB68B38829A2C03863FD7815FC624B0B80253DE3C8A2AA4E6E3374B8A46445881A6AA9CFC4774D9B99921D2E70DC5A71E3B1353D616633
Malicious:	false
Preview:	BM.)......6...(....................)...................V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.R.R.R.R.R.R.R.R.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.R.R.R.R.R.R.R.R.V.V.V.V.V.R.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.R.R.R.R.R.R.R.R.R.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.Z.Z.Z.Z.Z.V.R.R.R.R.R.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.Z.Z.Z.Z.Z.V.R.R.R.R.R.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.Z.Z.Z.Z.V.R.R.R.R.R.R.V.R.R.VtNSJTJuN.N.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.V.Z.Z.V.R.R.R.R.V.R.R.VtNSJtN.R.R.V

C:\Program Files (x86)\YCI Copy\Skins\0\is-HT3O0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 204 x 24 x 16, image size 9794, resolution 2834 x 2834 px/m, cbSize 9848, bits offset 54
Category:	dropped
Size (bytes):	9848
Entropy (8bit):	4.511926209315171
Encrypted:	false
SSDEEP:	48:pNww9YzyFomwnj4+T4nTMDoTMOjDawz5P:pMmob/sjXjDawz5P
MD5:	F946CC9149CD07679E53A9987DA304A8
SHA1:	5858413C5BE6AF9EFAD1A33429236045B74EE81B
SHA-256:	B97DA137E54850CCC842E6130F4D5148F33EF2D3F5CB51E9BC2351218D50E452
SHA-512:	BF3594C2AA09A4D25686DC7986FB063B1FDE7B66D1EF89C215A7FC3A9B4DD6598745777DCF25005D43918AEFA6C4BD570EB8DDE9F382615EEFD4D9AD524908C6
Malicious:	false
Preview:	BMx&......6...(...................B&...................<.<.<.<.<.8.4.0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.0.4.8.<.<.<.<.<.<.<.<.<.<.4.0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.0.4.<.<.<.<.<.<.<.<.<.<.0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.0.<.<.<.<.<.<.<.<.8`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.8.<.<.<.<.<.<.4`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.4.<.<.<.<.<.<.4`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.4.<.<.<.<.<.4`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0

C:\Program Files (x86)\YCI Copy\Skins\0\is-J00TF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 504 x 39 x 16, image size 39314, resolution 2834 x 2834 px/m, cbSize 39368, bits offset 54
Category:	dropped
Size (bytes):	39368
Entropy (8bit):	5.526214712530171
Encrypted:	false
SSDEEP:	768:ACEqpgekLNpIOgxQhavI5Se9QScfSKfhi888888888a888Af888888x+8FDixn4/:ACXpgekLNpIOgxQhavI5Se9QScfSK5iN
MD5:	419F6F155C68E4D52B797CCBB252E61B
SHA1:	BBBD691846820953D246C3A25F7B0150AC374F2E
SHA-256:	93C19A459DB12E52E98FF5E5B75CC5299913746D5754227403CEB80F62A9ABC7
SHA-512:	0C688F516D4E35FAE561FEB941462B8EA1CB4AC39886CA47043726203FC893CD1342B87EE57B429D7E2CAAE3C7937709D2D7B3BC3C0948D688C16B0E4923579E
Malicious:	false
Preview:	BM.......6...(.......'............................... , , ,@L.\.\.`.`.e.e.e.e.e.e.e.e.e.e.e.e.e.d.e.d.d.e.e.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.e.d.d.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.`.`.\AX.H.H.H@,@,@8 ``p.p.p.p.q.q.q.q.q.q.q.q.q.q.q.q.q.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.p.p`p h.P.H.H@,@,@,.`.h.h.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l

C:\Program Files (x86)\YCI Copy\Skins\0\is-L38PI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 340 x 224 x 24, resolution 2834 x 2834 px/m, cbSize 228536, bits offset 54
Category:	dropped
Size (bytes):	228536
Entropy (8bit):	3.9222343230790093
Encrypted:	false
SSDEEP:	1536:b+b4UzRbBVkabpmRH1zN2hhaZVYRNWs39Y2/bMzVn7z7wmMvUHhjb6f1PuSLyaz7:b+b4UzRbLkabsp15EI+eydUXXXgXto
MD5:	215F26873F9D872BDA8AACA9EB2EB6D5
SHA1:	5264C7FB1B5D42B184EB7D8468EAC1C1D23813A8
SHA-256:	B52C93CD2F14571108EE954D0AFC9561E6AFB0233937B56BAFF9C6C83BADCD3D
SHA-512:	058401EE5499D22ADF8000E81AFE3E92F5F30D8F091F77816755B7B422041D569297F6CBEAD079E59F712461028CF3C0A84C791FFFF10CC962244E89D7471436
Malicious:	false
Preview:	BM.\|......6...(...T.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\Skins\0\is-MI0KF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 81 x 24 x 16, image size 3938, resolution 2834 x 2834 px/m, cbSize 3992, bits offset 54
Category:	dropped
Size (bytes):	3992
Entropy (8bit):	5.78690827623497
Encrypted:	false
SSDEEP:	96:Y3S3dVxZ9bf9Eic35eZaV79vY4n0FWfLmJTXE4g:Y3mT9VEvVdhYO0QjmK
MD5:	139C52B6C601D75A066AD37114AF56BE
SHA1:	E079FCA0883DF17E9B4179D263AF9253DE4BC9EA
SHA-256:	84D842E9783A5042DAA452C0E230DFA37DAC69685218B60CACC9A48170807A50
SHA-512:	754CEBB5361E70E38480BA12799FF6082A4A3F352D5FF43E482329F8701AB519C8A42B3C6ED4887D15849547D4F5423A172B9B65790274298DC09F62564AF50E
Malicious:	false
Preview:	BM........6...(...Q...............b...................tZ.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.PtZ.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.PtZ.P.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T.T...P.P.P.P.P.P.P P@P.L.P.U#U#UCYC]ca.X T.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P P@P.P.P.U#U#UCYC]ca.X T.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P P@P.P.P#U#Y#YCYC]ca.X T.P.P.P.P.P.P.P.P...L.L.L.L.L.L.P H.H.e.v.~.~.~.~.zhr.e.aaT.L.L.L.L.L.L.L.L.L.L.L.L.L.P H.H.e.v..).).)..{.r.ecaaT.L.L.L.L.L.L.L.L.L.L.L.L.L.P H.@.aFr.z.z.~.~.zhr.ecaaT.L.L.L.L.L.L.L...L.L.L.L.L.H.@.Q.v.z.~.~.~.~.~.~.~.~Gn.e.X L.L.L.L.L.L.L.L.L.L.L.H.@.Q.v.~.~.~.~.~.~....*.Gn.e.X L.L.L.L.L.L.L.L.L.L.L.H.D.H.rDvcz.z.~.~.~.~.~.~Gn.a.X L.L.L.L.L.L...H.H.H.H.D <.e.z.~.~.~.~.~.~.~.~.~.~.~.v.e.X.H.H.H.H.H.H.H.H.H.D <.f.z..................%.H..v.e.X.H.H.H.H.H.H.H.H.H.D 8#Y.q"vBz.z.~.....~.~.~.~.~.v.e.X.H.H.H.H.H...H.H.H.H.8.e.z.z.~.~.~.....~.~.~.~.~.~.~.v.a.P.H.H.H.H.H.H.H.H.8.f.z.{#.#.$.....$.$.$.$.$.$.G..{.a.P.H.H.H.H.H.H.H.H.8!].q.uBz

C:\Program Files (x86)\YCI Copy\Skins\0\is-NHM4G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 153 x 240 x 16, image size 73922, resolution 2834 x 2834 px/m, cbSize 73976, bits offset 54
Category:	dropped
Size (bytes):	73976
Entropy (8bit):	4.272329656232792
Encrypted:	false
SSDEEP:	768:G0pgb+zAqbDZF3vy8JWArh1evhu2pvFev8xUV:QYnbDZF3q8kAdIU2pvFMD
MD5:	304E41C8108622A55A97B33388F21F37
SHA1:	E7C3E352A78DB1D5954719B088AA7F653775C763
SHA-256:	A6E558A84C0852A3A081F5E1ECE30420D5EB3AB9030D8AAE6AE59336E9D7DD92
SHA-512:	CA93CBD2EC967C22604E9D650084C07B19EDB0B415F76D155FBACDFBC3063AFC2E27CA9D99BB8ADDEDC8F2E219828466C2341CF210CD7E13165C74341610EF37
Malicious:	false
Preview:	BM. ......6...(.................... ..................@$@$@$.<.<@(@(@(@(@(@(@(@(@,@(@(@(@(@(@0@,@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@,`,.4.<.H.M M Q Q Q Q Q Q Q Q M@M.I.<.4`0@(@(@(@(@(@(@(@(@(@$@(@(@(@(@(@(@(`,`0.4.8.<.@.D.H.I.M.M M.M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M..@$@$@$.<@=`<@(@(@(@(@(@(@(@(@(@(@(@(@,@0@,@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@,`,.4.<.D.M M Q Q Q Q Q Q Q Q M@M.I.<.4`,@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(`,`0.4.8.@.D.H.I.M.M.M.M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M..@$@$@$`8.<.<`<@0`0`0`0`4`0@4@0@0@0`4`8`4@0@0@0@0@0@,@0@,@,@0@0@,@0@0@0@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(`,.4.<.D.I M Q Q Q Q Q Q Q Q M@I.D.8.4`,@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(`,`0.4.<.@.D.I.I.M.M.M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M..@$@$@$@(`4.<.<.<.<.<.<

C:\Program Files (x86)\YCI Copy\Skins\0\is-NJT1E.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 87 x 24 x 16, image size 4226, resolution 2834 x 2834 px/m, cbSize 4280, bits offset 54
Category:	dropped
Size (bytes):	4280
Entropy (8bit):	5.667361992445003
Encrypted:	false
SSDEEP:	96:O1IGSRz0EM9ms4lOUrjaI34zw2fLOsz4n:O11k0Z9bcUDjOj
MD5:	963411DC1287D59E23227B8E8ADA5F98
SHA1:	46452B287BFA315F93B86A14F5A4EE1DE8C0DC84
SHA-256:	9683438680651690F669A094FEFD7848DDF63ED8EB80078974931AD8BE7843B7
SHA-512:	5FF536A7E4F8B3F29DB79DF299C9915DB05EFEDFDD795D81D50D98820C4A3D13473167A7E47636AC6C29A9FF90FD18460A8CEB1441B2747389E0AD23F062815C
Malicious:	false
Preview:	BM........6...(...W....................................P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P...P.P.P.P.P.P.P.P.P.P@P.L.P.U#U#UCYC]ca.\ P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P@P.L.P.U#U#UCYC]C].X P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P@P.L.P#U#Y#YCYC]ca.X P.P.P.P.P.P.P.P.P...L.L.L.L.L.L.L.L.P H.H.e.v.~.~.~.~.zhr.e.aaT.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.P H.H.e.v..).).)..{.r.e.aaT.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.P H.@.aFr.z.z.~.~.zhr.ecaaT.L.L.L.L.L.L.L...L.L.L.L.L.L.L.H.@.Q.v.z.~.~.~.~.~.~.~.~Fn.e.X L.L.L.L.L.L.L.L.L.L.L.L.L.H.@.Q.v.~.~.~.~.~.~....*.Gn.e.X L.L.L.L.L.L.L.L.L.L.L.L.L.H.@.H.rDvcz.~.~.~.~.~.~.~Gn.a.X L.L.L.L.L.L...H.H.H.H.H.H.D <.e.z.~.~.~.~.~.~.~.~.~.~.~.v.e.X.H.H.H.H.H.H.H.H.H.H.H.D <.f.z..................%.H..v.e.X.H.H.H.H.H.H.H.H.H.H.H.H 8#Y.q"vBz.z.~.~.~.~.~.~.~.~.v.e.X.H.H.H.H.H...H.H.H.H.H.H.8.e.z.z.~.~.~.~.~.~.~.~.~.~.~.~.v.a.P.H.H.H.H.H.H.H.H

C:\Program Files (x86)\YCI Copy\Skins\0\is-NRTMC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 51 x 17 x 16, image size 1770, resolution 2834 x 2834 px/m, cbSize 1824, bits offset 54
Category:	dropped
Size (bytes):	1824
Entropy (8bit):	4.799241586593005
Encrypted:	false
SSDEEP:	24:9l0QuB6RuCqhRYIfaniLxOoFDdlBDxWLjCw/zTQzN:H0Qu0uCqhRNiWVFRjxqjCw/Q
MD5:	B495B2F7D809C1777F0C77DA87A144D8
SHA1:	ED8DF7F99846EBA1C89D69EA46C1D60DEF91A2D3
SHA-256:	DC4C8E98CAC6069650E1BDDCC9F4188DCA77F1AE5119629786248F3ACB868447
SHA-512:	F513168E85E704E4F0FE39E667BB08F732D53D113E0C13FB552E374CE3EA6A2B8EF4123D110E2EA2763E2B5A9F694E2A18A60050B75B26605DD4E2046E6A5274
Malicious:	false
Preview:	BM .......6...(...3....................................X@H`8`0`0`0`0`0`0`0`0`0`0`0`8@H.X.X@H`8`0`0`0`0`0`0`0`0`0`0`0`8@H.X.X@H`8`0`0`0`0`0`0`0`0`0`0`0`8@H.X.. H.0.H.T.] a e e e e e e e e@].0 H H.0@U.i.u.y.}.}.}.}.}.}.}.~ n.4 H H.0.H.T.] a e e e e e e e e@].0 H..`8.D`H.L.T.X.\.\.X.\.\.\.\ \.`@Y`8`8.M.` l.t.x.\|.\|.\|.\|.\|.\|.\| \|.}.j`8`8.D`H.L.T.X.\.\.X.\.\.\.\ \.`@Y`8..`0.H.H.P.X.\.\.\.\.\.\.\.\.\ \ e`0`0.Y `.l.t.x.\|.\|.\|.\|.\|.\|.\|.\| \|.y`0`0.H.H.P.X.\.\.\.\.\.\.\.\.\ \ e`0..`0.H.H.P.X.\.`.`.`.`.`.`.`.`.` e`0`0.X.`.l.t.x.\|.\|.\|.\|.\|.\|.\|.\|.\|.y`0`0.H.H.P.X.\.`.`.`(..`.`.`.`.` e`0..`0.H.L.T.\.`.`.`(..`.`.`.`.`.` i`0`0.X.`.l.t.x.\|.\|(..\|.\|.\|.\|.\|.\|.y`0`0.H.L.T.\.`.`.`(.(.(..`.`.`.` i`0..`0.L.L.T.\.`.d(.(.(..d.d.d.d.d i`0`0.X.`.l.t.x.\|(.(.(..\|.\|.\|.\|.\|.y`0`0.L.L.T.\.`.d(.(.(.(.(..d.d.d i`0..`0.L.P.X.`.d(.(.(.(.(..h.h.h.h m`0`0.X.`.l.t.x(.(.(.(.(..\|.\|.\|.\|.y`0`0.L.P.X.`.d(.(.(..D(.(.(..h.h m`0..`0.L.P.X.`(.(.(..D(.(.(..h.h.h m`0`0.X.`.l.t(.(.(..D(.(.(..\|.\|.\|.y`0`0.L.P.X.`(.(.(..D.D.h(.(.(..h m`0..`0.L.`.d..

C:\Program Files (x86)\YCI Copy\Skins\0\is-QPB9C.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 204 x 24 x 16, image size 9794, resolution 2834 x 2834 px/m, cbSize 9848, bits offset 54
Category:	dropped
Size (bytes):	9848
Entropy (8bit):	4.51614322719702
Encrypted:	false
SSDEEP:	24:phjzYxpYHYqYgy1O2cDKaUNmFWZoEjR6ngY4cQXTMfoUMsqonHQQfkoF1:phlWZoEknP4cMTMfoUMsqQv5P
MD5:	3C3632BDE50FA5F1DBBC7E918BD6A5CA
SHA1:	BF806CD682A3E8B40CED2FE3245F3E0E617A5E44
SHA-256:	FD009AD2E470115E99BCB56A4B6063341F8744E54C50C266D6DE93610425490A
SHA-512:	132EDB9BFF32F034C259F52A7FD29B73070E9CB6C056E05A10BC07E89540E16C0010EF661F018D6595484529391B6F4F695FE4B4B540AB07E44C68E698A8E3FB
Malicious:	false
Preview:	BMx&......6...(...................B&...................<.<.<.<.<.8.4.0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.0.4.8.<.<.<.<.<.<.<.<.<.<.4.0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.0.4.<.<.<.<.<.<.<.<.<.<.0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.0.<.<.<.<.<.<.<.<.8`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.8.<.<.<.<.<.<.4`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.4.<.<.<.<.<.<.4`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.4.<.<.<.<.<.4`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0

C:\Program Files (x86)\YCI Copy\Skins\0\is-TH15G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 504 x 39 x 16, image size 39314, resolution 2834 x 2834 px/m, cbSize 39368, bits offset 54
Category:	dropped
Size (bytes):	39368
Entropy (8bit):	5.464490993756563
Encrypted:	false
SSDEEP:	768:As0jROsaLYXeLFTolMRkHD+0wbc/mn/eHW888888888888888888888888888882:As0jROsaLYXeLFTolMRkHD+0wbc/mn/N
MD5:	21C83105ECC098CF6AB8F9EEE69C7F26
SHA1:	B30DB3A27843447D3A669EACECCB350FB141C368
SHA-256:	603FB6F80D5318808365564528584A8AEF1AB297DC4C57DE9CBDAE90F4C98102
SHA-512:	E039CCD557ADE8238F3ECF42875F0489EA10580091D7D89323E1431B5A1C88DD9FCFE6E01D6ED330BF388C2F0922349C1D190C0F24820535E03213AD10E4BA83
Malicious:	false
Preview:	BM.......6...(.......'............................... , , ,@L.\.\.`.`.e.e.e.e.e.e.e.e.e.e.e.e.e.d.e.d.d.e.e.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.d.e.d.d.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.`.`.\AX.H.H.H@,@,@8 ``p.p.p.p.q.q.q.q.q.q.q.q.q.q.q.q.q.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.p.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.q.p.p`p h.P.H.H@,@,@,.`.h.h.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l.l

C:\Program Files (x86)\YCI Copy\Skins\0\menu.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 198 x 27 x 16, image size 10694, resolution 2834 x 2834 px/m, cbSize 10748, bits offset 54
Category:	dropped
Size (bytes):	10748
Entropy (8bit):	5.574494951933628
Encrypted:	false
SSDEEP:	192:kGXzPXx3XAeMaLkPL0RBB44OVuWAxvIsWWdi:kGXzv5XAeHL3v44xWAxnWWdi
MD5:	CAAF5EC446552532BEC48AABB5DB27F8
SHA1:	46D061CC12BA6DBF28611F3D1F8DF407FB0FF695
SHA-256:	082CB4D2CED2F50A87B5CFF9EADEA49489024D47F0D54EEB160AA84F6E21A06D
SHA-512:	10190DB5393CBAC6FAFB68B38829A2C03863FD7815FC624B0B80253DE3C8A2AA4E6E3374B8A46445881A6AA9CFC4774D9B99921D2E70DC5A71E3B1353D616633
Malicious:	false
Preview:	BM.)......6...(....................)...................V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.R.R.R.R.R.R.R.R.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.R.R.R.R.R.R.R.R.V.V.V.V.V.R.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.R.R.R.R.R.R.R.R.R.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.Z.Z.Z.Z.Z.V.R.R.R.R.R.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.Z.Z.Z.Z.Z.V.R.R.R.R.R.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.V.Z.Z.Z.Z.V.R.R.R.R.R.R.V.R.R.VtNSJTJuN.N.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.R.V.Z.Z.V.R.R.R.R.V.R.R.VtNSJtN.R.R.V

C:\Program Files (x86)\YCI Copy\Skins\0\min.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 87 x 24 x 16, image size 4226, resolution 2834 x 2834 px/m, cbSize 4280, bits offset 54
Category:	dropped
Size (bytes):	4280
Entropy (8bit):	5.667361992445003
Encrypted:	false
SSDEEP:	96:O1IGSRz0EM9ms4lOUrjaI34zw2fLOsz4n:O11k0Z9bcUDjOj
MD5:	963411DC1287D59E23227B8E8ADA5F98
SHA1:	46452B287BFA315F93B86A14F5A4EE1DE8C0DC84
SHA-256:	9683438680651690F669A094FEFD7848DDF63ED8EB80078974931AD8BE7843B7
SHA-512:	5FF536A7E4F8B3F29DB79DF299C9915DB05EFEDFDD795D81D50D98820C4A3D13473167A7E47636AC6C29A9FF90FD18460A8CEB1441B2747389E0AD23F062815C
Malicious:	false
Preview:	BM........6...(...W....................................P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P...P.P.P.P.P.P.P.P.P.P@P.L.P.U#U#UCYC]ca.\ P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P@P.L.P.U#U#UCYC]C].X P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P.P@P.L.P#U#Y#YCYC]ca.X P.P.P.P.P.P.P.P.P...L.L.L.L.L.L.L.L.P H.H.e.v.~.~.~.~.zhr.e.aaT.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.P H.H.e.v..).).)..{.r.e.aaT.L.L.L.L.L.L.L.L.L.L.L.L.L.L.L.P H.@.aFr.z.z.~.~.zhr.ecaaT.L.L.L.L.L.L.L...L.L.L.L.L.L.L.H.@.Q.v.z.~.~.~.~.~.~.~.~Fn.e.X L.L.L.L.L.L.L.L.L.L.L.L.L.H.@.Q.v.~.~.~.~.~.~....*.Gn.e.X L.L.L.L.L.L.L.L.L.L.L.L.L.H.@.H.rDvcz.~.~.~.~.~.~.~Gn.a.X L.L.L.L.L.L...H.H.H.H.H.H.D <.e.z.~.~.~.~.~.~.~.~.~.~.~.v.e.X.H.H.H.H.H.H.H.H.H.H.H.D <.f.z..................%.H..v.e.X.H.H.H.H.H.H.H.H.H.H.H.H 8#Y.q"vBz.z.~.~.~.~.~.~.~.~.v.e.X.H.H.H.H.H...H.H.H.H.H.H.8.e.z.z.~.~.~.~.~.~.~.~.~.~.~.~.v.a.P.H.H.H.H.H.H.H.H

C:\Program Files (x86)\YCI Copy\Skins\0\select.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 204 x 24 x 16, image size 9794, resolution 2834 x 2834 px/m, cbSize 9848, bits offset 54
Category:	dropped
Size (bytes):	9848
Entropy (8bit):	4.511926209315171
Encrypted:	false
SSDEEP:	48:pNww9YzyFomwnj4+T4nTMDoTMOjDawz5P:pMmob/sjXjDawz5P
MD5:	F946CC9149CD07679E53A9987DA304A8
SHA1:	5858413C5BE6AF9EFAD1A33429236045B74EE81B
SHA-256:	B97DA137E54850CCC842E6130F4D5148F33EF2D3F5CB51E9BC2351218D50E452
SHA-512:	BF3594C2AA09A4D25686DC7986FB063B1FDE7B66D1EF89C215A7FC3A9B4DD6598745777DCF25005D43918AEFA6C4BD570EB8DDE9F382615EEFD4D9AD524908C6
Malicious:	false
Preview:	BMx&......6...(...................B&...................<.<.<.<.<.8.4.0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.0.4.8.<.<.<.<.<.<.<.<.<.<.4.0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.0.4.<.<.<.<.<.<.<.<.<.<.0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.0.<.<.<.<.<.<.<.<.8`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.8.<.<.<.<.<.<.4`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.4.<.<.<.<.<.<.4`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0.4.<.<.<.<.<.4`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0

C:\Program Files (x86)\YCI Copy\Skins\0\skin.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	852
Entropy (8bit):	4.941995219252514
Encrypted:	false
SSDEEP:	24:Atfp8/Hp4Hkl33GTTln1mOnfeHpAGmDwKFOAO+:At68mHvH+NDwKFOAO+
MD5:	A898D6AFA05106F47E901E02A29B17B2
SHA1:	E71F95D9DEB1BDC93B826780ECD8AD280F5D9EB4
SHA-256:	B3CDF6933634825D7B9BE31FD9FE2D4BBEFF44EBFD74A2FBAFD31F009B55C4CE
SHA-512:	A322CDCF77B5C6844D26885807825C72CABBC5D5240783C7363D1F6025C02DB9F416BBB47DD874320FA71DC3657A55D606ED331F78A622B57BC6B2D9DB10317F
Malicious:	false
Preview:	[MainWnd]..MainWnd = background.bmp..MenuButtonSkin = menu.bmp, 3..MenuButtonPos = 20, 19..BuyNowButtonSkin = buynow.bmp, 3..BuyNowButtonPos = 134, 21..WebButtonSkin = Web.bmp, 3..WebButtonPos = 134, 20..HelpButtonSkin = help.bmp, 3..HelpButtonPos = 355, 5..MinButtonSkin = min.bmp, 3..MinButtonPos = 381, 5..ExitButtonSkin = close.bmp, 3..ExitButtonPos = 410, 5..SelectSourceButtonSkin = select.bmp, 3..SelectSourceButtonPos = 336, 211..SettingButtonSkin = Setting.bmp, 3..SettingButtonPos = 336, 294..CopyNowButtonSkin = CopyNow.bmp, 3..CopyNowButtonPos = 279, 355..SelectDistinationButtonSkin = select.bmp, 3..SelectDistinationButtonPos = 336, 262..DownButton1Skin = Down.bmp, 3..DownButton1Pos = 305, 296..DownButton2Skin = Down.bmp, 3..DownButton2Pos = 305, 241..DownButton3Skin = Down.bmp, 3..DownButton3Pos = 305, 184..Image1Skin =wizard.bmp....

C:\Program Files (x86)\YCI Copy\Skins\0\wizard.bmp (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PC bitmap, Windows 3.x format, 153 x 240 x 16, image size 73922, resolution 2834 x 2834 px/m, cbSize 73976, bits offset 54
Category:	dropped
Size (bytes):	73976
Entropy (8bit):	4.272329656232792
Encrypted:	false
SSDEEP:	768:G0pgb+zAqbDZF3vy8JWArh1evhu2pvFev8xUV:QYnbDZF3q8kAdIU2pvFMD
MD5:	304E41C8108622A55A97B33388F21F37
SHA1:	E7C3E352A78DB1D5954719B088AA7F653775C763
SHA-256:	A6E558A84C0852A3A081F5E1ECE30420D5EB3AB9030D8AAE6AE59336E9D7DD92
SHA-512:	CA93CBD2EC967C22604E9D650084C07B19EDB0B415F76D155FBACDFBC3063AFC2E27CA9D99BB8ADDEDC8F2E219828466C2341CF210CD7E13165C74341610EF37
Malicious:	false
Preview:	BM. ......6...(.................... ..................@$@$@$.<.<@(@(@(@(@(@(@(@(@,@(@(@(@(@(@0@,@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@,`,.4.<.H.M M Q Q Q Q Q Q Q Q M@M.I.<.4`0@(@(@(@(@(@(@(@(@(@$@(@(@(@(@(@(@(`,`0.4.8.<.@.D.H.I.M.M M.M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M..@$@$@$.<@=`<@(@(@(@(@(@(@(@(@(@(@(@(@,@0@,@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@,`,.4.<.D.M M Q Q Q Q Q Q Q Q M@M.I.<.4`,@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(`,`0.4.8.@.D.H.I.M.M.M.M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M..@$@$@$`8.<.<`<@0`0`0`0`4`0@4@0@0@0`4`8`4@0@0@0@0@0@,@0@,@,@0@0@,@0@0@0@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(`,.4.<.D.I M Q Q Q Q Q Q Q Q M@I.D.8.4`,@(@(@(@(@(@(@(@(@(@(@(@(@(@(@(`,`0.4.<.@.D.I.I.M.M.M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M M..@$@$@$@(`4.<.<.<.<.<.<

C:\Program Files (x86)\YCI Copy\VideoBurn.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1003008
Entropy (8bit):	6.164306378761739
Encrypted:	false
SSDEEP:	12288:/9R5+9E2e0I5pHg9GcosSX5/8uEHxILa919VTtCYWrg/esogiBTZVHVezcSarEx:/66r5pdckUH91IYWPnr
MD5:	F4A0F0C95015108F36F2932BECDEB143
SHA1:	69418454D9900A7AE571C842E305F8C62197810F
SHA-256:	C2D39A55308388332B20BFD4834941536B70F76C64FD6C5ADAD43702A9B1D023
SHA-512:	2340B6C35F44D723D51D16D5114724348BAE947F45E19F397275581340AC919DCF7F62DD133498DF1F95EDCE3C070EEAD0F35C8E618CB42BDA5CE64522CD4ABD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L......B...........#..............................@..............................................................................)...0....................... ..$....................................................................................text............................... ..`.data...............................@....tls.................l..............@....idata...0.......*...n..............@..@.edata... ..........................@..@.rsrc........0......................@..@

C:\Program Files (x86)\YCI Copy\WinDVDCOPY.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	MS Windows 95 Internet shortcut text (URL=<http://www.winavi.com>), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.527681138773587
Encrypted:	false
SSDEEP:	3:HRAbABGQYm/0S4+MLGm:HRYFVm/r4nGm
MD5:	4CECA5E98A192A7839A6B315C28F9C9D
SHA1:	6EECEDD76B6B8B189723BFBF209DDB6F5AD49B3A
SHA-256:	B675A0CE4FEAA6C159B448820C1F99F3F8346DF8CB4BC818AB58C298A2EE4F7E
SHA-512:	C0B17578B6A8432323B74855743E5881C55DC725FA822F78FB74EC5BCB19967F2CA95B53F497642E375CDEF2A2F8F60C5D6B42294E7E34C454D43577FB1C26EE
Malicious:	false
Preview:	[InternetShortcut]..URL=http://www.winavi.com..

C:\Program Files (x86)\YCI Copy\is-0I6OU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	4.84171345916617
Encrypted:	false
SSDEEP:	768:U96Xm6aUW88ijA697M1hWxTxPQumVi4wf8z8ngwsWDkE0Kmao4hqF02nhaW:XXm6tF8is69sUTlP6lVfizoui02nhaW
MD5:	462E5732075713653B121B1819606F45
SHA1:	50D20651D1EA29333582FEAE246221F212D3284F
SHA-256:	F64D390A0816E33ECF0A992738D565C8627970163B22902FE8D5004A472F6D5A
SHA-512:	989E362CB05DABBD2F466A70B655A87EE9E96F738581B3ED5AB111762B6062C9EB84FCB5E3CEA1C1805958B1DF27D560AE6D76060E7EB969C7DAF60717367159
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8.4MY.gMY.gMY.g"F.gEY.g.E.gXY.g"F.gpY.gMY.g.Y.g/F.gNY.g.z.gLY.g.z.gDY.g.{.gLY.g.y.gLY.gRichMY.g................PE..L....jrB...........!..........A......`........................................B.........................................a.......(............................PB.H....................................................................................text............................... ..`.rdata..............................@..@.data....sA......P..................@....reloc..&?...PB..@... ..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\is-2BLD0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	ISO-8859 text, with very long lines (772), with CRLF line terminators
Category:	dropped
Size (bytes):	3967
Entropy (8bit):	4.952533365596146
Encrypted:	false
SSDEEP:	96:dhT3fqmEWbmAiCqFh9DsZmQ+tvN9gIhCIoP3:dhT3fDv7REh96GN9nhCIw3
MD5:	4FAED84D38ED7879299CD34D8D2E0D61
SHA1:	4ECC1EAAD37A003DC0542DD20931ACB5C8B8E2CC
SHA-256:	EE53C85A8247388D3F1FDFD2682803F858EB161B2537F1FE17C919A58530B764
SHA-512:	5E731A86C38892080877E08F76F5589AEF648D97AA37C3957B7084009CCE7D8C89FD5BC6C21C6132F3ACBAECFF52A37F7FD431D04C931ED53A64329656607A80
Malicious:	false
Preview:	**************************************************.. WinAVI DVD Copy Readme.... Copyright(C) 2005 ZJMedia Digital Technology Ltd... All Rights Reserved.. **************************************************....Thank you for using WinAVI DVD Copy!....This README file contains the latest information about WinAVI DVD Copy. For the complete WinAVI DVD Copy instructions and usage, please refer to the help. For purchase information, please visit http://www.winavi.com.....======================================..About WinAVI DVD Copy..=================================-====..WinAVI DVD Copy is a very useful software program for backing up your DVD movies. By using WinAVI DVD Copy, you can easily copy your whole DVD collection at a fast speed while giving you an exact copy of your DVD. ..WinAVI DVD Copy has a user friendly interface which makes copying your DVD..s more convenient. W

C:\Program Files (x86)\YCI Copy\is-64DNJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	5.159573737733904
Encrypted:	false
SSDEEP:	1536:TT3OYTOOZyjVVbiCT1K4dTPN18SPWoYxEh:neV5BpiCT1K4xPT82WoYxq
MD5:	A962DA75BA5D9AB697F20DD8A57E440B
SHA1:	BE0CC8BFFFA757076FC7C0C4C6FCDB715EDC1543
SHA-256:	3C4AE73B75C5A1F298198F9CAB9ECF1CB2A5A4A039F8BD68BDB1B9EF04C02AF5
SHA-512:	5404994F2443FA4AFF89CCE0FE17E0F1DF38922784D2A4244B81F8D58C194EB5D44B278789318FEF80BBB27096048A70141378BF22DE182230A577DB9BE4920D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............K...K...K..K...K;..K...K..K..K..K...K...K.K.K...KG..K...KRich...K................PE..L.....\B...........!.................!.......................................`..........................................Q.......<............................@.......................................................... ............................text...z........................... ..`.rdata..!........ ..................@..@.data...0M.......@..................@....reloc.......@... ...0..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\is-ER9BI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	200704
Entropy (8bit):	4.881978838245314
Encrypted:	false
SSDEEP:	3072:BAdGrwHfH1hauadHSloeLuRd0EhoHHMkH:6bvl8SKeyRFYs
MD5:	C2329E1092D9061409B539CA84ED5245
SHA1:	1A6E4F44B4A7964582C24FC38B427B5AB062B5A4
SHA-256:	C58539D4F38D8033F24359A4224B58F30484FA4EA02D71186632F81BFE900773
SHA-512:	0EFA395B1C2492CD565709EDB0E9BF403FDE725CC4B12228256F2FEBD9ACEBE070A39315ACA9FD6B67DDB7846C77FEC30E8A96DDB370D55CC4644AC7C05AEFF9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s.y.7..J7..J7..JX..J6..JX..J0..JL..J5..J...J ..J...JE..J7..J>..JU..J0..J7..JU..J...J-..J...J6..JRich7..J........PE..L...T..B...........!.....`... ...............p..........................................................................Q...`...x............................p.......................................................p...............................text...f[.......`.................. ..`.rdata..a$...p...0...p..............@..@.data...4........P..................@....reloc.......p... ..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\is-FLDF5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1003008
Entropy (8bit):	6.164306378761739
Encrypted:	false
SSDEEP:	12288:/9R5+9E2e0I5pHg9GcosSX5/8uEHxILa919VTtCYWrg/esogiBTZVHVezcSarEx:/66r5pdckUH91IYWPnr
MD5:	F4A0F0C95015108F36F2932BECDEB143
SHA1:	69418454D9900A7AE571C842E305F8C62197810F
SHA-256:	C2D39A55308388332B20BFD4834941536B70F76C64FD6C5ADAD43702A9B1D023
SHA-512:	2340B6C35F44D723D51D16D5114724348BAE947F45E19F397275581340AC919DCF7F62DD133498DF1F95EDCE3C070EEAD0F35C8E618CB42BDA5CE64522CD4ABD
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L......B...........#..............................@..............................................................................)...0....................... ..$....................................................................................text............................... ..`.data...............................@....tls.................l..............@....idata...0.......*...n..............@..@.edata... ..........................@..@.rsrc........0......................@..@

C:\Program Files (x86)\YCI Copy\is-H0QO1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	946688
Entropy (8bit):	6.590259013061352
Encrypted:	false
SSDEEP:	12288:Jo/c4LjEojQ4iz87llSwKjlvrHRvBgcL3gWOZZ4oW9n+suuEk1Mfw+X7r:JofLIhDSmDlvjRvBLglDvi+rG+Lr
MD5:	872A4D2C6BC01ACE5C2A8B95EE2EAE2D
SHA1:	331C7A54DE34F1FA206296BC859362C61AABECAC
SHA-256:	22EBB7A2064F833D1B25D14E5D152FBD924D0B17B3ABC4851059894CEBE46793
SHA-512:	EFD48386EED6ECF2B6DFC197F9202A6727F3219975DEC5E8B467FB604AC6A4D9337FCABB925E1252E24156C7E7B6226AA22BA10651A4A6574DD10FC5E3DD60F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L.....B...........#.....`... ......$........p....@.....................................................................&z.......+...P....................... ..@....................................................................................text....`.......\.................. ..`.data.... ...p.......b..............@....tls.................2..............@....idata...0.......,...4..............@..@.edata...........\|...`..............@..@.rsrc........P......................@..@

C:\Program Files (x86)\YCI Copy\is-IAPSA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2329088
Entropy (8bit):	7.7722221954842245
Encrypted:	false
SSDEEP:	49152:j1xHIBA+NltzC+4ij8QAF4CO4DX2US9s0RI3+ThdRB:uA4lNAi2gHi+T
MD5:	DA7C7C802E2164A70B460B5163AFDEC4
SHA1:	16899726E571A5CD3C686888EB6FDEB2EE21A61B
SHA-256:	2A99537198B8D97B067CC3C3A9C17B2EB396435AF9E1756D6025FF563032BE46
SHA-512:	D74C04E0EEB2273F46BF38A3B8ECE0CC5C0C57094A942EFE29B6193092DF1A5DE8D8D122F0F3F8C84E88FB60D4289846925CFE5A82B16951DF6FFA026109EFE4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_.....................$......`R............@.........................................................................X...............................................................0........................................................text...T........................... ..`.rdata..j+.......,..................@..@.data..../.......,..................@....tls................................@....fxm.... ...........................`..`.rsrc.................".............@..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\is-J9NT4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	5.667262138418869
Encrypted:	false
SSDEEP:	1536:ream20MuBpo4VeKNYTkeiLyeHjUFTevbfO1BYbb90ruzWQiGoB5iwnfFF:vOymRBj0godGoHJ
MD5:	41E7BC59744793C3A4796183274FC636
SHA1:	B16A4D725A7B336C1F88A6C46DAECEBD8B0E5D75
SHA-256:	509EE2C151EA02878E8FAC24D37176700DB64B1529EC863928B8A08BD71BDAC5
SHA-512:	2292A31F8DF978E3411F9892F9F5B0157AAAA8F26B1ECEFFC7D55D2766E4C1948ABE318E346CB17EF8B4232C8E6F35936A2C73C1850B1C17B4E5F4C61AE7767A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-t.i...i...i.......m.......u..._3......i...m.......l...i...6..._3..f...5..h...Richi...................PE..L......B...........!.....p..........K........................................@.........................................T.......P............................ ..........................................................`............................text....e.......p.................. ..`.rdata..$........ ..................@..@.data............p..................@....reloc....... ... ..................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\is-K70RL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.984301218238288
Encrypted:	false
SSDEEP:	1536:5Vfv9SkK89JZKSbGcwTfJS7YkS14oFb2BoBpRApzP7lQuVNOd0:5x9SI9PKeGcG/xinBoBpWpzP7lQuVNI
MD5:	167566A7781E7E0C4A70A01591A9FA9C
SHA1:	342D2C172E52FAFE64E693EE201E1487474A78E8
SHA-256:	A7C711845D3B80547A3004767D0E575E9F8A8DB077E3CA1B477931DCCD4F861B
SHA-512:	CEB4317082D05CDA2F42EBE23E707732BEE02B1BE7A8F4CCC679CA75A8A8280BD0E308DDAD54658AAC96E73CF89C602C76CE5F671260C4EE2DED4081F4DB4921
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1..._..._..._..S..._...U..._...Q..._..._..._...L..._...^.._...T..._...[..._.Rich.._.........PE..L... ..B...........!.........p......XA....................................... .........................................S...$...P....................................................................................................................text...v........................... ..`.rdata..C...........................@..@.data...<M.......@..................@....reloc..............................@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\YCI Copy\is-OE9O8.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2589527
Entropy (8bit):	6.373531593126736
Encrypted:	false
SSDEEP:	49152:NR/KpmZubPf2S8W2ILeWl+C1p9jWy5Snd0eig6NQ:z/jtYLP1Sy5E0y
MD5:	1B10BB12643856747BDBD83D2ECEEED8
SHA1:	FDB2B85931AD4EF9833E80B69EA1D4ECE847BB39
SHA-256:	84F532F2C79D65AF361FF4FF4DF709D849FACE9F5C402944FFD5F6432DB845C5
SHA-512:	68F1EAD0C3361192269309419DB4B62B7CCCDCA6EA4E0BFB56FB56718A65929458D9F2EEFDD016708368FBED4D072032C89869116D6333D43F02EEF918430F42
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......^..................%..\|........%.......%...@...........................(...........@......@....................'.......&..5...0'...................................................... '.....................L.&.H.....&......................text.....%.......%................. ..`.itext...&....%..(....%............. ..`.data...dZ....%..\....%.............@....bss.....x...0&..........................idata...5....&..6....&.............@....didata.......&......@&.............@....edata........'......J&.............@..@.tls....D.....'..........................rdata..].... '......L&.............@..@.rsrc........0'......N&.............@..@............. (......<'.............@..@........................................................

C:\Program Files (x86)\YCI Copy\readme.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	ISO-8859 text, with very long lines (772), with CRLF line terminators
Category:	dropped
Size (bytes):	3967
Entropy (8bit):	4.952533365596146
Encrypted:	false
SSDEEP:	96:dhT3fqmEWbmAiCqFh9DsZmQ+tvN9gIhCIoP3:dhT3fDv7REh96GN9nhCIw3
MD5:	4FAED84D38ED7879299CD34D8D2E0D61
SHA1:	4ECC1EAAD37A003DC0542DD20931ACB5C8B8E2CC
SHA-256:	EE53C85A8247388D3F1FDFD2682803F858EB161B2537F1FE17C919A58530B764
SHA-512:	5E731A86C38892080877E08F76F5589AEF648D97AA37C3957B7084009CCE7D8C89FD5BC6C21C6132F3ACBAECFF52A37F7FD431D04C931ED53A64329656607A80
Malicious:	false
Preview:	**************************************************.. WinAVI DVD Copy Readme.... Copyright(C) 2005 ZJMedia Digital Technology Ltd... All Rights Reserved.. **************************************************....Thank you for using WinAVI DVD Copy!....This README file contains the latest information about WinAVI DVD Copy. For the complete WinAVI DVD Copy instructions and usage, please refer to the help. For purchase information, please visit http://www.winavi.com.....======================================..About WinAVI DVD Copy..=================================-====..WinAVI DVD Copy is a very useful software program for backing up your DVD movies. By using WinAVI DVD Copy, you can easily copy your whole DVD collection at a fast speed while giving you an exact copy of your DVD. ..WinAVI DVD Copy has a user friendly interface which makes copying your DVD..s more convenient. W

C:\Program Files (x86)\YCI Copy\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	InnoSetup Log YCI Copy, version 0x418, 8641 bytes, 141700\37\user, C:\Program Files (x86)\YCI Copy\376\377\37
Category:	modified
Size (bytes):	8641
Entropy (8bit):	3.918636358379749
Encrypted:	false
SSDEEP:	96:lY1fWN+WUvApdONnRZrLOmPCvWLtw1DaIDCGC5CKbqqqqlHhFy:G1fW5SApd8vrLdK1JsqqqqlHu
MD5:	150EF986C390624005C24C148D42A4BD
SHA1:	BB1B01B8638CD27241106A55D42D9CBC4DDF805A
SHA-256:	A4CDA04E661F83CE18466BAA0E3C163F9FF4BE03FF629655E69649B18754DFB3
SHA-512:	01DC78DB57E093D43BA7DE2D80C615D45B2A57CF2C7F1AE63F30A559115968470BE4A067F3BED7F661122E92F0D71FE46D1871C8177AB23FA207CCB97A538123
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................YCI Copy........................................................................................................................YCI Copy............................................................................................................................-....!...................................................................................................................@rM...........=...............1.4.1.7.0.0......f.r.o.n.t.d.e.s.k......C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.Y.C.I. .C.o.p.y................6...... .....~........IFPS....#........................................................................................................ANYMETHOD.....................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TMAINFORM....TMAINFORM.........TUNINSTALLPROGRESSFORM....TUNINSTALLPROGRESSFORM.........TMSGBOXTYPE.........TPASSWORDEDIT....TPASSWORDEDIT.

C:\Program Files (x86)\YCI Copy\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2589527
Entropy (8bit):	6.373531593126736
Encrypted:	false
SSDEEP:	49152:NR/KpmZubPf2S8W2ILeWl+C1p9jWy5Snd0eig6NQ:z/jtYLP1Sy5E0y
MD5:	1B10BB12643856747BDBD83D2ECEEED8
SHA1:	FDB2B85931AD4EF9833E80B69EA1D4ECE847BB39
SHA-256:	84F532F2C79D65AF361FF4FF4DF709D849FACE9F5C402944FFD5F6432DB845C5
SHA-512:	68F1EAD0C3361192269309419DB4B62B7CCCDCA6EA4E0BFB56FB56718A65929458D9F2EEFDD016708368FBED4D072032C89869116D6333D43F02EEF918430F42
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......^..................%..\|........%.......%...@...........................(...........@......@....................'.......&..5...0'...................................................... '.....................L.&.H.....&......................text.....%.......%................. ..`.itext...&....%..(....%............. ..`.data...dZ....%..\....%.............@....bss.....x...0&..........................idata...5....&..6....&.............@....didata.......&......@&.............@....edata........'......J&.............@..@.tls....D.....'..........................rdata..].... '......L&.............@..@.rsrc........0'......N&.............@..@............. (......<'.............@..@........................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YCI Copy\YCI Copy.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Thu Jan 2 11:54:09 2025, mtime=Thu Jan 2 11:54:09 2025, atime=Fri Nov 6 06:30:12 2020, length=2329088, window=hide
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	4.670228723026296
Encrypted:	false
SSDEEP:	24:8mthOEWdOEIUluRtgUAVA3UDd5qdtVUUlnz/TJLTJUwqygm:8m/BWdORUkLgjVA3UDd5qdtWifJXJmyg
MD5:	A958D2D42761BF017B2677FADA754F12
SHA1:	DFE98D6E4024AD1AE788DEB4DDA1F435AF54E9FD
SHA-256:	AC4B34B50167BE3AF48BCF507729CDD45C37E722E5235F96CA4E8F900A5F990F
SHA-512:	3CF23E501801804A20A76B2671CE3AA3735CF6EBB09B3C592EC95861786295A5C0AD0581F73AD1238A01F2224D63D4D133DF60F6BE835AC36BD69C04AC85A5B6
Malicious:	false
Preview:	L..................F.... ...QL(j.]...^;j.]....{.......#..........................P.O. .:i.....+00.../C:\.....................1....."Z.f..PROGRA~2.........O.I"Z.f....................V.....~.`.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....Z.1....."Z.f..YCICOP~1..B......"Z.f"Z.f..........................T...Y.C.I. .C.o.p.y.....j.2...#.fQ.; .AVIDVD~1.EXE..N......"Z.f"Z.f..............................A.v.i.D.V.D.C.o.p.y...e.x.e.......]...............-.......\...........Y..\|.....C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe..=.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.Y.C.I. .C.o.p.y.\.A.v.i.D.V.D.C.o.p.y...e.x.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.Y.C.I. .C.o.p.y.........*................@Z\|...K.J.........`.......X.......141700...........hT..CrF.f4... ..../Tc...,......hT..CrF.f4... ..../Tc...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_AviDVDCopy.exe_2c5b657375b7d1c5ec3cfda6829e68ab5d59ad1e_b29fedd8_1155786e-5dfb-408a-bd57-c526adb6db8f\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9527000393049649
Encrypted:	false
SSDEEP:	192:jNaNxP0X97QnjYrBNkA/zuiFWZ24IO8z:j0Nx8XZQnjYjzuiFWY4IO8z
MD5:	4442DDAA692BC747077E1509DEC68F08
SHA1:	787496C38448845E09AE75EDF58CB485DA0DEF09
SHA-256:	292F0231B29057BBCE30CBB5E6893F4DFFC8BDAB4B69F309EE172CBBA6A5E49D
SHA-512:	98E257483AD182246290A572F5DD1B504ED6B441B78DED9384897413F7A223AC8286F65840AFFB60DDBA8BB8BB1577D6ACBDB9F577709C74365F331D930D264E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.2.9.6.0.5.3.8.2.3.2.4.1.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.2.9.6.0.5.4.3.3.8.8.5.6.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.1.5.5.7.8.6.e.-.5.d.f.b.-.4.0.8.a.-.b.d.5.7.-.c.5.2.6.a.d.b.6.d.b.8.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.8.f.c.f.2.e.2.-.3.d.3.a.-.4.7.3.e.-.8.2.f.0.-.b.4.3.c.d.7.d.8.8.1.b.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.A.v.i.D.V.D.C.o.p.y...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.e.1.c.-.0.0.0.1.-.0.0.1.4.-.9.0.d.4.-.9.a.6.a.1.5.5.d.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.8.0.2.7.1.0.a.1.6.9.8.b.0.d.c.3.c.e.1.e.5.3.1.c.b.2.0.7.3.1.b.2.0.0.0.0.f.f.f.f.!.0.0.0.0.1.6.8.9.9.7.2.6.e.5.7.1.a.5.c.d.3.c.6.8.6.8.8.8.e.b.6.f.d.e.b.2.e.e.2.1.a.6.1.b.!.A.v.i.D.V.D.C.o.p.y...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6F40.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Jan 2 12:54:13 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	50028
Entropy (8bit):	2.2202044600242603
Encrypted:	false
SSDEEP:	192:00e17EJdCPJP1TAxONzcPrqwKpQyDSSHSe1oBLPsWmh6TD1gCynrlxCdvDYDW8wY:ME3CPJ9nNguNpQyD9RoRsIftqswKar
MD5:	8A758D5FE0FA58BE0D3950851B076881
SHA1:	434B6F7D680D61DF863EB963343E2944C5056917
SHA-256:	8B2848CC2FEDA5D4C1F656DBA033B8FC6CDD0AA33B5507CDE9BE77C0458F9F19
SHA-512:	CB3B8B61B945AFFDBFB71290BBC4EEAD63C4385D7E72E64162E8BB98F3F1C68ED2CD4BD02BFCA08531418EAF0AB5C8CADCCB9F045C7554C68D5D52093F4008C2
Malicious:	false
Preview:	MDMP..a..... .......u.vg........................D...........l................2..........`.......8...........T............!.........................t...............................................................................eJ..............GenuineIntel............T...........r.vg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6FFD.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8374
Entropy (8bit):	3.695042502227543
Encrypted:	false
SSDEEP:	192:R6l7wVeJ8M6o2+vP6YHu6p9gmfuoR+BSpDG89bDDsfGhm:R6lXJX6oZvP6YO6Dgmfz0BADofB
MD5:	3F88CC5A9BE0F336C0A851E725F00475
SHA1:	C00B3B412B27EEFF88F01ABF02C03DA14704CF14
SHA-256:	599FAE7C533B87A8BC8F77DDC10D113B3170E74B998CC52B13A997D75FC249AB
SHA-512:	5F33668DB5DD8B2A25A6E20D2C3D1A3D6A27F2C3DBC965E9655D83B7A58E1B2CB3316060F14322F10F8735FA2ED2A55B659444D13A77368881F535FE2D7BD2E4
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.7.0.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER705C.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4680
Entropy (8bit):	4.450741652173642
Encrypted:	false
SSDEEP:	48:cvIwWl8zsrBJg77aI9GYyWpW8VYKYm8M4J0e+VpF7Z+q8vae+Vt5jSv97wrd:uIjfnI7YA7VqJCZKa5Wv97wrd
MD5:	C257F4E499B83FC6B29A08B5EAE54567
SHA1:	9961B3D56ED42A6B5AB431D71F49FDFB07482E3A
SHA-256:	4E82427C0CBEFAE7C25B04771B76690FDAA9862559916906660D8C6A54577E36
SHA-512:	FF4607FCB6CA6897ACE30DBFF2B418B005E2461D5254A9A7EBD8461A3F820B78025B39E073D9704D670C1C2625A61544EF9E7F05705BBA9910B3C06B4E787DAF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="658316" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\is-J26FF.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-J26FF.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp

Download File

Process:	C:\Users\user\Desktop\NkMMNoILv9.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	2566656
Entropy (8bit):	6.389424236428972
Encrypted:	false
SSDEEP:	49152:1R/KpmZubPf2S8W2ILeWl+C1p9jWy5Snd0eig6N3:b/jtYLP1Sy5E0F
MD5:	F7500A6E24D1453EDC7080EDE00360E9
SHA1:	0BAF2715E682AD38EFED66F54C1D86B40C4A1A9E
SHA-256:	173235D1325713CC591A4E1CD7EC398B550A46EC10B366D3B28007A28A6BA07D
SHA-512:	D11DF452D57B8A16A854862F783A32280DE0DFF4C2B68EE827EB9A763D49A8EC95105E97B84579254C6D8944E6EF511BEC78E11B4D248A41DA0BD22DB7E1F5FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L......^..................%..\|........%.......%...@...........................(...........@......@....................'.......&..5...0'...................................................... '.....................L.&.H.....&......................text.....%.......%................. ..`.itext...&....%..(....%............. ..`.data...dZ....%..\....%.............@....bss.....x...0&..........................idata...5....&..6....&.............@....didata.......&......@&.............@....edata........'......J&.............@..@.tls....D.....'..........................rdata..].... '......L&.............@..@.rsrc........0'......N&.............@..@............. (......<'.............@..@........................................................

C:\Windows\SysWOW64\is-60UJ3.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Windows\SysWOW64\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Windows\WINDVDBOOTRECDOE.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 3211264
Category:	dropped
Size (bytes):	2570
Entropy (8bit):	3.1163772019584455
Encrypted:	false
SSDEEP:	48:epJFh/yhZ7Rx8Cci4Yk0zAQK8YkDK7pWQpJQQ:sFh/yhZFx8Cc+zAQK8FK74Q7QQ
MD5:	1D30E7D3F9F0C0D3E4D2ABAB348B6214
SHA1:	7F6E6CE628FCB975DE6B9CB2676F1841D953AD50
SHA-256:	9DA978A3E512751D4B0164575981640CE4508FDEB1C59423988B1A6E5F2233A8
SHA-512:	E03DE3A5521AC6B89CE4ECB981C01D773F5308BD055797D4CC1ED9D8271300763B33009E43B30561D7E5F593DDEC7C1429688627DE728CE3273FFA2A142CA422
Malicious:	false
Preview:	..........1.........1980-06-22 09:00:34.............................................................................................................................................................................................................................................ws.....H.1.........................ws...]..<.......................\|.......8...8...........P+..........cZ..P+..T!.../.. ...{...`!..HC..T!..........ws..XB......8....... ......................w..@.e...........`!.......#@.T!....:.........t%@...@.....................................D....7..(7..P7......................................................L...h.]......E@..q@............w......................S......H.w...w.............$@.....Actx .......L...\|....... ...................4...............................................d...........[IY-....2...(...............................0...............p.......SsHd,...............................,...Z...Z...........................................$...4...C.:.\.W.I.N.D.O.W.S.

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.416679671790262
Encrypted:	false
SSDEEP:	6144:bcifpi6ceLPL9skLmb0moSWSPtaJG8nAgex285i2MMhA20X4WABlGuNf5+:Ai58oSWIZBk2MM6AFBlo
MD5:	4B3ABC24F9F44E99571C651A656C6593
SHA1:	5C2ACB654212FA24B62D27299B7051986C780E40
SHA-256:	5D1C5EF5C52635764717B123A3C7F91626E2A48FD4B8ACE81BC96F511A424D02
SHA-512:	82E0007A296E8ECEF35EA9012A165946F246EC908FED642DD6BBE5476FCFC369BF4532B6EB718C76E5B7B6A43F00ED2068D87A7AEF9D14015048F4E6A7D46ECA
Malicious:	false
Preview:	regfE...E....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...l.]...............................................................................................................................................................................................................................................................................................................................................7.X........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\is-O6HFG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
File Type:	Matlab v4 mat-file (little endian) , numeric, rows 0, columns 3211264
Category:	dropped
Size (bytes):	2570
Entropy (8bit):	3.1163772019584455
Encrypted:	false
SSDEEP:	48:epJFh/yhZ7Rx8Cci4Yk0zAQK8YkDK7pWQpJQQ:sFh/yhZFx8Cc+zAQK8FK74Q7QQ
MD5:	1D30E7D3F9F0C0D3E4D2ABAB348B6214
SHA1:	7F6E6CE628FCB975DE6B9CB2676F1841D953AD50
SHA-256:	9DA978A3E512751D4B0164575981640CE4508FDEB1C59423988B1A6E5F2233A8
SHA-512:	E03DE3A5521AC6B89CE4ECB981C01D773F5308BD055797D4CC1ED9D8271300763B33009E43B30561D7E5F593DDEC7C1429688627DE728CE3273FFA2A142CA422
Malicious:	false
Preview:	..........1.........1980-06-22 09:00:34.............................................................................................................................................................................................................................................ws.....H.1.........................ws...]..<.......................\|.......8...8...........P+..........cZ..P+..T!.../.. ...{...`!..HC..T!..........ws..XB......8....... ......................w..@.e...........`!.......#@.T!....:.........t%@...@.....................................D....7..(7..P7......................................................L...h.]......E@..q@............w......................S......H.w...w.............$@.....Actx .......L...\|....... ...................4...............................................d...........[IY-....2...(...............................0...............p.......SsHd,...............................,...Z...Z...........................................$...4...C.:.\.W.I.N.D.O.W.S.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.908115360175687
TrID:	Win32 Executable (generic) a (10002005/4) 98.45% Inno Setup installer (109748/4) 1.08% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	NkMMNoILv9.exe
File size:	4'816'166 bytes
MD5:	94722be5aa4e12860a09965f78ee60aa
SHA1:	2cfa52ca0545d9880eff2d1b7bafb5e65773b810
SHA256:	0b00372bfe0e6acd0cb66e8fd916168886052cccc50b9bf47c725f492f88dd61
SHA512:	d30a99bd64c78c34bfb55922a0672a385622259e60758561ab4fc69a52d1cb37bc34dcdbe1ddc63901acd9abc40d693595432cd683bfe6a0b9ed8c7052b5abf1
SSDEEP:	98304:NEukb3SZ+C8BnJf2U9HWk/wub1q///gzwAozfORU45J7fNhU+Lv:rkb3PzfB9HWr+wwmQJxhxv
TLSH:	C626123FB268B53ED4AF4B3246739260897BBB61781A8C2E47F4490CCF664701E3B655
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	0000000180014500

Static PE Info

General

Entrypoint:	0x4b5eec
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5EC61807 [Thu May 21 05:56:23 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5a594319a0d69dbc452e748bcf05892e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFA4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-3Ch], eax
mov dword ptr [ebp-40h], eax
mov dword ptr [ebp-5Ch], eax
mov dword ptr [ebp-30h], eax
mov dword ptr [ebp-38h], eax
mov dword ptr [ebp-34h], eax
mov dword ptr [ebp-2Ch], eax
mov dword ptr [ebp-28h], eax
mov dword ptr [ebp-14h], eax
mov eax, 004B10D8h
call 00007F5EF104F235h
xor eax, eax
push ebp
push 004B65DEh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 004B659Ah
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [004BE634h]
call 00007F5EF10F1947h
call 00007F5EF10F149Eh
lea edx, dword ptr [ebp-14h]
xor eax, eax
call 00007F5EF1064CA8h
mov edx, dword ptr [ebp-14h]
mov eax, 004C1D3Ch
call 00007F5EF1049E27h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [004C1D3Ch]
mov dl, 01h
mov eax, dword ptr [004237A4h]
call 00007F5EF1065D0Fh
mov dword ptr [004C1D40h], eax
xor edx, edx
push ebp
push 004B6546h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007F5EF10F19CFh
mov dword ptr [004C1D48h], eax
mov eax, dword ptr [004C1D48h]
cmp dword ptr [eax+0Ch], 01h
jne 00007F5EF10F7FCAh
mov eax, dword ptr [004C1D48h]
mov edx, 00000028h
call 00007F5EF1066604h
mov edx, dword ptr [004C1D48h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xc4000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc2000	0xf36	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x35c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc6000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc22e4	0x244	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xc3000	0x1a4	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb3604	0xb3800	364bc619a502d7f0a97aba31e34b82d2	False	0.34484761272632314	data	6.354329115342966	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0xb5000	0x1684	0x1800	282b489eac439b258c98ec516c03c2cd	False	0.5445963541666666	data	5.970901565517897	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb7000	0x37a4	0x3800	342785cf6ba6de905ca393413e77b906	False	0.36104910714285715	data	5.0421620677813435	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xbb000	0x6da0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc2000	0xf36	0x1000	a73d686f1e8b9bb06ec767721135e397	False	0.3681640625	data	4.8987046479600425	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xc3000	0x1a4	0x200	41b8ce23dd243d14beebc71771885c89	False	0.345703125	data	2.7563628682496506	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xc4000	0x9a	0x200	43f8d31e224bbd887c839f21e694b898	False	0.2578125	data	1.8722228665884297	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xc5000	0x18	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc6000	0x5d	0x200	8f2f090acd9622c88a6a852e72f94e96	False	0.189453125	data	1.3838943752217987	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc7000	0x35c4	0x3600	da38e675be3287259264142ddc36723a	False	0.3167679398148148	data	4.335503459237698	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7438	0x264	Device independent bitmap graphic, 13 x 26 x 24, image size 572	English	United States	0.27124183006535946
RT_STRING	0xc769c	0x360	data			0.34375
RT_STRING	0xc79fc	0x260	data			0.3256578947368421
RT_STRING	0xc7c5c	0x45c	data			0.4068100358422939
RT_STRING	0xc80b8	0x40c	data			0.3754826254826255
RT_STRING	0xc84c4	0x2d4	data			0.39226519337016574
RT_STRING	0xc8798	0xb8	data			0.6467391304347826
RT_STRING	0xc8850	0x9c	data			0.6410256410256411
RT_STRING	0xc88ec	0x374	data			0.4230769230769231
RT_STRING	0xc8c60	0x398	data			0.3358695652173913
RT_STRING	0xc8ff8	0x368	data			0.3795871559633027
RT_STRING	0xc9360	0x2a4	data			0.4275147928994083
RT_RCDATA	0xc9604	0x10	data			1.5
RT_RCDATA	0xc9614	0x2c4	data			0.6384180790960452
RT_RCDATA	0xc98d8	0x2c	data			1.1818181818181819
RT_GROUP_ICON	0xc9904	0x14	data	English	United States	1.05
RT_VERSION	0xc9918	0x584	data	English	United States	0.2613314447592068
RT_MANIFEST	0xc9e9c	0x726	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4005464480874317

Imports

DLL	Import
kernel32.dll	GetACP, GetExitCodeProcess, LocalFree, CloseHandle, SizeofResource, VirtualProtect, VirtualFree, GetFullPathNameW, ExitProcess, HeapAlloc, GetCPInfoExW, RtlUnwind, GetCPInfo, GetStdHandle, GetModuleHandleW, FreeLibrary, HeapDestroy, ReadFile, CreateProcessW, GetLastError, GetModuleFileNameW, SetLastError, FindResourceW, CreateThread, CompareStringW, LoadLibraryA, ResetEvent, GetVersion, RaiseException, FormatMessageW, SwitchToThread, GetExitCodeThread, GetCurrentThread, LoadLibraryExW, LockResource, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, VirtualQueryEx, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, GetFileSize, GetStartupInfoW, GetFileAttributesW, InitializeCriticalSection, GetThreadPriority, SetThreadPriority, GetCurrentProcess, VirtualAlloc, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, VerSetConditionMask, GetDiskFreeSpaceW, FindFirstFileW, GetUserDefaultUILanguage, lstrlenW, QueryPerformanceCounter, SetEndOfFile, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, GetSystemDirectoryW, DeleteFileW, GetLocalTime, GetEnvironmentVariableW, WaitForSingleObject, WriteFile, ExitThread, DeleteCriticalSection, TlsGetValue, GetDateFormatW, SetErrorMode, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, LocalAlloc, GetUserDefaultLangID, RemoveDirectoryW, CreateEventW, SetThreadLocale, GetThreadLocale
comctl32.dll	InitCommonControls
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
user32.dll	CreateWindowExW, TranslateMessage, CharLowerBuffW, CallWindowProcW, CharUpperW, PeekMessageW, GetSystemMetrics, SetWindowLongW, MessageBoxW, DestroyWindow, CharUpperBuffW, CharNextW, MsgWaitForMultipleObjects, LoadStringW, ExitWindowsEx, DispatchMessageW
oleaut32.dll	SysAllocStringLen, SafeArrayPtrOfIndex, VariantCopy, SafeArrayGetLBound, SafeArrayGetUBound, VariantInit, VariantClear, SysFreeString, SysReAllocStringLen, VariantChangeType, SafeArrayCreate
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
advapi32.dll	RegQueryValueExW, AdjustTokenPrivileges, LookupPrivilegeValueW, RegCloseKey, OpenProcessToken, RegOpenKeyExW

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x454058
__dbk_fcall_wrapper	2	0x40d0a0
dbkFCallWrapperAddr	1	0x4be63c

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-02T13:54:13.141411+0100	2844648	ETPRO MALWARE Observed FinderBot CnC Domain in TLS SNI	1	192.168.2.7	49699	103.224.212.212	443	TCP
2025-01-02T13:54:13.367176+0100	2840690	ETPRO MALWARE FinderBot Loader - CnC Activity M1	1	192.168.2.7	49699	103.224.212.212	443	TCP
2025-01-02T13:54:14.271490+0100	2844648	ETPRO MALWARE Observed FinderBot CnC Domain in TLS SNI	1	192.168.2.7	49700	103.224.212.212	443	TCP
2025-01-02T13:54:14.519026+0100	2840691	ETPRO MALWARE FinderBot Loader - CnC Activity M2	1	192.168.2.7	49700	103.224.212.212	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 13:54:12.467817068 CET	49699	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:12.467842102 CET	443	49699	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:12.468003988 CET	49699	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:12.468183994 CET	49699	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:12.468204021 CET	443	49699	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:13.141247988 CET	443	49699	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:13.141411066 CET	49699	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:13.142339945 CET	443	49699	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:13.144572973 CET	49699	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:13.157341957 CET	49699	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:13.157361031 CET	443	49699	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:13.157706022 CET	443	49699	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:13.158198118 CET	49699	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:13.158238888 CET	443	49699	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:13.367213011 CET	443	49699	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:13.367290020 CET	443	49699	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:13.367356062 CET	49699	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:13.433269978 CET	49699	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:13.433304071 CET	443	49699	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:13.613811016 CET	49700	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:13.613836050 CET	443	49700	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:13.613914967 CET	49700	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:13.614058971 CET	49700	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:13.614070892 CET	443	49700	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:14.271410942 CET	443	49700	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:14.271490097 CET	49700	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:14.272212982 CET	443	49700	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:14.272264004 CET	49700	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:14.275875092 CET	49700	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:14.275882006 CET	443	49700	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:14.276125908 CET	443	49700	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:14.276304960 CET	49700	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:14.319329023 CET	443	49700	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:14.519047976 CET	443	49700	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:14.519121885 CET	443	49700	103.224.212.212	192.168.2.7
Jan 2, 2025 13:54:14.519171953 CET	49700	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:14.519264936 CET	49700	443	192.168.2.7	103.224.212.212
Jan 2, 2025 13:54:14.519273996 CET	443	49700	103.224.212.212	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 2, 2025 13:54:11.925337076 CET	52351	53	192.168.2.7	1.1.1.1
Jan 2, 2025 13:54:12.230190039 CET	53	52351	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2025 13:54:11.925337076 CET	192.168.2.7	1.1.1.1	0xb225	Standard query (0)	mastergamenameper.club	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 13:54:12.230190039 CET	1.1.1.1	192.168.2.7	0xb225	No error (0)	mastergamenameper.club		103.224.212.212	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

mastergamenameper.club

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	103.224.212.212	443	7708	C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 12:54:13 UTC	316	OUT	POST /installers/pp HTTP/1.1 Host: mastergamenameper.club User-Agent: undefined Content-Type: application/json Accept: application/json X-Data: {"cid":1,"ibc":"64bit","idid":"","iid":"1735822451","it":"","iv":500.0,"ivm":"0","pid":7708,"wkv":"10.0.19041.1889","wpv":"10.0.19041.1889"} Content-Length: 10380
2025-01-02 12:54:13 UTC	10380	OUT	Data Raw: 7b 22 70 61 79 6c 6f 61 64 22 3a 22 31 31 34 36 34 31 34 39 31 41 30 38 33 46 34 39 33 31 33 42 31 33 31 37 34 35 35 43 35 35 31 32 33 34 31 39 30 35 30 42 30 46 31 37 34 32 36 34 31 41 31 45 34 36 33 38 31 33 31 42 31 45 30 31 35 43 31 42 31 34 31 30 33 36 30 45 30 44 30 31 31 39 31 30 34 33 34 30 31 41 31 45 34 36 31 38 30 37 31 42 31 39 34 41 35 34 34 31 35 44 31 30 34 38 34 39 30 39 31 42 31 38 31 37 34 32 31 37 35 44 34 41 30 31 34 39 34 36 34 41 31 44 30 44 35 46 35 30 35 36 35 42 31 30 34 35 30 46 31 30 30 46 34 36 31 44 31 42 35 42 34 31 31 36 31 38 31 39 34 36 30 46 31 43 35 34 31 42 31 34 31 30 31 33 30 32 30 34 30 34 30 35 30 33 35 45 35 37 31 36 35 37 31 43 30 45 34 38 34 34 34 38 31 37 35 34 34 42 34 45 35 42 30 37 30 45 31 39 34 36 30 46 31 Data Ascii: {"payload":"114641491A083F49313B1317455C55123419050B0F1742641A1E4638131B1E015C1B1410360E0D01191043401A1E4618071B194A54415D104849091B181742175D4A0149464A1D0D5F50565B10450F100F461D1B5B41161819460F1C541B14101302040405035E5716571C0E48444817544B4E5B070E19460F1
2025-01-02 12:54:13 UTC	353	IN	HTTP/1.1 302 Found date: Thu, 02 Jan 2025 12:54:13 GMT server: Apache set-cookie: __tad=1735822453.5431414; expires=Sun, 31-Dec-2034 12:54:13 GMT; Max-Age=315360000 location: http://ww25.mastergamenameper.club/installers/pp?subid1=20250102-2354-13c6-af36-174aa28c07b8 content-length: 2 content-type: text/html; charset=UTF-8 connection: close
2025-01-02 12:54:13 UTC	2	IN	Data Raw: 0a 0a Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49700	103.224.212.212	443	7708	C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 12:54:14 UTC	303	OUT	POST /log HTTP/1.1 Host: mastergamenameper.club User-Agent: undefined Content-Type: application/json Accept: application/json X-Data: {"cid":1,"ibc":"64bit","idid":"","iid":"1735822451","it":"","iv":500.0,"ivm":"0","pid":7708,"wkv":"10.0.19041.1889","wpv":"10.0.19041.1889"} Content-Length: 36
2025-01-02 12:54:14 UTC	36	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 61 63 74 69 6f 6e 22 3a 22 22 7d 2c 22 65 76 65 6e 74 5f 69 64 22 3a 34 30 7d Data Ascii: {"data":{"action":""},"event_id":40}
2025-01-02 12:54:14 UTC	343	IN	HTTP/1.1 302 Found date: Thu, 02 Jan 2025 12:54:14 GMT server: Apache set-cookie: __tad=1735822454.3242623; expires=Sun, 31-Dec-2034 12:54:14 GMT; Max-Age=315360000 location: http://ww25.mastergamenameper.club/log?subid1=20250102-2354-145f-aab7-442a1121e9f0 content-length: 2 content-type: text/html; charset=UTF-8 connection: close
2025-01-02 12:54:14 UTC	2	IN	Data Raw: 0a 0a Data Ascii:

Target ID:	0
Start time:	07:54:08
Start date:	02/01/2025
Path:	C:\Users\user\Desktop\NkMMNoILv9.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\NkMMNoILv9.exe"
Imagebase:	0x400000
File size:	4'816'166 bytes
MD5 hash:	94722BE5AA4E12860A09965F78EE60AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:54:08
Start date:	02/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\is-QMENT.tmp\NkMMNoILv9.tmp" /SL5="$2044A,4113998,776192,C:\Users\user\Desktop\NkMMNoILv9.exe"
Imagebase:	0x400000
File size:	2'566'656 bytes
MD5 hash:	F7500A6E24D1453EDC7080EDE00360E9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 2%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:54:10
Start date:	02/01/2025
Path:	C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe"
Imagebase:	0x400000
File size:	2'329'088 bytes
MD5 hash:	DA7C7C802E2164A70B460B5163AFDEC4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:54:13
Start date:	02/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7708 -s 848
Imagebase:	0x620000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Function 10001130 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1496648105.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1496629728.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1496664997.0000000010002000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_NkMMNoILv9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction ID: 1c94840b05858ddf3503627acbaac9226f9c4a6e1659969bf0a936c2f155f8a0
Opcode Fuzzy Hash: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction Fuzzy Hash: FF11303254D3D28FC305CF2894506D6FFE4AF6A640F194AAEE1D45B203C2659549C7A2

Function 10001000 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1496648105.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.1496629728.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.1496664997.0000000010002000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_NkMMNoILv9.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction ID: 837d35c9df4effc004866add7a9100bdfed479f04b3922bb4bd4c5469ecd81ba
Opcode Fuzzy Hash: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction Fuzzy Hash:

Analysis Process: AviDVDCopy.exePID: 7708, Parent PID: 7336COMMON

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.3%
Total number of Nodes:	76
Total number of Limit Nodes:	9

Executed Functions

Function 00560011 Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f9154659d83bc252f07ce2a5b0926ee4cef48c0800698cb6810854e17ea24b
Instruction ID: fffbf5ae1e1fc08604101661b9307ec33fdbf5e96986d1df7799f31091995c2f
Opcode Fuzzy Hash: 16f9154659d83bc252f07ce2a5b0926ee4cef48c0800698cb6810854e17ea24b
Instruction Fuzzy Hash: 2EF06571610224DBCB26D74CC509B5AB7BCFB45B65F511056F509DB191C278DD00C7D1

Function 0055F962 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ext-ms-, xrefs: 0055F9CD
api-ms-, xrefs: 0055F9B9

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: b9c446dffa72448202776a5a9f844fc003e921ef1f7aed95f0630d22e28685b6
Instruction ID: 39146434522682d8b93354cc9b25daf54381f6f1e3d5a366522ac4480db35a8e
Opcode Fuzzy Hash: b9c446dffa72448202776a5a9f844fc003e921ef1f7aed95f0630d22e28685b6
Instruction Fuzzy Hash: 86212B32A01611BBC7319B64EC55B2A3F68BF11761F250532ED4AE7291E730ED08E7E1

Function 0054EB88 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(005E7890,0000000C), ref: 0054EB9B
ExitThread.KERNEL32 ref: 0054EBA2

Strings

PB, xrefs: 0054EBD8

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: ErrorExitLastThread
String ID: PB
API String ID: 1611280651-3196168531
Opcode ID: 557f6f1ad937596780eb166833a1328f79795e539bdb0151e0a47489ebbbe54e
Instruction ID: f5a2ade19c03da28b6dc60cd99a8b89ee3ea38e1749cbf737a77158301d0329b
Opcode Fuzzy Hash: 557f6f1ad937596780eb166833a1328f79795e539bdb0151e0a47489ebbbe54e
Instruction Fuzzy Hash: D8F0AF7494020AAFDB04ABB0D80FA6E3F74FF95711F10015EF406972A2CB745985EB60

Function 0055FA29 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c011f4e31f8110b7a4500d4c9255741480c0cdaa2eed89646ff85ace229af12
Instruction ID: 216c5713e690edc9859768adaa7c297a68bd95f2efdfb280d07149f689c85403
Opcode Fuzzy Hash: 8c011f4e31f8110b7a4500d4c9255741480c0cdaa2eed89646ff85ace229af12
Instruction Fuzzy Hash: 1101D2337001159FAB1ACA69ECA095B3B97BBC4332B154632FD08CB194EB309808D792

Function 0055F665 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0055E8DD,00000001,00000364,00000007,000000FF,?,?,0054E9A7,0055E0C7,?,?,00559E30), ref: 0055F6A6

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ed0ce2d5d0d44c88ede1dae1dffa74a17e686f34af8185b36b3a9fd0554a3545
Instruction ID: 65900333f175958b049e7e5cc248907f637591378f2fbfd4d1adf79031f30bb2
Opcode Fuzzy Hash: ed0ce2d5d0d44c88ede1dae1dffa74a17e686f34af8185b36b3a9fd0554a3545
Instruction Fuzzy Hash: 57F0E93220122A67DB321A729C39A6A3F89BF80762B158133BC44DA1B4CF30DC4C87A5

Function 0055E0DB Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0055F3F4,00001000,00000000,?,00000000,?,005587E0,00000000,00000000,00000000,00000000,?), ref: 0055E10D

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8498a2f5e17bb1d83fac2bd118e84d507f29d828332295485092eb116ad08ad5
Instruction ID: e5cf2ff78d218c39410ed6ac5ef59aeaeb57db089deded7c9ec329315f3fba59
Opcode Fuzzy Hash: 8498a2f5e17bb1d83fac2bd118e84d507f29d828332295485092eb116ad08ad5
Instruction Fuzzy Hash: D7E0E535100A2657D62926669C2BB5B3E48BF813A6F010123EC55921D1CB30DE08C1E2

Function 00554122 Relevance: 1.5, APIs: 1, Instructions: 11
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00554135

Part of subcall function 0055E0A1: RtlFreeHeap.NTDLL(00000000,00000000,?,00559E30), ref: 0055E0B7
Part of subcall function 0055E0A1: GetLastError.KERNEL32(?,?,00559E30), ref: 0055E0C9

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: 791e719d15d0e18bc717c4a9d0df73e002dc8a298672f0b032592ad6a0eaea14
Instruction ID: e77d973d4f4af72c19bdd7d45f2fc002b3af6ebac155101f1c8a64dc925a400e
Opcode Fuzzy Hash: 791e719d15d0e18bc717c4a9d0df73e002dc8a298672f0b032592ad6a0eaea14
Instruction Fuzzy Hash: 2EC08C7100020CBBCB049B41C80BA4E7FA8EBC0364F200044F80017290CAB1EF449680

Non-executed Functions

Function 6096748C Relevance: 131.0, APIs: 72, Strings: 2, Instructions: 1504COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 609674C6

Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_step.SQLITE3 ref: 6096755A
sqlite3_malloc.SQLITE3 ref: 6096783A
sqlite3_bind_int64.SQLITE3 ref: 609678A8
sqlite3_column_bytes.SQLITE3 ref: 609678E8
sqlite3_column_blob.SQLITE3 ref: 60967901
sqlite3_column_int64.SQLITE3 ref: 6096791A
sqlite3_column_int64.SQLITE3 ref: 60967931
sqlite3_column_int64.SQLITE3 ref: 60967950
sqlite3_step.SQLITE3 ref: 609679C3
sqlite3_bind_int64.SQLITE3 ref: 60967AA9
sqlite3_step.SQLITE3 ref: 60967AB4
sqlite3_column_int.SQLITE3 ref: 60967AC7
sqlite3_reset.SQLITE3 ref: 60967AD4
sqlite3_bind_int.SQLITE3 ref: 60967B89
sqlite3_step.SQLITE3 ref: 60967B94
sqlite3_column_int64.SQLITE3 ref: 60967BB0
sqlite3_column_int64.SQLITE3 ref: 60967BCF
sqlite3_column_int64.SQLITE3 ref: 60967BE6
sqlite3_column_bytes.SQLITE3 ref: 60967C05
sqlite3_column_blob.SQLITE3 ref: 60967C1E

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED50

sqlite3_bind_int64.SQLITE3 ref: 60967C72
sqlite3_step.SQLITE3 ref: 60967C7D
memcmp.MSVCRT ref: 60967D4C
sqlite3_free.SQLITE3 ref: 60967D69
sqlite3_free.SQLITE3 ref: 60967D74
sqlite3_free.SQLITE3 ref: 60967FF7
sqlite3_free.SQLITE3 ref: 60968002

Part of subcall function 609634F0: sqlite3_blob_reopen.SQLITE3 ref: 60963510
Part of subcall function 609634F0: sqlite3_blob_bytes.SQLITE3 ref: 609635A3
Part of subcall function 609634F0: sqlite3_malloc.SQLITE3 ref: 609635BB
Part of subcall function 609634F0: sqlite3_blob_read.SQLITE3 ref: 60963602
Part of subcall function 609634F0: sqlite3_free.SQLITE3 ref: 60963621

sqlite3_reset.SQLITE3 ref: 60967C93

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

sqlite3_reset.SQLITE3 ref: 60967CA7
sqlite3_reset.SQLITE3 ref: 60968035
sqlite3_bind_int64.SQLITE3 ref: 60967B72

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_int64.SQLITE3 ref: 6096809D
sqlite3_bind_int64.SQLITE3 ref: 609680C6
sqlite3_step.SQLITE3 ref: 609680D1
sqlite3_column_int.SQLITE3 ref: 609680F3
sqlite3_reset.SQLITE3 ref: 60968104
sqlite3_step.SQLITE3 ref: 60968139
sqlite3_column_int64.SQLITE3 ref: 60968151
sqlite3_reset.SQLITE3 ref: 6096818A

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED2B
Part of subcall function 6095ECA6: sqlite3_bind_value.SQLITE3 ref: 6095EDDF

sqlite3_reset.SQLITE3 ref: 609679E9

Part of subcall function 609160CD: sqlite3_realloc.SQLITE3 ref: 609160EF

sqlite3_column_bytes.SQLITE3 ref: 60967587

Part of subcall function 6091D5DC: sqlite3_value_bytes.SQLITE3 ref: 6091D5F4

sqlite3_column_blob.SQLITE3 ref: 60967572

Part of subcall function 6091D57E: sqlite3_value_blob.SQLITE3 ref: 6091D596

sqlite3_reset.SQLITE3 ref: 609675B7
sqlite3_bind_int.SQLITE3 ref: 60967641
sqlite3_step.SQLITE3 ref: 6096764C
sqlite3_column_int64.SQLITE3 ref: 6096766E
sqlite3_reset.SQLITE3 ref: 6096768B
sqlite3_bind_int.SQLITE3 ref: 6096754F

Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704

sqlite3_bind_int.SQLITE3 ref: 609690B2
sqlite3_bind_blob.SQLITE3 ref: 609690DB
sqlite3_step.SQLITE3 ref: 609690E6
sqlite3_reset.SQLITE3 ref: 609690F1
sqlite3_free.SQLITE3 ref: 60969102
sqlite3_free.SQLITE3 ref: 6096910D

Strings

, xrefs: 60968643
d, xrefs: 6096875D

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_reset$sqlite3_step$sqlite3_column_int64sqlite3_free$sqlite3_bind_int64$sqlite3_bind_int$sqlite3_column_blobsqlite3_column_bytessqlite3_mallocsqlite3_mprintf$sqlite3_column_intsqlite3_mutex_leave$memcmpsqlite3_bind_blobsqlite3_bind_valuesqlite3_blob_bytessqlite3_blob_readsqlite3_blob_reopensqlite3_initializesqlite3_mutex_entersqlite3_prepare_v2sqlite3_reallocsqlite3_value_blobsqlite3_value_bytes
String ID: $d
API String ID: 2451604321-2084297493
Opcode ID: 8a4e51d2763d1baa8146902d495da2ef892242416c9706ebfa3093aedc646825
Instruction ID: 6b7ea73e19bc996eb6a422b8fcf26663d3cb25e4dd91ceba81a4d6a678ae72ab
Opcode Fuzzy Hash: 8a4e51d2763d1baa8146902d495da2ef892242416c9706ebfa3093aedc646825
Instruction Fuzzy Hash: 2CF2CF74A152288FDB54CF68C980B9EBBF2BF69304F1185A9E888A7341D774ED85CF41

Function 609615FA Relevance: 97.3, APIs: 50, Strings: 5, Instructions: 1014COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3(?), ref: 6096167A

Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4

sqlite3_malloc.SQLITE3(?), ref: 6096169E
sqlite3_stricmp.SQLITE3(?), ref: 60961C47
sqlite3_strnicmp.SQLITE3 ref: 609617D0

Part of subcall function 60929740: sqlite3_mprintf.SQLITE3 ref: 60929761
Part of subcall function 60929740: sqlite3_mprintf.SQLITE3 ref: 609297C8
Part of subcall function 60929740: sqlite3_free.SQLITE3 ref: 609298AC

sqlite3_mprintf.SQLITE3(?), ref: 60961840
sqlite3_free.SQLITE3(?), ref: 60961A9D
sqlite3_free.SQLITE3(?), ref: 60961AAB
sqlite3_free.SQLITE3(?), ref: 60961AC1
sqlite3_mprintf.SQLITE3(?), ref: 60961AE8
sqlite3_prepare.SQLITE3 ref: 60961B21
sqlite3_free.SQLITE3(?), ref: 60961B2F
sqlite3_column_name.SQLITE3(?), ref: 60961B64
sqlite3_malloc.SQLITE3(?), ref: 60961B91
sqlite3_column_name.SQLITE3(?), ref: 60961BB9
sqlite3_finalize.SQLITE3(?), ref: 60961BFC
sqlite3_malloc.SQLITE3(?), ref: 60961D1B
sqlite3_mprintf.SQLITE3(?), ref: 60961DB5
sqlite3_malloc.SQLITE3(?), ref: 60961E0C
sqlite3_strnicmp.SQLITE3(?), ref: 60962011
sqlite3_free.SQLITE3(?), ref: 6096202A
sqlite3_mprintf.SQLITE3(?), ref: 6096206B
sqlite3_mprintf.SQLITE3(?), ref: 609620C3
sqlite3_free.SQLITE3 ref: 609621AD

Part of subcall function 609298BB: sqlite3_vmprintf.SQLITE3 ref: 609298DC
Part of subcall function 609298BB: sqlite3_mprintf.SQLITE3 ref: 609298FC
Part of subcall function 609298BB: sqlite3_free.SQLITE3 ref: 60929907
Part of subcall function 609298BB: sqlite3_free.SQLITE3 ref: 60929922

sqlite3_free.SQLITE3 ref: 60962323
sqlite3_mprintf.SQLITE3 ref: 60962369
sqlite3_mprintf.SQLITE3 ref: 6096238B

Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA

Part of subcall function 6095F37F: sqlite3_vmprintf.SQLITE3 ref: 6095F39C

sqlite3_mprintf.SQLITE3 ref: 609623B6
sqlite3_free.SQLITE3 ref: 609623FE
sqlite3_mprintf.SQLITE3 ref: 6096251E
sqlite3_prepare.SQLITE3 ref: 6096254F
sqlite3_step.SQLITE3 ref: 6096255E
sqlite3_column_int.SQLITE3 ref: 60962571
sqlite3_finalize.SQLITE3 ref: 60962582
sqlite3_free.SQLITE3 ref: 609625A3
sqlite3_vtab_config.SQLITE3 ref: 609625F1
sqlite3_mprintf.SQLITE3 ref: 60962606
sqlite3_mprintf.SQLITE3 ref: 60962629
sqlite3_mprintf.SQLITE3 ref: 60962653
sqlite3_declare_vtab.SQLITE3 ref: 6096266C

Part of subcall function 6095F37F: sqlite3_exec.SQLITE3 ref: 6095F3D1
Part of subcall function 6095F37F: sqlite3_free.SQLITE3 ref: 6095F3DB

sqlite3_free.SQLITE3 ref: 60962681
sqlite3_free.SQLITE3 ref: 60962689
sqlite3_free.SQLITE3(?), ref: 609626C1
sqlite3_free.SQLITE3(?), ref: 609626CC
sqlite3_free.SQLITE3(?), ref: 609626DA
sqlite3_free.SQLITE3(?), ref: 609626E8
sqlite3_free.SQLITE3(?), ref: 609626F6
sqlite3_free.SQLITE3(?), ref: 60962704
sqlite3_free.SQLITE3(?), ref: 60962719
sqlite3_free.SQLITE3(?), ref: 60962730
sqlite3_free.SQLITE3(?), ref: 6096273E

Strings

_content, xrefs: 609627B7
uncompress, xrefs: 609620AC
compress, xrefs: 609620A3
simple, xrefs: 60961CBD
rowid, xrefs: 609621B4

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mprintf$sqlite3_malloc$sqlite3_vmprintf$sqlite3_column_namesqlite3_finalizesqlite3_initializesqlite3_preparesqlite3_strnicmp$sqlite3_column_intsqlite3_declare_vtabsqlite3_execsqlite3_stepsqlite3_stricmpsqlite3_vtab_config
String ID: _content$compress$rowid$simple$uncompress
API String ID: 3347237373-2113267749
Opcode ID: fd172d80f0f02367f886f7d0732b42904a1b85da8985b7232fe88c033b1bdd76
Instruction ID: 0e240010b05f41dc07939d2d7ecbb6a46474f09563f6262102b8980c0b8574bc
Opcode Fuzzy Hash: fd172d80f0f02367f886f7d0732b42904a1b85da8985b7232fe88c033b1bdd76
Instruction Fuzzy Hash: C1B204B4914219CFEB20CF68C48079DBBF2BF69304F1585AAE898AB341D774D985CF91

Function 6096A5EE Relevance: 81.5, APIs: 45, Strings: 1, Instructions: 1006COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6096A64C
sqlite3_value_bytes.SQLITE3 ref: 6096A656
sqlite3_strnicmp.SQLITE3 ref: 6096A682
sqlite3_strnicmp.SQLITE3 ref: 6096A6BC
sqlite3_mprintf.SQLITE3 ref: 6096A6F9
sqlite3_malloc.SQLITE3 ref: 6096A754
sqlite3_step.SQLITE3 ref: 6096A969
sqlite3_free.SQLITE3 ref: 6096A9AC
sqlite3_finalize.SQLITE3 ref: 6096A9BB
sqlite3_strnicmp.SQLITE3 ref: 6096B04A

Part of subcall function 6096A38C: sqlite3_bind_int.SQLITE3 ref: 6096A3DE
Part of subcall function 6096A38C: sqlite3_step.SQLITE3 ref: 6096A435
Part of subcall function 6096A38C: sqlite3_reset.SQLITE3 ref: 6096A445

sqlite3_value_int.SQLITE3 ref: 6096B241
sqlite3_malloc.SQLITE3 ref: 6096B270
sqlite3_bind_null.SQLITE3 ref: 6096B2DF
sqlite3_step.SQLITE3 ref: 6096B2EA
sqlite3_reset.SQLITE3 ref: 6096B2F5
sqlite3_value_int.SQLITE3 ref: 6096B43B
sqlite3_value_text.SQLITE3 ref: 6096B530
sqlite3_value_bytes.SQLITE3 ref: 6096B576
sqlite3_free.SQLITE3 ref: 6096B5F4

Strings

optimize, xrefs: 6096A677

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_stepsqlite3_strnicmp$sqlite3_freesqlite3_mallocsqlite3_resetsqlite3_value_bytessqlite3_value_intsqlite3_value_text$sqlite3_bind_intsqlite3_bind_nullsqlite3_finalizesqlite3_mprintf
String ID: optimize
API String ID: 1540667495-3797040228
Opcode ID: ab382b16e3f59fac809a38361d516dac1e6c4c02a096abfb60effccae4f38c9b
Instruction ID: 15d53f9c7948a495e2c6926a79545eea34293df74e7a3e63ea56b3727437b729
Opcode Fuzzy Hash: ab382b16e3f59fac809a38361d516dac1e6c4c02a096abfb60effccae4f38c9b
Instruction Fuzzy Hash: 54B2F670A142198FEB14DF68C890B9DBBF6BF68304F1085A9E889AB351E774DD85CF41

Function 6096281E Relevance: 45.4, APIs: 30, Instructions: 375
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_mprintf.SQLITE3 ref: 6096286E
sqlite3_vtab_config.SQLITE3 ref: 60962898
sqlite3_malloc.SQLITE3 ref: 609628D7
sqlite3_mprintf.SQLITE3 ref: 60962978
sqlite3_mprintf.SQLITE3 ref: 609629C0

Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA

Part of subcall function 60961580: sqlite3_prepare_v2.SQLITE3 ref: 609615BA
Part of subcall function 60961580: sqlite3_step.SQLITE3 ref: 609615C9
Part of subcall function 60961580: sqlite3_column_int.SQLITE3 ref: 609615E1
Part of subcall function 60961580: sqlite3_finalize.SQLITE3 ref: 609615EE

sqlite3_mprintf.SQLITE3 ref: 609629F0
sqlite3_mprintf.SQLITE3 ref: 60962BEE
sqlite3_prepare_v2.SQLITE3 ref: 60962C23
sqlite3_free.SQLITE3 ref: 60962C30
sqlite3_errmsg.SQLITE3 ref: 60962C49
sqlite3_mprintf.SQLITE3 ref: 60962C59
sqlite3_mprintf.SQLITE3 ref: 60962C79
sqlite3_mprintf.SQLITE3 ref: 60962C9C
sqlite3_free.SQLITE3 ref: 60962CA7

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_mprintf.SQLITE3 ref: 60962CCA
sqlite3_free.SQLITE3 ref: 60962CD4
sqlite3_declare_vtab.SQLITE3 ref: 60962CEC
sqlite3_errmsg.SQLITE3 ref: 609629E0

Part of subcall function 609258A8: sqlite3_log.SQLITE3 ref: 609258E5

sqlite3_free.SQLITE3 ref: 609629FD
sqlite3_mprintf.SQLITE3 ref: 60962A5C
sqlite3_exec.SQLITE3 ref: 60962A8D
sqlite3_free.SQLITE3 ref: 60962A97
sqlite3_prepare_v2.SQLITE3 ref: 60962B1A
sqlite3_bind_text.SQLITE3 ref: 60962B48
sqlite3_step.SQLITE3 ref: 60962B53
sqlite3_column_int64.SQLITE3 ref: 60962B6F
sqlite3_finalize.SQLITE3 ref: 60962B7E
sqlite3_errmsg.SQLITE3 ref: 60962CFD
sqlite3_mprintf.SQLITE3 ref: 60962D0D
sqlite3_free.SQLITE3 ref: 60962D23

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mprintf$sqlite3_free$sqlite3_errmsgsqlite3_prepare_v2$sqlite3_finalizesqlite3_step$sqlite3_bind_textsqlite3_column_intsqlite3_column_int64sqlite3_declare_vtabsqlite3_execsqlite3_initializesqlite3_logsqlite3_mallocsqlite3_mutex_entersqlite3_vmprintfsqlite3_vtab_config
String ID:
API String ID: 1118341049-0
Opcode ID: 8a30035407fa36d043fa5a42f7ff9a9c36b2d6c52798fad5a4a3b9d2116b71e5
Instruction ID: 9690ff12759a1a2b4249a07fad325e6c212a88ae3811af8a178a796da7f2e199
Opcode Fuzzy Hash: 8a30035407fa36d043fa5a42f7ff9a9c36b2d6c52798fad5a4a3b9d2116b71e5
Instruction Fuzzy Hash: 2EF102B59187048BDB10DF68C48469EBBF2FFA9314F15896AE8989B344D735DC41CB82

Function 609660FA Relevance: 39.4, APIs: 19, Strings: 3, Instructions: 926COMMON

Download Yara Rule

APIs

sqlite3_finalize.SQLITE3 ref: 60966178
sqlite3_free.SQLITE3 ref: 60966183
sqlite3_value_numeric_type.SQLITE3 ref: 609661AE
sqlite3_value_numeric_type.SQLITE3 ref: 609661DE
sqlite3_value_text.SQLITE3 ref: 60966236
sqlite3_value_int.SQLITE3 ref: 60966274
memcmp.MSVCRT ref: 6096639E

Part of subcall function 60940A5B: sqlite3_malloc.SQLITE3 ref: 60940AA1
Part of subcall function 60940A5B: sqlite3_free.SQLITE3 ref: 60940C1D

sqlite3_mprintf.SQLITE3 ref: 60966B51
sqlite3_mprintf.SQLITE3 ref: 60966B7D

Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA

Strings

x, xrefs: 609664F1
DESC, xrefs: 60966CB3
ASC, xrefs: 60966CA5

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_value_numeric_type$memcmpsqlite3_finalizesqlite3_initializesqlite3_mallocsqlite3_value_intsqlite3_value_textsqlite3_vmprintf
String ID: ASC$DESC$x
API String ID: 4082667235-1162196452
Opcode ID: 7264e4280a4ba67b830c3238f8418230a53be4a89f04bb086879d88682624c0f
Instruction ID: 01f4316cc9c65235d83944c747b96ccca9397e1276bdc6c450b31a73d7ca280a
Opcode Fuzzy Hash: 7264e4280a4ba67b830c3238f8418230a53be4a89f04bb086879d88682624c0f
Instruction Fuzzy Hash: AD921274A14319CFEB10CFA9C99079DBBB6BF69304F20816AD858AB342D774E985CF41

Function 609687A7 Relevance: 36.3, APIs: 24, Instructions: 282COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 6096882B
sqlite3_bind_int.SQLITE3 ref: 60968842
sqlite3_step.SQLITE3 ref: 6096884D
sqlite3_reset.SQLITE3 ref: 60968858
sqlite3_bind_int64.SQLITE3 ref: 60968907
sqlite3_bind_int.SQLITE3 ref: 60968924
sqlite3_step.SQLITE3 ref: 6096892F
sqlite3_column_blob.SQLITE3 ref: 60968947
sqlite3_column_bytes.SQLITE3 ref: 6096895C
sqlite3_column_int64.SQLITE3 ref: 60968975
sqlite3_reset.SQLITE3 ref: 609689B0

Part of subcall function 609634F0: sqlite3_blob_reopen.SQLITE3 ref: 60963510
Part of subcall function 609634F0: sqlite3_blob_bytes.SQLITE3 ref: 609635A3
Part of subcall function 609634F0: sqlite3_malloc.SQLITE3 ref: 609635BB
Part of subcall function 609634F0: sqlite3_blob_read.SQLITE3 ref: 60963602
Part of subcall function 609634F0: sqlite3_free.SQLITE3 ref: 60963621

sqlite3_free.SQLITE3 ref: 60968A68
sqlite3_bind_int64.SQLITE3 ref: 60968B00
sqlite3_bind_int64.SQLITE3 ref: 60968B2D
sqlite3_step.SQLITE3 ref: 60968B38
sqlite3_reset.SQLITE3 ref: 60968B43
sqlite3_bind_int64.SQLITE3 ref: 60968B9F
sqlite3_bind_blob.SQLITE3 ref: 60968BC8
sqlite3_bind_int64.SQLITE3 ref: 60968BEF
sqlite3_bind_int.SQLITE3 ref: 60968C0C
sqlite3_step.SQLITE3 ref: 60968C17
sqlite3_reset.SQLITE3 ref: 60968C22
sqlite3_free.SQLITE3 ref: 60968C2F
sqlite3_free.SQLITE3 ref: 60968C3A

Part of subcall function 60916390: sqlite3_free.SQLITE3 ref: 609164E9
Part of subcall function 60916390: sqlite3_free.SQLITE3 ref: 609164F4

Part of subcall function 6095F772: sqlite3_bind_int64.SQLITE3 ref: 6095F7AC
Part of subcall function 6095F772: sqlite3_bind_blob.SQLITE3 ref: 6095F7D5
Part of subcall function 6095F772: sqlite3_step.SQLITE3 ref: 6095F7E0
Part of subcall function 6095F772: sqlite3_reset.SQLITE3 ref: 6095F7EB

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_int64$sqlite3_free$sqlite3_resetsqlite3_step$sqlite3_bind_int$sqlite3_bind_blob$sqlite3_blob_bytessqlite3_blob_readsqlite3_blob_reopensqlite3_column_blobsqlite3_column_bytessqlite3_column_int64sqlite3_malloc
String ID:
API String ID: 2526640242-0
Opcode ID: 80c4178694f9100467d9f8914e06a53f74e1fc263bd09a9052fbc3a5e85adfd3
Instruction ID: ecb2fadc30329ad4410b738d56806f6ecd0ac298638076f7c65242d8805d2ed1
Opcode Fuzzy Hash: 80c4178694f9100467d9f8914e06a53f74e1fc263bd09a9052fbc3a5e85adfd3
Instruction Fuzzy Hash: A0D1C2B4A153189FDB14DF68C884B8EBBF2BFA9304F118599E888A7344E774D985CF41

Function 60966DF1 Relevance: 32.0, APIs: 17, Strings: 1, Instructions: 502
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 609296D1: sqlite3_value_bytes.SQLITE3 ref: 609296F3
Part of subcall function 609296D1: sqlite3_mprintf.SQLITE3 ref: 60929708
Part of subcall function 609296D1: sqlite3_free.SQLITE3 ref: 6092971B

sqlite3_value_text.SQLITE3 ref: 60966E30
sqlite3_mprintf.SQLITE3 ref: 60966E8C
sqlite3_free.SQLITE3 ref: 60966EA0
strcmp.MSVCRT ref: 60966F11
sqlite3_free.SQLITE3 ref: 60966F20
sqlite3_malloc.SQLITE3 ref: 60966FAA
sqlite3_bind_int64.SQLITE3 ref: 60967177

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_step.SQLITE3 ref: 60967182
sqlite3_column_type.SQLITE3 ref: 6096719A
sqlite3_reset.SQLITE3 ref: 609671AA
sqlite3_column_blob.SQLITE3 ref: 609671D5
sqlite3_reset.SQLITE3 ref: 6096720D
sqlite3_malloc.SQLITE3 ref: 60967235
sqlite3_free.SQLITE3 ref: 6096738D
sqlite3_reset.SQLITE3 ref: 6096742C
sqlite3_result_error_code.SQLITE3 ref: 60967456

Part of subcall function 6095FA45: sqlite3_column_blob.SQLITE3 ref: 6095FA6D

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_result_blob.SQLITE3 ref: 6096747C

Strings

matchinfo, xrefs: 60966E08

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mprintfsqlite3_reset$sqlite3_column_blobsqlite3_malloc$sqlite3_bind_int64sqlite3_column_typesqlite3_mutex_leavesqlite3_prepare_v2sqlite3_result_blobsqlite3_result_error_codesqlite3_stepsqlite3_value_bytessqlite3_value_textstrcmp
String ID: matchinfo
API String ID: 1423568287-2192345459
Opcode ID: c7f01f6d7a7790de48dc9d5f60ba2aac436da0f336c1d2af69b2104264b70887
Instruction ID: 3be0df16278722ad6cda5d6e0ae7eaa0e7e512ba4ad128f996f734e06d2b6327
Opcode Fuzzy Hash: c7f01f6d7a7790de48dc9d5f60ba2aac436da0f336c1d2af69b2104264b70887
Instruction Fuzzy Hash: 35221474A14218CBEB20CFA9C88079DBBF2BF69304F218569E855AB345D734DC86DF91

Function 6096923E Relevance: 29.3, APIs: 19, Instructions: 779COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3(?,?), ref: 609693A5
sqlite3_step.SQLITE3(?,?), ref: 609693B0
sqlite3_column_int64.SQLITE3(?,?), ref: 609693DC

Part of subcall function 6096A2BD: sqlite3_bind_int64.SQLITE3 ref: 6096A322
Part of subcall function 6096A2BD: sqlite3_step.SQLITE3 ref: 6096A32D
Part of subcall function 6096A2BD: sqlite3_column_int.SQLITE3 ref: 6096A347
Part of subcall function 6096A2BD: sqlite3_reset.SQLITE3 ref: 6096A354

sqlite3_reset.SQLITE3(?,?), ref: 609693F3
sqlite3_malloc.SQLITE3(?), ref: 60969561
sqlite3_malloc.SQLITE3(?), ref: 6096958D
sqlite3_step.SQLITE3(?), ref: 609695D2
sqlite3_column_int64.SQLITE3(?), ref: 609695EA
sqlite3_reset.SQLITE3(?), ref: 60969604
sqlite3_realloc.SQLITE3(?), ref: 609697D0
sqlite3_realloc.SQLITE3(?), ref: 609698A9

Part of subcall function 609129D5: sqlite3_initialize.SQLITE3(?,?,?,60915F55,?,?,?,?,?,?,00000000,?,?,?,60915FE2,00000000), ref: 609129E0

sqlite3_bind_int64.SQLITE3(?,?), ref: 609699B8
sqlite3_bind_int64.SQLITE3(?), ref: 6096934D

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_int64.SQLITE3(?,?), ref: 60969A6A
sqlite3_step.SQLITE3(?,?), ref: 60969A75
sqlite3_reset.SQLITE3(?,?), ref: 60969A80
sqlite3_free.SQLITE3(?), ref: 60969D41
sqlite3_free.SQLITE3(?), ref: 60969D4C
sqlite3_free.SQLITE3(?), ref: 60969D5B

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_int64$sqlite3_freesqlite3_resetsqlite3_step$sqlite3_column_int64sqlite3_mallocsqlite3_realloc$sqlite3_column_intsqlite3_initializesqlite3_mprintfsqlite3_mutex_leavesqlite3_prepare_v2
String ID:
API String ID: 961572588-0
Opcode ID: c724daf3936d67fd3e7a59374d144345718a9f8d9c21f3c7abba70c9fa35c0f4
Instruction ID: dba6eef834311e7f80380fc62c490a647dd1765b4da9a7e0a506f520bf28697a
Opcode Fuzzy Hash: c724daf3936d67fd3e7a59374d144345718a9f8d9c21f3c7abba70c9fa35c0f4
Instruction Fuzzy Hash: 9872F275A042298FDB24CF69C88078DB7F6FF98314F1586A9D889AB341D774AD81CF81

Function 609606A8 Relevance: 28.7, APIs: 14, Strings: 2, Instructions: 682COMMON

Download Yara Rule

Strings

wrong number of arguments to function snippet(), xrefs: 609606BF
snippet, xrefs: 609606D9

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: snippet$wrong number of arguments to function snippet()
API String ID: 0-1415007213
Opcode ID: 4f478a22a128a86722c1a65024d96313549bc1af9a851d902954fd7965b3e693
Instruction ID: bc93f16abc43d4f3fd761875b4ebf01958e834a383bde22727426b443a8863f0
Opcode Fuzzy Hash: 4f478a22a128a86722c1a65024d96313549bc1af9a851d902954fd7965b3e693
Instruction Fuzzy Hash: C462F670E14229CBDB24CF59C8907DEBBB2BF99314F1086A9D459AB350D774AE85CF80

Function 6096583A Relevance: 26.6, APIs: 14, Strings: 1, Instructions: 331COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 609658AA
sqlite3_realloc.SQLITE3 ref: 609658C8
qsort.MSVCRT ref: 6096590C
sqlite3_malloc.SQLITE3 ref: 6096594A
sqlite3_free.SQLITE3 ref: 6096598E
sqlite3_bind_int64.SQLITE3 ref: 60965A50
sqlite3_bind_int64.SQLITE3 ref: 60965AFC
sqlite3_column_int64.SQLITE3 ref: 60965B21
sqlite3_column_int64.SQLITE3 ref: 60965B3A
sqlite3_column_int64.SQLITE3 ref: 60965B53
sqlite3_column_bytes.SQLITE3 ref: 60965B6A
sqlite3_column_blob.SQLITE3 ref: 60965B7F
sqlite3_step.SQLITE3 ref: 60965C4D
sqlite3_reset.SQLITE3 ref: 60965C63

Strings

e, xrefs: 60965C68

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_column_int64$sqlite3_bind_int64$memcmpqsortsqlite3_column_blobsqlite3_column_bytessqlite3_freesqlite3_mallocsqlite3_reallocsqlite3_resetsqlite3_step
String ID: e
API String ID: 2765688754-4024072794
Opcode ID: be7e8315ac6bb083781f59c83fce59d9db6a6e098012851969460f1582c89f1c
Instruction ID: d5c66fc62cfe600711b58756dae63213f56318a98490cf8470d4ae7d29dab92c
Opcode Fuzzy Hash: be7e8315ac6bb083781f59c83fce59d9db6a6e098012851969460f1582c89f1c
Instruction Fuzzy Hash: CFE1E4B5A14319CFEB04DFA8C48079DBBF6BFA8304F11852AE859AB351E774D842CB41

Function 6092F74D Relevance: 19.8, APIs: 2, Strings: 8, Instructions: 2328COMMON

Download Yara Rule

Strings

=, xrefs: 609309A0
BINARY, xrefs: 609303BF, 6093040C, 60930446, 6093046C
H, xrefs: 6093005F
<, xrefs: 60930998
0, xrefs: 609303CD
;, xrefs: 6093099C
0, xrefs: 60931862
>, xrefs: 60930994

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: 0$0$;$<$=$>$BINARY$H
API String ID: 0-995857479
Opcode ID: 3b535ffa8c794769b71436a22a9005e9be2e53299859120d4b311d50808b1e99
Instruction ID: 407e726c1222a50ac4f3564cf0b14e49ffa981a9a9a85e8989eea68cc087d701
Opcode Fuzzy Hash: 3b535ffa8c794769b71436a22a9005e9be2e53299859120d4b311d50808b1e99
Instruction Fuzzy Hash: D1330474A042298FDB14CF68C490B9DBBF2BF99318F2581A9D859AB355D734ED82CF40

Function 6092114F Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 549COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 609212DD
sqlite3_stricmp.SQLITE3 ref: 60921320
sqlite3_stricmp.SQLITE3 ref: 6092135A
sqlite3_stricmp.SQLITE3 ref: 6092142F
sqlite3_stricmp.SQLITE3 ref: 6092145B
sqlite3_stricmp.SQLITE3 ref: 6092148E
sqlite3_stricmp.SQLITE3 ref: 609215B9

Strings

no such column, xrefs: 6092167F
ROWID, xrefs: 60921801
ambiguous column name, xrefs: 60921676

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: ROWID$ambiguous column name$no such column
API String ID: 912767213-1999615802
Opcode ID: 6ecd8f946fe9f06efcaadad8dd846b61acccec0fe9b7732b958e573ec2f0e174
Instruction ID: 999775ddbd2d31d4a5ed01a038f59fb492b6b2bffd61a86af4f8245b21f57f5d
Opcode Fuzzy Hash: 6ecd8f946fe9f06efcaadad8dd846b61acccec0fe9b7732b958e573ec2f0e174
Instruction Fuzzy Hash: 4C321370A142088FDB05CF58D58079EBBF7BFAA314F208159E859AB359D336E852CF81

Function 6095FDAE Relevance: 19.7, APIs: 13, Instructions: 158COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 6095FDD7

Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4

sqlite3_bind_int.SQLITE3 ref: 6095FE2D
sqlite3_step.SQLITE3 ref: 6095FE38
sqlite3_column_bytes.SQLITE3 ref: 6095FE50
sqlite3_column_blob.SQLITE3 ref: 6095FE63
sqlite3_reset.SQLITE3 ref: 6095FEA3
sqlite3_free.SQLITE3 ref: 6095FEB1

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_intsqlite3_column_blobsqlite3_column_bytessqlite3_freesqlite3_initializesqlite3_mallocsqlite3_resetsqlite3_step
String ID:
API String ID: 3167175467-0
Opcode ID: 8f78a912f726b425bb1e53f213956ec521839380435b7204de195e592d44cc89
Instruction ID: 867e1abe1b9d8afff939803784d7be15f2765b5bfa2346e8feba5dbdde2c9093
Opcode Fuzzy Hash: 8f78a912f726b425bb1e53f213956ec521839380435b7204de195e592d44cc89
Instruction Fuzzy Hash: A461F370A48219DBCB11DFA9C49579DBBF2FFA8318F10882CE485AB344E739D859CB51

Function 6094C8C2 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

sqlite3_value_int.SQLITE3 ref: 6094C9A3
sqlite3_value_int.SQLITE3 ref: 6094C9B3
sqlite3_bind_int64.SQLITE3 ref: 6094CA38
sqlite3_step.SQLITE3 ref: 6094CA46
sqlite3_reset.SQLITE3 ref: 6094CA57
sqlite3_bind_null.SQLITE3 ref: 6094CAFB
sqlite3_bind_null.SQLITE3 ref: 6094CB11
sqlite3_step.SQLITE3 ref: 6094CB1F
sqlite3_reset.SQLITE3 ref: 6094CB2D

Strings

d, xrefs: 6094CA65

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_nullsqlite3_resetsqlite3_stepsqlite3_value_int$sqlite3_bind_int64
String ID: d
API String ID: 788585506-2564639436
Opcode ID: d2f11cac82a0455c854f620262a0883d748cf086616ec3213a4399810b83bc0e
Instruction ID: 7ef39a6ddac577f8b519d45125a156414ab1a70b2d0639156342c4ed50531758
Opcode Fuzzy Hash: d2f11cac82a0455c854f620262a0883d748cf086616ec3213a4399810b83bc0e
Instruction Fuzzy Hash: 25919CB1E04218DFCB41EFA8C88568DBBF2FB64344F058969E895AB349D734D855CF81

Function 6095C314 Relevance: 16.5, APIs: 4, Strings: 5, Instructions: 741COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3 ref: 6095C4A8
sqlite3_strnicmp.SQLITE3 ref: 6095C4C7
sqlite3_stricmp.SQLITE3 ref: 6095C822
sqlite3_stricmp.SQLITE3 ref: 6095CA10

Strings

BINARY, xrefs: 6095C8B3, 6095C996
index, xrefs: 6095C3DB
sqlite_master, xrefs: 6095C633, 6095CBA9
UNIQUE, xrefs: 6095CB71
sqlite_temp_master, xrefs: 6095C63E, 6095CBB4

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_stricmpsqlite3_strnicmp
String ID: UNIQUE$BINARY$index$sqlite_master$sqlite_temp_master
API String ID: 456569458-3510621077
Opcode ID: 368d0f74d68b8ffe7f8c8d3e9e4bf83117905aa73531804f2d5f0428aa3dc48f
Instruction ID: 5a59681064280b009841fa68749411512e066db73c89bb3f88ff4c78e7b8a615
Opcode Fuzzy Hash: 368d0f74d68b8ffe7f8c8d3e9e4bf83117905aa73531804f2d5f0428aa3dc48f
Instruction Fuzzy Hash: 89724AB4A04258CFDB15CF99C480B9DBBF2BF68304F148969E895AB355D774EC86CB80

Function 6095F883 Relevance: 12.1, APIs: 8, Instructions: 81COMMON

Download Yara Rule

APIs

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_bind_int64.SQLITE3 ref: 6095F8E5

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_int.SQLITE3 ref: 6095F8FF

Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704

sqlite3_bind_int64.SQLITE3 ref: 6095F920
sqlite3_bind_int64.SQLITE3 ref: 6095F941
sqlite3_bind_int64.SQLITE3 ref: 6095F962
sqlite3_bind_blob.SQLITE3 ref: 6095F98B
sqlite3_step.SQLITE3 ref: 6095F996
sqlite3_reset.SQLITE3 ref: 6095F9A1

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_int64$sqlite3_mutex_leave$sqlite3_bind_blobsqlite3_bind_intsqlite3_freesqlite3_mprintfsqlite3_mutex_entersqlite3_prepare_v2sqlite3_resetsqlite3_step
String ID:
API String ID: 1154799056-0
Opcode ID: e44b370a1dfa701ff5b9885cc4cf0a2423246689aee604e01ba9336684cc4512
Instruction ID: 4c6ccefb8af807723b251ff764995e511564b2c054836566e23fd100615de26c
Opcode Fuzzy Hash: e44b370a1dfa701ff5b9885cc4cf0a2423246689aee604e01ba9336684cc4512
Instruction Fuzzy Hash: A3415DB4908708AFCB04DF69D18469EBBF1EF98314F11C91AE898A7344E775D9448F92

Function 60936B27 Relevance: 11.5, APIs: 2, Strings: 4, Instructions: 1027COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 609374D6
sqlite3_stricmp.SQLITE3 ref: 6093780A

Strings

BINARY, xrefs: 609376DE
a, xrefs: 60937506
NOCASE, xrefs: 609376E7
L, xrefs: 60936CA7

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_stricmpsqlite3_value_text
String ID: BINARY$L$NOCASE$a
API String ID: 3779612131-3955957805
Opcode ID: f6fd1f528eae1a2bfc48079cb3c143d8a34b6232c31dfa0af25abdabb41cb628
Instruction ID: 0f7853ab31ca1b2cdb65d1e7dea5df5077df61c625de61d554049eaff2e9cfc4
Opcode Fuzzy Hash: f6fd1f528eae1a2bfc48079cb3c143d8a34b6232c31dfa0af25abdabb41cb628
Instruction Fuzzy Hash: ADA2F574A04228CBDB18CFA8D591B9DFBF2BF59314F248259E859AB355D734E842CF80

Function 6094B7DB Relevance: 11.5, APIs: 5, Strings: 1, Instructions: 961COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 6094B888
sqlite3_malloc.SQLITE3(?), ref: 6094BA19
sqlite3_free.SQLITE3(?), ref: 6094BF8A

Part of subcall function 6094A9F5: sqlite3_free.SQLITE3 ref: 6094AA7A

sqlite3_malloc.SQLITE3 ref: 6094C255

Part of subcall function 6094B764: sqlite3_bind_int64.SQLITE3 ref: 6094B795
Part of subcall function 6094B764: sqlite3_bind_int64.SQLITE3 ref: 6094B7B3
Part of subcall function 6094B764: sqlite3_step.SQLITE3 ref: 6094B7C1

sqlite3_free.SQLITE3 ref: 6094C5B9

Strings

0, xrefs: 6094C365

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_malloc$sqlite3_bind_int64$sqlite3_step
String ID: 0
API String ID: 3177887849-4108050209
Opcode ID: ebfb5d3a62b3820ecebd18ab8241e81d19939014d8b97e1e1c65bf5a57d8488d
Instruction ID: 5dc17e4d84bfec96016c844e71b0a8efda0105c55c74a22169285dd350886d01
Opcode Fuzzy Hash: ebfb5d3a62b3820ecebd18ab8241e81d19939014d8b97e1e1c65bf5a57d8488d
Instruction Fuzzy Hash: 9E9239B5A042198FCB65CF18C8907CDB7B2EBA9314F2185E9D849A7355DB30EE95CF80

Function 6094DA3A Relevance: 11.3, APIs: 3, Strings: 3, Instructions: 840COMMON

Download Yara Rule

Strings

H, xrefs: 6094E100
H, xrefs: 6094E4B2
H, xrefs: 6094DECF

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: H$H$H
API String ID: 0-1989617792
Opcode ID: d9ce9a564c735bd3486351ad8d0342d86e9fcc605a93b9a931959543cbb2d273
Instruction ID: 6b84c544b96c7eab427e285d03ecc93b5d0eb8921b65a61b014ce3b2339d8c39
Opcode Fuzzy Hash: d9ce9a564c735bd3486351ad8d0342d86e9fcc605a93b9a931959543cbb2d273
Instruction Fuzzy Hash: 7A82F574A052188FDB14CF98C490B9DBBF2BFA9314F248569E855AB355E774EC42CF80

Function 6093FAD6 Relevance: 11.2, APIs: 5, Strings: 1, Instructions: 657COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 6093FF2E
sqlite3_log.SQLITE3 ref: 6093FF69

Part of subcall function 60904396: sqlite3_mutex_enter.SQLITE3(?,?,?,60908235), ref: 60904404

Part of subcall function 60904423: sqlite3_mutex_leave.SQLITE3(6090449D,?,?,?,60908270), ref: 60904446

sqlite3_randomness.SQLITE3 ref: 6093FF7C
sqlite3_snprintf.SQLITE3 ref: 6093FFA8
sqlite3_free.SQLITE3 ref: 60940046

Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8

Strings

d, xrefs: 6093FF12

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_log$sqlite3_freesqlite3_mutex_entersqlite3_mutex_leavesqlite3_mutex_trysqlite3_randomnesssqlite3_snprintf
String ID: d
API String ID: 1629246311-2564639436
Opcode ID: cd1361515989f55d602762cd8221744f530961dc60c06e298635b18f92336be5
Instruction ID: 39d41d0acd81b6f8d193bd419e839c1f28e43f23523dde6debf7dff496098844
Opcode Fuzzy Hash: cd1361515989f55d602762cd8221744f530961dc60c06e298635b18f92336be5
Instruction Fuzzy Hash: E5523670A442548FDB18CF68C49478EBBF7BFA9308F208569E8699B355C778E885CF41

Function 60963143 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 60963159
sqlite3_bind_int64.SQLITE3 ref: 609633E6
sqlite3_mutex_leave.SQLITE3 ref: 609634B6

Strings

indexed, xrefs: 609631F0
2, xrefs: 60963403
foreign key, xrefs: 609631B8

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_mutex_leavesqlite3_stricmp
String ID: 2$foreign key$indexed
API String ID: 4126863092-702264400
Opcode ID: efb0247afb620838301bdf32ec29a55ffab8ab84c5461d6934eb6e15b590f11f
Instruction ID: 3d5d194cd292e354de8359ea213fef7e5121ae3f60f7d2d7ba557b44893e8b9c
Opcode Fuzzy Hash: efb0247afb620838301bdf32ec29a55ffab8ab84c5461d6934eb6e15b590f11f
Instruction Fuzzy Hash: 6BE1B374A142099FDB04CFA8D590A9DBBF2BFA9304F21C129E855AB754DB35ED82CF40

Function 6094A6C5 Relevance: 10.6, APIs: 7, Instructions: 144COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 6094A72B
sqlite3_step.SQLITE3 ref: 6094A73C
sqlite3_column_blob.SQLITE3 ref: 6094A760
sqlite3_column_bytes.SQLITE3 ref: 6094A77C
sqlite3_malloc.SQLITE3 ref: 6094A793
sqlite3_reset.SQLITE3 ref: 6094A7F2
sqlite3_free.SQLITE3(?), ref: 6094A87C

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_column_blobsqlite3_column_bytessqlite3_freesqlite3_mallocsqlite3_mutex_entersqlite3_resetsqlite3_step
String ID:
API String ID: 2794791986-0
Opcode ID: 324244e72ed1eb068e97444324dd06558e7f5640642cd65f7376e38a8826fd77
Instruction ID: 088d5e00ded46b3eb5457b54e5d33bc48436a4b712d77f6ae5dc1ca3eb859b7b
Opcode Fuzzy Hash: 324244e72ed1eb068e97444324dd06558e7f5640642cd65f7376e38a8826fd77
Instruction Fuzzy Hash: BE5110B5A042058FCB04CF69C48069ABBF6FF68318F158569E858AB345D734EC82CF90

Function 6093323D Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 432COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 609334A2
sqlite3_stricmp.SQLITE3 ref: 609334BB

Strings

DISTINCT, xrefs: 60933658
USING COVERING INDEX , xrefs: 609333F7
ORDER BY, xrefs: 60933671

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: USING COVERING INDEX $DISTINCT$ORDER BY
API String ID: 912767213-1308749736
Opcode ID: 5e6ae8a77223c4cf3853263767bd84c2ef0a0cb2633a4755bdfaa367f33b2fd5
Instruction ID: 4f43644a9add5c5df618cbd47cd61ce2203d262f2077f605e752fe25420d36ab
Opcode Fuzzy Hash: 5e6ae8a77223c4cf3853263767bd84c2ef0a0cb2633a4755bdfaa367f33b2fd5
Instruction Fuzzy Hash: 2412D674A08268CFDB25DF28C880B5AB7B3AFA9314F1085E9E8899B355D774DD81CF41

Function 6094B407 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 6094B488
sqlite3_step.SQLITE3 ref: 6094B496
sqlite3_reset.SQLITE3 ref: 6094B4A4
sqlite3_bind_int64.SQLITE3 ref: 6094B4D2
sqlite3_step.SQLITE3 ref: 6094B4E0
sqlite3_reset.SQLITE3 ref: 6094B4EE

Part of subcall function 6094B54C: memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,6094B44B), ref: 6094B6B5

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_resetsqlite3_step$memmove
String ID:
API String ID: 4082478743-0
Opcode ID: aa77e302053f557c70a8d8c80c1bb3ccc0b69d7e46be98bddd9db9cb48891f7f
Instruction ID: 9e7f29540a3c6f2d28ce6b101cd1a975f5529a8f599b89b7128c34d749e8d9ce
Opcode Fuzzy Hash: aa77e302053f557c70a8d8c80c1bb3ccc0b69d7e46be98bddd9db9cb48891f7f
Instruction Fuzzy Hash: DD41D2B4A087018FCB50DF69C484A9EB7F6EFA8364F158929EC99CB315E734E8418F51

Function 6095ECA6 Relevance: 9.1, APIs: 6, Instructions: 98COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3 ref: 6095ED06

Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA

sqlite3_mprintf.SQLITE3 ref: 6095ED2B
sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
sqlite3_free.SQLITE3 ref: 6095ED9B
sqlite3_bind_value.SQLITE3 ref: 6095EDDF

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mprintf$sqlite3_bind_valuesqlite3_freesqlite3_initializesqlite3_prepare_v2sqlite3_vmprintf
String ID:
API String ID: 2308881617-0
Opcode ID: b18b84f8f648529070cc53ca7e1ac59d8ae9759e969b0d3f17e200a645f66353
Instruction ID: 47af330925bcb78a56884a9c91f22277db2bd1c22034a42e343db5c7652a2369
Opcode Fuzzy Hash: b18b84f8f648529070cc53ca7e1ac59d8ae9759e969b0d3f17e200a645f66353
Instruction Fuzzy Hash: 4D4103B4A05315CFDB15CF29C480B9ABBF6FB98310F1186AAE8589B384E335E855CF51

Function 6095FCCE Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 6095FCEE

Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4

sqlite3_free.SQLITE3 ref: 6095FD37

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_malloc
String ID:
API String ID: 1320878182-0
Opcode ID: 3f4991d1e02eeb2c3599bfa8467456ca06433810823f3707d06756d1fe6bd1fc
Instruction ID: 83321851b4fe24c01f4eb91194473882a2e2461ea6946649068b7ec0425b26ad
Opcode Fuzzy Hash: 3f4991d1e02eeb2c3599bfa8467456ca06433810823f3707d06756d1fe6bd1fc
Instruction Fuzzy Hash: CE21C3B09083058FCB05DF69C485A9EBBF6EFA8318F00882DE8849B344E778D845CF51

Function 6094D33B Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 6094D354
sqlite3_mutex_leave.SQLITE3 ref: 6094D546

Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905D8B
Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905DA4
Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905DB8

sqlite3_stricmp.SQLITE3 ref: 6094D3DA

Strings

BINARY, xrefs: 6094D45D, 6094D469
INTEGER, xrefs: 6094D462

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_stricmp$sqlite3_mutex_entersqlite3_mutex_leave
String ID: BINARY$INTEGER
API String ID: 317512412-1676293250
Opcode ID: a7efc97792d1e6a4bc5cda92ab6d03f9066f32250883ff14ac0274f07e3e06bf
Instruction ID: cace79839434994537c0410bddb438ad3d501bddbf1b20fcc6a8a8bdb5da7fdd
Opcode Fuzzy Hash: a7efc97792d1e6a4bc5cda92ab6d03f9066f32250883ff14ac0274f07e3e06bf
Instruction Fuzzy Hash: 8E712978A056099BDB05CF69C49079EBBF2BFA8308F11C529EC55AB3A4D734E941CF80

Function 6094B54C Relevance: 7.6, APIs: 5, Instructions: 145COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 6094B582
sqlite3_step.SQLITE3 ref: 6094B590
sqlite3_column_int64.SQLITE3 ref: 6094B5AD
sqlite3_reset.SQLITE3 ref: 6094B5EE
memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,6094B44B), ref: 6094B6B5

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: memmovesqlite3_bind_int64sqlite3_column_int64sqlite3_resetsqlite3_step
String ID:
API String ID: 2802900177-0
Opcode ID: f7dd783d858009ac2aa36dfb06bc3a4e86bc75c1920f7d1bf53ec4d0fe99899e
Instruction ID: fa681a173a9aa7ad5377a8f3376375fc0286f70c891b696e42c92f52458a3a0e
Opcode Fuzzy Hash: f7dd783d858009ac2aa36dfb06bc3a4e86bc75c1920f7d1bf53ec4d0fe99899e
Instruction Fuzzy Hash: 0B517D75A082018FCB14CF69C48169EF7F7FBA8314F25C669D8499B318EA74EC81CB81

Function 6095FB98 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

sqlite3_value_int.SQLITE3 ref: 6095FC20
sqlite3_bind_int.SQLITE3 ref: 6095FC39
sqlite3_bind_value.SQLITE3 ref: 6095FC99
sqlite3_step.SQLITE3 ref: 6095FCA8
sqlite3_reset.SQLITE3 ref: 6095FCB3

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_intsqlite3_bind_valuesqlite3_resetsqlite3_stepsqlite3_value_int
String ID:
API String ID: 908518397-0
Opcode ID: 3924c563a705a1272a877f1552a30ddf5336e1e3a4193b3414f0c65f6aed999e
Instruction ID: 414031b85d29458480bf4c96568fb44df97e455c8855ca9e26388b955e5efdec
Opcode Fuzzy Hash: 3924c563a705a1272a877f1552a30ddf5336e1e3a4193b3414f0c65f6aed999e
Instruction Fuzzy Hash: E341A0B0A046058FD705DF29C58572ABBF6FF64318F01846AECC58B356E738D8A5DB50

Function 6094A92B Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 6094A969

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_null.SQLITE3 ref: 6094A97B
sqlite3_bind_blob.SQLITE3 ref: 6094A9A1
sqlite3_step.SQLITE3 ref: 6094A9A9
sqlite3_reset.SQLITE3 ref: 6094A9B8

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_blobsqlite3_bind_int64sqlite3_bind_nullsqlite3_mutex_leavesqlite3_resetsqlite3_step
String ID:
API String ID: 2721088213-0
Opcode ID: 0987861e968245ea630cb38a86c96ee15305b47d4e417f3ac8b63dd8c9b15d18
Instruction ID: 48795e04d589229ceb55daa7a6f1ce45c31714b5f6b4226137eaa884ebdab8e2
Opcode Fuzzy Hash: 0987861e968245ea630cb38a86c96ee15305b47d4e417f3ac8b63dd8c9b15d18
Instruction Fuzzy Hash: 1C2104B05047009FD714DF29C18562BBBE6EBA8314F15C96DE8898B349E379E881CB92

Function 60951E86 Relevance: 6.8, APIs: 1, Strings: 2, Instructions: 1556COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3(?), ref: 609527DB

Strings

4, xrefs: 60952375
, xrefs: 60952766

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: $4
API String ID: 912767213-391154401
Opcode ID: 47c65962433417efb1d89a38120d36cadfbf56bc44f14329ced35f2e03e0f49b
Instruction ID: 6b8fb852f0a3f29cee159783c149bab179eaa0439a16ede92b81998f85a47a40
Opcode Fuzzy Hash: 47c65962433417efb1d89a38120d36cadfbf56bc44f14329ced35f2e03e0f49b
Instruction Fuzzy Hash: E2F2E674A08218CFDB25CF69C89079DBBB2BF69304F2081A9E499AB395D734DD85CF41

Function 6094E9BC Relevance: 6.5, APIs: 1, Strings: 2, Instructions: 1284COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 6094EC2B

Strings

_rowid_, xrefs: 6094EE69
ROWID, xrefs: 6094ECEA

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: ROWID$_rowid_
API String ID: 912767213-713255191
Opcode ID: 42e0b4a3e0f3f8792d5c760e5404c3bcdefe2c040ef1b16585664ff91b73ace2
Instruction ID: 9cbecf72b78666ce094892631a5f8c5a2a3eae14fc7a959aa7ec59660d381c46
Opcode Fuzzy Hash: 42e0b4a3e0f3f8792d5c760e5404c3bcdefe2c040ef1b16585664ff91b73ace2
Instruction Fuzzy Hash: 2ED2D374A04219CBDB24CF68C890B9DBBF6BF98308F2085A9E499AB355D774DD81CF41

Function 6093B368 Relevance: 6.5, APIs: 4, Instructions: 508COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 6093B3CA
sqlite3_log.SQLITE3 ref: 6093B493
sqlite3_log.SQLITE3 ref: 6093B9DE

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_log
String ID:
API String ID: 632333372-0
Opcode ID: 4f2b17eca27222a8bc178abb5b4c92c57f661b69f859f12d4a0125327be4c155
Instruction ID: 744f91bee486328f7640fe4ac38668a85db8df308d9887ec45d0042335c376f7
Opcode Fuzzy Hash: 4f2b17eca27222a8bc178abb5b4c92c57f661b69f859f12d4a0125327be4c155
Instruction Fuzzy Hash: FE224674A04629CFDB04CFA9D481A8DBBF2BF69308F108129EA55AB356D734EC42CF51

Function 60963D35 Relevance: 6.4, APIs: 4, Instructions: 420COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 60963E74
memcmp.MSVCRT ref: 60963EB8
sqlite3_realloc.SQLITE3(?), ref: 60963F38

Part of subcall function 60941B27: sqlite3_free.SQLITE3 ref: 60941B3C
Part of subcall function 60941B27: sqlite3_blob_close.SQLITE3 ref: 60941B47

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: memcmp$sqlite3_blob_closesqlite3_freesqlite3_realloc
String ID:
API String ID: 3707747965-0
Opcode ID: 3812bb5343e672b5d92497c084b0526760b2012d24f3e464b28deea5815b7571
Instruction ID: 2d98187ece3df4610b15f999fbc10f3983f67395f8e8440e3b165b5c2a3e0898
Opcode Fuzzy Hash: 3812bb5343e672b5d92497c084b0526760b2012d24f3e464b28deea5815b7571
Instruction Fuzzy Hash: B5120E70E14218CFEB14CFA8C490B9DBBB2BFA9304F248169D859AB355D774E886CF50

Function 6093F42E Relevance: 6.4, APIs: 4, Instructions: 416COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 6093F443

Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8

sqlite3_mutex_enter.SQLITE3 ref: 6093F45C

Part of subcall function 60939559: memcmp.MSVCRT ref: 60939694
Part of subcall function 60939559: memcmp.MSVCRT ref: 609396CA

sqlite3_mutex_leave.SQLITE3 ref: 6093F8CD
sqlite3_mutex_leave.SQLITE3 ref: 6093F8E3

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: memcmpsqlite3_mutex_entersqlite3_mutex_leave$sqlite3_mutex_try
String ID:
API String ID: 4038589952-0
Opcode ID: 29e5932b9866e1e5e2fcd92ac707fe98724786dada8c9b11deae4621e05e1fb7
Instruction ID: 916146ddc5613ce70bfe97dc7fabc38680eb49f4f4fdba01105907ea2da9c682
Opcode Fuzzy Hash: 29e5932b9866e1e5e2fcd92ac707fe98724786dada8c9b11deae4621e05e1fb7
Instruction Fuzzy Hash: 87F13674A046158FDB18CFA9C590A9EB7F7AFA8308F248429E846AB355D774EC42CF40

Function 6094C64A Relevance: 6.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 6094A894: sqlite3_bind_int64.SQLITE3 ref: 6094A8C0
Part of subcall function 6094A894: sqlite3_step.SQLITE3 ref: 6094A8CE
Part of subcall function 6094A894: sqlite3_column_int64.SQLITE3 ref: 6094A8E9
Part of subcall function 6094A894: sqlite3_reset.SQLITE3 ref: 6094A90F

sqlite3_bind_int64.SQLITE3 ref: 6094C719
sqlite3_step.SQLITE3 ref: 6094C72A
sqlite3_reset.SQLITE3 ref: 6094C73B

Part of subcall function 6094B54C: memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,6094B44B), ref: 6094B6B5

Part of subcall function 6094A9F5: sqlite3_free.SQLITE3 ref: 6094AA7A

sqlite3_free.SQLITE3 ref: 6094C881

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_freesqlite3_resetsqlite3_step$memmovesqlite3_column_int64
String ID:
API String ID: 3487101843-0
Opcode ID: 5f7c6ccdcb237f7a487fb09799aacf08d073da1bf61c53431d7ccff799043987
Instruction ID: dadb85a3919e548a164012fc2e04d9b0ab11445217433cc10b515e99a95ed5c3
Opcode Fuzzy Hash: 5f7c6ccdcb237f7a487fb09799aacf08d073da1bf61c53431d7ccff799043987
Instruction Fuzzy Hash: 3681FA74A046098FCB44DF99C480A9DF7F7AFA8354F258529E855AB314EB34EC46CF90

Function 6096CF94 Relevance: 6.1, APIs: 4, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 6096CFE9
GetProcAddress.KERNEL32 ref: 6096D007
GetProcAddress.KERNEL32 ref: 6096D024

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: 47effb9e05507b14184525c79ea85ab5816a8a266cba0ac40e84aac47dcd7279
Instruction ID: 8e9be920c64f9dfeb33fffcf0e4d61348394ea5588bcff17eaa3a053c8d3138e
Opcode Fuzzy Hash: 47effb9e05507b14184525c79ea85ab5816a8a266cba0ac40e84aac47dcd7279
Instruction Fuzzy Hash: DC317471629345CBEF10DF14C9897597FE7E7A6348F208418D454AB361D3BAD884EB11

Function 6096A38C Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_bind_int.SQLITE3 ref: 6096A3DE

Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704

sqlite3_column_int.SQLITE3 ref: 6096A3F3
sqlite3_step.SQLITE3 ref: 6096A435
sqlite3_reset.SQLITE3 ref: 6096A445

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_intsqlite3_bind_int64sqlite3_column_intsqlite3_freesqlite3_mprintfsqlite3_prepare_v2sqlite3_resetsqlite3_step
String ID:
API String ID: 247099642-0
Opcode ID: 64427881e425bd4a7d2fa305579facb0dd1ab8a71ce9f1271cd8f49c57a97bec
Instruction ID: 69535c0605dcb565d56369453fd68d3a3097adfd173720c6e67b3d4aca8354ad
Opcode Fuzzy Hash: 64427881e425bd4a7d2fa305579facb0dd1ab8a71ce9f1271cd8f49c57a97bec
Instruction Fuzzy Hash: FF2151B0A143148BEB109FA9D88479EB7FAEF64308F00852DE89597350EBB8D845CF51

Function 60969D75 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

sqlite3_bind_int.SQLITE3 ref: 60969E15
sqlite3_step.SQLITE3 ref: 60969E20
sqlite3_column_int.SQLITE3 ref: 60969E3A
sqlite3_reset.SQLITE3 ref: 60969E4F

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_intsqlite3_column_intsqlite3_resetsqlite3_step
String ID:
API String ID: 4060988840-0
Opcode ID: 2b0f9e58d1e328cb3829e779b22d50d117fa313bd5850face777db4315682c5b
Instruction ID: fc6e7a51f6a7180fd9359021bb537724969cb003eeaebdbdf06144410461e2ec
Opcode Fuzzy Hash: 2b0f9e58d1e328cb3829e779b22d50d117fa313bd5850face777db4315682c5b
Instruction Fuzzy Hash: 89219270A182018BEB119F79C98479EBBEFEFA0714F004539EC948B385E776C885C751

Function 6096A2BD Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_bind_int64.SQLITE3 ref: 6096A322

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_step.SQLITE3 ref: 6096A32D
sqlite3_column_int.SQLITE3 ref: 6096A347

Part of subcall function 6091D4F4: sqlite3_value_int.SQLITE3 ref: 6091D50C

sqlite3_reset.SQLITE3 ref: 6096A354

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_column_intsqlite3_freesqlite3_mprintfsqlite3_mutex_leavesqlite3_prepare_v2sqlite3_resetsqlite3_stepsqlite3_value_int
String ID:
API String ID: 326482775-0
Opcode ID: de94f0bba3b8b54078f1ceecce583a965f8e010bb36370f6070bcd8bc28ee8b0
Instruction ID: 7c1586c82cd56d85cf32929a5cd575737867df940847ca2bf63216634e784e33
Opcode Fuzzy Hash: de94f0bba3b8b54078f1ceecce583a965f8e010bb36370f6070bcd8bc28ee8b0
Instruction Fuzzy Hash: 0E214DB0A043049BDB04DFA9C480B9EF7FAEFA8354F04C429E8959B340E778D8418B51

Function 6095FFB2 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

sqlite3_result_error_code.SQLITE3 ref: 60960043

Part of subcall function 6095EE02: sqlite3_mprintf.SQLITE3 ref: 6095EE2B
Part of subcall function 6095EE02: sqlite3_prepare_v2.SQLITE3 ref: 6095EE5C
Part of subcall function 6095EE02: sqlite3_free.SQLITE3 ref: 6095EE67

sqlite3_bind_int64.SQLITE3 ref: 6095FFFA

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_step.SQLITE3 ref: 60960009
sqlite3_reset.SQLITE3 ref: 60960019

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_leave$sqlite3_bind_int64sqlite3_freesqlite3_mprintfsqlite3_mutex_entersqlite3_prepare_v2sqlite3_resetsqlite3_result_error_codesqlite3_step
String ID:
API String ID: 266850690-0
Opcode ID: 6eafe2b5b73731162c5a0b55dd84156859f8d48e6571a8b1562ff8fb11924ca9
Instruction ID: bd844383fd300bb091138132bad9ec757de118e5a7fb84aacb1b0013b167b2e1
Opcode Fuzzy Hash: 6eafe2b5b73731162c5a0b55dd84156859f8d48e6571a8b1562ff8fb11924ca9
Instruction Fuzzy Hash: 7311A3716043019FDB02DF29C4C475ABBEAAFA4358F058569EC888F305E776DC85CB91

Function 6095F9AD Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_bind_int.SQLITE3 ref: 6095F9EE

Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704

sqlite3_step.SQLITE3 ref: 6095F9F9
sqlite3_column_type.SQLITE3 ref: 6095FA11
sqlite3_reset.SQLITE3 ref: 6095FA21

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_intsqlite3_bind_int64sqlite3_column_typesqlite3_freesqlite3_mprintfsqlite3_prepare_v2sqlite3_resetsqlite3_step
String ID:
API String ID: 4183316597-0
Opcode ID: 6cdff1a39566bdb7d46aaaebd0f80e156b810e9be7163e254f5b182bf79c1317
Instruction ID: c90fffb536399796cf1a2968a621f06012012e5c87e0cfeaeddef3a9d6715a79
Opcode Fuzzy Hash: 6cdff1a39566bdb7d46aaaebd0f80e156b810e9be7163e254f5b182bf79c1317
Instruction Fuzzy Hash: 91014C70E082049BDB11DFA6C49479EBBF5EF6435CF008869E8949B380E779D945CB82

Function 6094A894 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 6094A8C0

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_step.SQLITE3 ref: 6094A8CE
sqlite3_column_int64.SQLITE3 ref: 6094A8E9
sqlite3_reset.SQLITE3 ref: 6094A90F

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_leave$sqlite3_bind_int64sqlite3_column_int64sqlite3_mutex_entersqlite3_resetsqlite3_step
String ID:
API String ID: 3728028068-0
Opcode ID: 4480569ff34e75ea7b3577054b4356c5dff4901ba2a75f55588298fac9ec1789
Instruction ID: ee155327ad46b109c371b626633bea00b74b78c8347343cda40424352d7c4f30
Opcode Fuzzy Hash: 4480569ff34e75ea7b3577054b4356c5dff4901ba2a75f55588298fac9ec1789
Instruction Fuzzy Hash: 31010C7060A3009FDB00EF2CC48539ABBE5EF64358F15887DE88C8B345E775D8508B82

Function 6095F7F7 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_bind_int64.SQLITE3 ref: 6095F83D

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_int64.SQLITE3 ref: 6095F85E
sqlite3_step.SQLITE3 ref: 6095F869
sqlite3_reset.SQLITE3 ref: 6095F874

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_mutex_leave$sqlite3_freesqlite3_mprintfsqlite3_mutex_entersqlite3_prepare_v2sqlite3_resetsqlite3_step
String ID:
API String ID: 2747803115-0
Opcode ID: e7ba5a424be07f97404f27e37360827cc19527dc01f9216413d7b5c44ff8a2c2
Instruction ID: f00e87c6dd3c8672f4b8fa92d33f96d93ee8ab4b9f2e93312e2458fba8eee522
Opcode Fuzzy Hash: e7ba5a424be07f97404f27e37360827cc19527dc01f9216413d7b5c44ff8a2c2
Instruction Fuzzy Hash: 9311DBB4A046049FCB04DF69C0C565AF7F6EFA8318F05C869E8898B349E735E894CB91

Function 6095F772 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_bind_int64.SQLITE3 ref: 6095F7AC

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_blob.SQLITE3 ref: 6095F7D5
sqlite3_step.SQLITE3 ref: 6095F7E0
sqlite3_reset.SQLITE3 ref: 6095F7EB

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_leave$sqlite3_bind_blobsqlite3_bind_int64sqlite3_freesqlite3_mprintfsqlite3_mutex_entersqlite3_prepare_v2sqlite3_resetsqlite3_step
String ID:
API String ID: 1956248851-0
Opcode ID: 50d15a15163a625fc2631aa0d6ee46575d14479fce2c17ccb278089255f39c88
Instruction ID: 4081a9388348d49f983bc2db4af636c0e8f58482a36dc41ad0278772ae94fdf0
Opcode Fuzzy Hash: 50d15a15163a625fc2631aa0d6ee46575d14479fce2c17ccb278089255f39c88
Instruction Fuzzy Hash: 2E01AEB4908304AFDB00EF69D48579EFBE5EF68358F00885EE89887345E7B5D9448B82

Function 60964807 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 609649ED
sqlite3_free.SQLITE3 ref: 60964A1E

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 60964A75

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_enter
String ID:
API String ID: 3930042888-0
Opcode ID: a1cbf21d678072f8e2cd414f0f274c643203f7d5c966c39000ef3db80036896e
Instruction ID: e0c543494f0a6fdde79d31354cfaa994e0c64f353d375ed7759d0f545c8a1ee1
Opcode Fuzzy Hash: a1cbf21d678072f8e2cd414f0f274c643203f7d5c966c39000ef3db80036896e
Instruction Fuzzy Hash: 2EA13774A65215DFEB05CFD8C0A0B9EBBB6BFA9304F218069D855AB355D730D841CF80

Function 60932654 Relevance: 4.7, Strings: 3, Instructions: 973COMMON

Download Yara Rule

Strings

GROUP BY, xrefs: 60932C50, 60932C6C
DISTINCT, xrefs: 60932C5B, 60933658
ORDER BY, xrefs: 60933671

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: DISTINCT$GROUP BY$ORDER BY
API String ID: 0-2369623052
Opcode ID: 1a459299d3b94f7108005aefb261192b5d85503d5cd0a7f4689da89b73ac3331
Instruction ID: 5c4a17a5bb23bc051e37144b0452ab904043a6136018b6355a04d009071dc204
Opcode Fuzzy Hash: 1a459299d3b94f7108005aefb261192b5d85503d5cd0a7f4689da89b73ac3331
Instruction Fuzzy Hash: BCA2D574A04228CFDB24DF28C880B99B7B2BFA9304F1085E9E489AB755D774DE85CF51

Function 60925778 Relevance: 4.6, APIs: 3, Instructions: 80COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 609257D2

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_double.SQLITE3 ref: 609257EA

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_doublesqlite3_bind_int64sqlite3_mutex_leave
String ID:
API String ID: 1465616180-0
Opcode ID: 9530f87787b8119f4c9cc68ae88dcf3bf39b5687c460dfc3dfef9c72e832448e
Instruction ID: 7d90fc06d4cce0e838b429dd10c1bf3c3a361cb752c215b3ba3cb2f1ab2ab036
Opcode Fuzzy Hash: 9530f87787b8119f4c9cc68ae88dcf3bf39b5687c460dfc3dfef9c72e832448e
Instruction Fuzzy Hash: 3D314CB1918304DBCB08DF19E49519ABBE6EB98324F10C51EEC994B38DD378C990CB91

Function 0054E71C Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0054E814
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0054E81E
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0054E82B

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: f20b24d365213a08dce6008b5d01b7e7a96437df28e61d1a0384d5fe624605e2
Instruction ID: f17e9e4e5efe5d91b3f164491ce13b55e897eb81942158b8e3bf9c2759ef28dd
Opcode Fuzzy Hash: f20b24d365213a08dce6008b5d01b7e7a96437df28e61d1a0384d5fe624605e2
Instruction Fuzzy Hash: 7D31D5749412199BCF21DF68D8897CDBBB8FF18314F5041EAE41CA6251E7709B859F44

Function 6094B6ED Relevance: 4.5, APIs: 3, Instructions: 34COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 6094B71E

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_int64.SQLITE3 ref: 6094B73C
sqlite3_step.SQLITE3 ref: 6094B74A

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_int64$sqlite3_mutex_leavesqlite3_step
String ID:
API String ID: 3305529457-0
Opcode ID: dc92f9052f14c19b23696c87723feab2593fd922d888b89f432a916288e70c30
Instruction ID: cea3564161c85327b61b62d60446574847d05a2bcfebeda4641ea5396b37aa5a
Opcode Fuzzy Hash: dc92f9052f14c19b23696c87723feab2593fd922d888b89f432a916288e70c30
Instruction Fuzzy Hash: D401A8B45047049FCB00DF19D9C968ABBE5FF98354F158869FC888B305D374E8548BA6

Function 6094B764 Relevance: 4.5, APIs: 3, Instructions: 34COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 6094B795

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_int64.SQLITE3 ref: 6094B7B3
sqlite3_step.SQLITE3 ref: 6094B7C1

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_int64$sqlite3_mutex_leavesqlite3_step
String ID:
API String ID: 3305529457-0
Opcode ID: aa85c24925b376cbc314ef521cc12e9f9171d3119abae0787e576649609cd9a8
Instruction ID: 1e84d685e39bf1e153ba29bb425c2efe513faafee25cd0ef6e7f8ad628d1a415
Opcode Fuzzy Hash: aa85c24925b376cbc314ef521cc12e9f9171d3119abae0787e576649609cd9a8
Instruction Fuzzy Hash: 6B01BBB45057049FCB00DF19D58968ABBE5EF98354F15C46AFC888B305E374E854CFA6

Function 00556F24 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00556F23,?,?,?,?), ref: 00556F46
TerminateProcess.KERNEL32(00000000,?,00556F23,?,?,?,?), ref: 00556F4D
ExitProcess.KERNEL32 ref: 00556F5F

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 9d1ea1265699c30a151269c09235e5e5f03c82d4ead66365775e74f5be5914f0
Instruction ID: 24ce1fecfe2234257ceae90bcc55c5345e52b6b2bf42981a5bddfe44051707a3
Opcode Fuzzy Hash: 9d1ea1265699c30a151269c09235e5e5f03c82d4ead66365775e74f5be5914f0
Instruction Fuzzy Hash: 74E04632400148EBCF126F58FD6CA083F29FF60342B808019F90887131CB35DE89EB80

Function 60937929 Relevance: 3.8, Strings: 2, Instructions: 1333COMMON

Download Yara Rule

Strings

v, xrefs: 60938385
s, xrefs: 60938779

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: s$v
API String ID: 0-3782752948
Opcode ID: d38dca65ca8ca9be3ac16ead990230180713fb5fa2f381b6888f18fb988e91ae
Instruction ID: 8c4192619820c4c11a8cd86770b12f3c7294714d41c1962cbc84496e602a87d9
Opcode Fuzzy Hash: d38dca65ca8ca9be3ac16ead990230180713fb5fa2f381b6888f18fb988e91ae
Instruction Fuzzy Hash: 58D2A074A04218CFDB18CFA9C49079EBBB2BF98304F208169E859AB355D775ED86CF41

Function 6091F2C9 Relevance: 3.5, APIs: 2, Instructions: 493COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4eb881292827090b34289a399ec51e1b83ae8a1a1c2a3728c880324a6037d80
Instruction ID: 70f4401a15b8a5aa659b5a0682ef13241a1b92f9b7b370028a5e83a28cfaf3aa
Opcode Fuzzy Hash: a4eb881292827090b34289a399ec51e1b83ae8a1a1c2a3728c880324a6037d80
Instruction Fuzzy Hash: C3223674E0825D8FDB04CFA9C490B9EBBB2BF59318F148199D859AB395D334EC86CB40

Function 6090C1D6 Relevance: 3.0, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 6090C1EA
sqlite3_mutex_leave.SQLITE3 ref: 6090C22F

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: 8c595cf50166d2d57a1b46d7a61a8743a20f226779b5cb212a2500e19f50b056
Instruction ID: fc120f7ed3300d8301d0f99cb769197b575d5683181bd6b289e4b53452841bc5
Opcode Fuzzy Hash: 8c595cf50166d2d57a1b46d7a61a8743a20f226779b5cb212a2500e19f50b056
Instruction Fuzzy Hash: 6501F4715042548BDB449F2EC4C576EBBEAEF65318F048469DD419B326D374D882CBA1

Function 60955665 Relevance: 3.0, Strings: 2, Instructions: 473COMMON

Download Yara Rule

Strings

d, xrefs: 609556D4
q, xrefs: 60955D74

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: d$q
API String ID: 0-1718950626
Opcode ID: a87c3b3051a627b28906aa56c9c3fc12d1b02b2116980aed29eb1fd9a104735f
Instruction ID: 6eb004900b9626c721c127e2c358ac87aa2acdfa793b1731418fee987daff942
Opcode Fuzzy Hash: a87c3b3051a627b28906aa56c9c3fc12d1b02b2116980aed29eb1fd9a104735f
Instruction Fuzzy Hash: 801259B0B083188BD715DF59C49075EBBF2ABA8708F10845DE5999B385CB79DD82CF81

Function 60950312 Relevance: 2.9, Strings: 2, Instructions: 437COMMON

Download Yara Rule

Strings

FOREIGN KEY constraint failed, xrefs: 60950700
oid, xrefs: 60950417

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: FOREIGN KEY constraint failed$oid
API String ID: 0-104532129
Opcode ID: 00f7df2595d5d9e527f1af03618ebb3b5725cea106bf2b54e4eb943f25e63a93
Instruction ID: a286a5271ceb1dc8ece7322571b1ccaabdd5b923e0bdc8f61c2101cd63f36b67
Opcode Fuzzy Hash: 00f7df2595d5d9e527f1af03618ebb3b5725cea106bf2b54e4eb943f25e63a93
Instruction Fuzzy Hash: 3012E774A042188FDB04DFA9C49079EBBF2BFA8308F10852DE459AB355DB79D84ACF41

Function 60954FF8 Relevance: 2.9, Strings: 2, Instructions: 375COMMON

Download Yara Rule

Strings

4, xrefs: 60955216
rowid, xrefs: 6095504B

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: 4$rowid
API String ID: 0-309610143
Opcode ID: 7641726edffa10a659a4e00588d1e05e8c8d2cd4ecdb6f035b0ff3a17781a0b9
Instruction ID: 3f3c31505cd5d00b58fd93351278a11d048c0df203962ecfcd4daa28c40a43c4
Opcode Fuzzy Hash: 7641726edffa10a659a4e00588d1e05e8c8d2cd4ecdb6f035b0ff3a17781a0b9
Instruction Fuzzy Hash: 77F1C174A083188BDB14DF69C89179EB7F2BB68308F10856DE899AB341DB74ED85CF41

Function 609255D4 Relevance: 1.6, APIs: 1, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406

sqlite3_mutex_leave.SQLITE3 ref: 609255B2

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 61f2b65abbb078f396bfa931b2809e4962fa985140118a0fa907d432528e7d54
Instruction ID: 19c4c58ecb434a21204d9b38047e93a23a7f28015e8477a734fda6841bb58fe8
Opcode Fuzzy Hash: 61f2b65abbb078f396bfa931b2809e4962fa985140118a0fa907d432528e7d54
Instruction Fuzzy Hash: 56317AB4A082188FCB04DF69D880A8EBBF6FF99314F008559FC5897348D734D940CBA5

Function 6092570B Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406

sqlite3_mutex_leave.SQLITE3 ref: 60925769

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: f78b12b45e858c7fd8cb74f5d211d4e30abbc68d4504511404b73e1b177a8d68
Instruction ID: d5dd20366bd30be5098f9e48471fbeb1ccf01997be5a2761bb4486817e6b3aba
Opcode Fuzzy Hash: f78b12b45e858c7fd8cb74f5d211d4e30abbc68d4504511404b73e1b177a8d68
Instruction Fuzzy Hash: 23F08171A10A28D7CB106F29EC8958EBBB9FF69254B055058ECC1A730CDB35D925C791

Function 609254B1 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406

sqlite3_mutex_leave.SQLITE3 ref: 60925508

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 7f15987c0945e0fd4273a36fcce91cc0d916abb620506d2e7fdad6d0c82ef640
Instruction ID: ad89f0bb34aa7175efe61e1ac22fb0c12735e6005c3b9edbf096fd229bca234b
Opcode Fuzzy Hash: 7f15987c0945e0fd4273a36fcce91cc0d916abb620506d2e7fdad6d0c82ef640
Instruction Fuzzy Hash: 5A01A475B107148BCB109F2ACC8164BBBFAEF68254F05991AEC41DB315D775ED458BC0

Function 60925686 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406

sqlite3_mutex_leave.SQLITE3 ref: 609256D3

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: ebbe32869a67294cb2d54c108597a832b3743d43329dcf341f64f2493053d601
Instruction ID: 4fd0dfe8dd6226820e052206e0db6187a6d8a97f2116fb4a305c2fd2856f8961
Opcode Fuzzy Hash: ebbe32869a67294cb2d54c108597a832b3743d43329dcf341f64f2493053d601
Instruction Fuzzy Hash: 94F08CB5A002099BCB00DF2AD88088ABBBAFF98264B05952AEC049B314D770E941CBD0

Function 60925655 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406

sqlite3_mutex_leave.SQLITE3 ref: 60925678

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 20ce1548f611e36a3668a48b9975394e1a388ab84833d9cb320a678b216caf11
Instruction ID: bc2fa39936d9f4ed0ba1ebf98b65e017ff83ed2bbf5e058a49948814e7f33c49
Opcode Fuzzy Hash: 20ce1548f611e36a3668a48b9975394e1a388ab84833d9cb320a678b216caf11
Instruction Fuzzy Hash: 59E0EC74A042089BCB04DF6AD4C194AB7F9EF58258B14D665EC458B309E231E9858BC1

Function 609256E5 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 60925704

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_mutex_leave
String ID:
API String ID: 3064317574-0
Opcode ID: 8bfbb127be37b3944cf6aee767a60d103abce584902525ba566a621f413e0d82
Instruction ID: 7a9bf9350bb0d435b7485bd9c083abc2dab3a9c90cc7cce47300d03dda88f0d0
Opcode Fuzzy Hash: 8bfbb127be37b3944cf6aee767a60d103abce584902525ba566a621f413e0d82
Instruction Fuzzy Hash: FFD092B4909309AFCB00EF29C48644EBBE5AF98258F40C82DFC98C7314E274E8408F92

Function 60950C6B Relevance: .6, Instructions: 595COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452e4f812ae83002cd801fe72fecc8da3374478239405c8bc441feb5ce37b530
Instruction ID: 412430d4e18b851e60dd1fbf372024ce972bb6baadb17a7452f5e52f94c990f8
Opcode Fuzzy Hash: 452e4f812ae83002cd801fe72fecc8da3374478239405c8bc441feb5ce37b530
Instruction Fuzzy Hash: CB52D270A043188FDB15CF69C480B9EBBF2AF99308F208569E859AB395D774DD86CF41

Function 60912E0B Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a7b4a87f505da04ffa54fb6e55f922526e69c02bf2bee3d2f8bc6b13896a50
Instruction ID: 99ea1b77078c0709a599f33f482de29416b13d6b9d26db2c6a8ee7fb45e299ab
Opcode Fuzzy Hash: 52a7b4a87f505da04ffa54fb6e55f922526e69c02bf2bee3d2f8bc6b13896a50
Instruction Fuzzy Hash: 0EE11B73B0D6858FC7098A7CC890169BBB3AFBA210B2E82EAD4655F3D6C174CD45D790

Function 60954CF6 Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0650abc8eefa839619154ae7fdd960ed138065e28e79e3f23827930d6b2e8a99
Instruction ID: 1cfcf76407a17513e555170fcd39be25d283782da3c2e9f17f7e58ab31a40c08
Opcode Fuzzy Hash: 0650abc8eefa839619154ae7fdd960ed138065e28e79e3f23827930d6b2e8a99
Instruction Fuzzy Hash: 4A8136B07083048BEB15DF69C45535EBBF2ABA5708F10C46DE4998B384CB79C895CF86

Function 60954470 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e499c5a4c3726fda9714884925a8318f32bca1dcd6fb293ea21283165bd9a7c6
Instruction ID: a2dd9cd188195757dd58031fb80d8640774723bdb620e3c0a9e6ca6eb92d801c
Opcode Fuzzy Hash: e499c5a4c3726fda9714884925a8318f32bca1dcd6fb293ea21283165bd9a7c6
Instruction Fuzzy Hash: 516129B07083048BEB05DF69C45175EBBE3ABA5708F11C45DE4898F384CB79C9A6CB82

Function 0040321D Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7843b180895422b3b0bcc0ba4a262943549954c7f4171b96b157888fc70d2e22
Instruction ID: dd62d92f1d8198b13c3d2fdafc71b47adaefd2b7ecaba933e3368fc72e5d7fe3
Opcode Fuzzy Hash: 7843b180895422b3b0bcc0ba4a262943549954c7f4171b96b157888fc70d2e22
Instruction Fuzzy Hash: BB51ADF380D3985BD3249FA5CC8129AF3E0BFD8250F4B872DED84E7601EB7456019681

Function 6096D6A4 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a59d87207625365d9d25d016f5c80020e1a98d1f6d0359848c7b4ce1eb42bdc0
Instruction ID: a761baf234fe108a62f10e4617a0ede2e20925be3d5e17916a044bbd01b4e757
Opcode Fuzzy Hash: a59d87207625365d9d25d016f5c80020e1a98d1f6d0359848c7b4ce1eb42bdc0
Instruction Fuzzy Hash: 1E419172F1152947EB04C95EC8502DEB7E7ABED260F369226D829F7344DA74DC028B91

Function 6096DAE8 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b53c3e538c3bb04aa5627c6fab7d76f38406483066ea63e533442fc0065a622
Instruction ID: 5ee81938f643c8f74c15c326a77d321ab5ccf77fb7a150182473360b0189da76
Opcode Fuzzy Hash: 5b53c3e538c3bb04aa5627c6fab7d76f38406483066ea63e533442fc0065a622
Instruction Fuzzy Hash: 2131D732F0511507AB04DDAE98D01DEF3E7ABDC264B2A817ED919D7348D9B1DC1AC650

Function 60909E9C Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27cd1a1db6350a5652be618cb352969fe2d1c11a8093f549374ed784605744c6
Instruction ID: 35caaeb7f32db3300690e414cd0506150ddcd435c17892dedab9d67e7a368409
Opcode Fuzzy Hash: 27cd1a1db6350a5652be618cb352969fe2d1c11a8093f549374ed784605744c6
Instruction Fuzzy Hash: 53110D73F1052A47CB18DDBF8C4129BF5E39BC8211B5AC23DA929E7395E5749E014AC0

Function 6090EAE5 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40395c641e49209b74336e0d8e4e44201a68b1d77ea56dec89a6cae5d47849df
Instruction ID: 19424a6827ebbc36b7a62e0588813998817030a1c249f32cc602ad3062ac7d27
Opcode Fuzzy Hash: 40395c641e49209b74336e0d8e4e44201a68b1d77ea56dec89a6cae5d47849df
Instruction Fuzzy Hash: BAF0AC201043859AE7059616D148B64BFABAB25308F19809DD9574B1E2E3B5E8C4CB96

Function 00560055 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794e4035ad947a19ea7fd98e1d0f4e34cbcc44065160e7783872e226e18c8c4c
Instruction ID: fd78d3f6c0298515188a3d6ca1797a260bf514c592047f5de307d095bfbda414
Opcode Fuzzy Hash: 794e4035ad947a19ea7fd98e1d0f4e34cbcc44065160e7783872e226e18c8c4c
Instruction Fuzzy Hash: 76E08C32911228EBCB14DBC8C908E8AF7ECFB88B10B5500A6B901D3140C6B0DE40C7D0

Function 6090577D Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc903d30242b0235a49ca3dc9f8df4f0198bb3c17ee07b08e44db8f45d9d2100
Instruction ID: 8dcd3a280e311d85a08cff7bb149483fc74061697cd2af1d422aa8a6e56622f3
Opcode Fuzzy Hash: fc903d30242b0235a49ca3dc9f8df4f0198bb3c17ee07b08e44db8f45d9d2100
Instruction Fuzzy Hash: 3DE0E2287142159BDB08EE6AC6C181B77ABBFD9654760846CE9078F202E776E9029640

Function 609255FF Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5aa561fe8b7943dde2a358ba30c2c8876ef78bddd50c77f68009583e67d90a
Instruction ID: 29002ccca7877ead4b7e7e784383ace88c03f26ddf616943a2b43c0eb71ea2e3
Opcode Fuzzy Hash: 5c5aa561fe8b7943dde2a358ba30c2c8876ef78bddd50c77f68009583e67d90a
Instruction Fuzzy Hash: 36E0E2B850430DABDF00CF09D8C188A7BAAFB08364F10C119FC190B305C371E9548BA1

Function 6092562A Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82c79c3d673ce5d83164ffe7b594e49b00bd73c00824d0aa5044480003c1f0d
Instruction ID: a276b763828cd9d21177d39229c24ef0f5c00ef14d0f26540801fec71d9d5410
Opcode Fuzzy Hash: c82c79c3d673ce5d83164ffe7b594e49b00bd73c00824d0aa5044480003c1f0d
Instruction Fuzzy Hash: 29E0E2B850430DABDF00CF09D8C198A7BAAFB08264F10C119FC190B304C331E9148BE1

Function 6090F435 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c407e99ff1326d716251d27052f3514f6d3ace0f30ccd24b81610f61b1d9b8
Instruction ID: aa639d4c52eda77921d109c173628d401b16d57fa3137d2b917a91732d8775c8
Opcode Fuzzy Hash: d3c407e99ff1326d716251d27052f3514f6d3ace0f30ccd24b81610f61b1d9b8
Instruction Fuzzy Hash: D7C01265704208574B00E92DE8C154577AA9718164B108039E80B87301D975ED084291

Function 6090576B Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a733227118cb881a49c8c313e73996236a25ff6ef409992dae375156ab2579
Instruction ID: b9da89681c28018b616aefc3abdd9d2409dd53a1bfe33812f7039069606fa4db
Opcode Fuzzy Hash: 83a733227118cb881a49c8c313e73996236a25ff6ef409992dae375156ab2579
Instruction Fuzzy Hash: 6DB09214310A0F829B008B29A4819277BEEAB989897558064990A8A115FA71F88286C0

Function 004011E0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48bb5fd150bdaffd22e10e4a063d4335be66f6bf54fdc1186d90b7f8ae246483
Instruction ID: e65e3dd5bf12b315687b82d488b0a593f89c2ae043fe975c0e0a68b24c3ec6c5
Opcode Fuzzy Hash: 48bb5fd150bdaffd22e10e4a063d4335be66f6bf54fdc1186d90b7f8ae246483
Instruction Fuzzy Hash: 06B012355001005F970ACE24DD110A232B277A6300769C4B9D003C9074DA3E9005D604

Function 60961865 Relevance: 58.1, APIs: 31, Strings: 2, Instructions: 352COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3 ref: 6096187D
sqlite3_mprintf.SQLITE3 ref: 6096189A
sqlite3_strnicmp.SQLITE3 ref: 609618E1
sqlite3_mprintf.SQLITE3 ref: 60961903
sqlite3_free.SQLITE3 ref: 6096192C

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 60961A30
sqlite3_free.SQLITE3(?), ref: 60961A9D
sqlite3_free.SQLITE3(?), ref: 60961AAB
sqlite3_free.SQLITE3(?), ref: 60961AC1
sqlite3_mprintf.SQLITE3(?), ref: 60961AE8
sqlite3_prepare.SQLITE3 ref: 60961B21
sqlite3_free.SQLITE3(?), ref: 60961B2F
sqlite3_malloc.SQLITE3(?), ref: 60961B91
sqlite3_finalize.SQLITE3(?), ref: 60961BFC

Strings

fts3, xrefs: 609618D6
simple, xrefs: 60961CBD

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mprintf$sqlite3_strnicmp$sqlite3_finalizesqlite3_mallocsqlite3_mutex_entersqlite3_prepare
String ID: fts3$simple
API String ID: 4021629296-2774786773
Opcode ID: e98fd3c98470f581118ac735cd3e394c7cfcf46046b635093844574dcb43d6d9
Instruction ID: cebf61b9b3ee91a8f287d72ab97851b5677d6ef717c020799f249302b5bf32c9
Opcode Fuzzy Hash: e98fd3c98470f581118ac735cd3e394c7cfcf46046b635093844574dcb43d6d9
Instruction Fuzzy Hash: E2F126709183298FEB209F64C88079DBBF6BF66308F19849DD899A7240DB74DD85DF42

Function 6096C598 Relevance: 51.2, APIs: 22, Strings: 7, Instructions: 417
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_initialize.SQLITE3 ref: 6096C5BE

Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1

sqlite3_log.SQLITE3 ref: 6096C5FC
sqlite3_free.SQLITE3 ref: 6096C67E
sqlite3_free.SQLITE3 ref: 6096CD71
sqlite3_mutex_leave.SQLITE3 ref: 6096CD80
sqlite3_errcode.SQLITE3 ref: 6096CD88
sqlite3_close.SQLITE3 ref: 6096CD97
sqlite3_create_function.SQLITE3 ref: 6096CDF8

Strings

BINARY, xrefs: 6096C752, 6096C77A, 6096C7A2, 6096C7E7
RTRIM, xrefs: 6096C7CA
NOCASE, xrefs: 6096C817
simple, xrefs: 6096CAAC
porter, xrefs: 6096CACA
rtree, xrefs: 6096CCF8
rtree_i32, xrefs: 6096CD1E

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_closesqlite3_create_functionsqlite3_errcodesqlite3_initializesqlite3_logsqlite3_mutex_entersqlite3_mutex_leave
String ID: BINARY$NOCASE$RTRIM$porter$rtree$rtree_i32$simple
API String ID: 1320758876-2501389569
Opcode ID: 6bfcb0ec024900a9d9b4e92c8a495cd7f0e11888819caa106d9e2d842adf35f2
Instruction ID: 66f98c4e8467cc0752991b2fada45a5d6d89a43a55ba94f1559c09c68fc79e30
Opcode Fuzzy Hash: 6bfcb0ec024900a9d9b4e92c8a495cd7f0e11888819caa106d9e2d842adf35f2
Instruction Fuzzy Hash: 7A024BB05183019BEB119F64C49536ABFF6BFA1348F11882DE8959F386D7B9C845CF82

Function 6096CAE3 Relevance: 40.4, APIs: 15, Strings: 8, Instructions: 163
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_overload_function.SQLITE3 ref: 6096CB3C

Part of subcall function 60924B9B: sqlite3_mutex_enter.SQLITE3 ref: 60924BBD
Part of subcall function 60924B9B: sqlite3_mutex_leave.SQLITE3 ref: 60924C35

sqlite3_overload_function.SQLITE3 ref: 6096CB5E
sqlite3_overload_function.SQLITE3 ref: 6096CB80
sqlite3_overload_function.SQLITE3 ref: 6096CBA2
sqlite3_create_module.SQLITE3 ref: 6096CC2A
sqlite3_overload_function.SQLITE3 ref: 6096CBC4

Part of subcall function 60924E73: sqlite3_mutex_enter.SQLITE3 ref: 60924E89
Part of subcall function 60924E73: sqlite3_log.SQLITE3 ref: 60924ECE
Part of subcall function 60924E73: sqlite3_mutex_leave.SQLITE3 ref: 60924F57

sqlite3_free.SQLITE3 ref: 6096CC3D
sqlite3_create_function.SQLITE3 ref: 6096CB1A

Part of subcall function 60924D8C: sqlite3_create_function_v2.SQLITE3 ref: 60924DD1

sqlite3_create_function.SQLITE3 ref: 6096CC8F
sqlite3_create_function.SQLITE3 ref: 6096CCD9
sqlite3_wal_autocheckpoint.SQLITE3 ref: 6096CD66
sqlite3_free.SQLITE3 ref: 6096CD71
sqlite3_mutex_leave.SQLITE3 ref: 6096CD80
sqlite3_errcode.SQLITE3 ref: 6096CD88
sqlite3_close.SQLITE3 ref: 6096CD97
sqlite3_create_function.SQLITE3 ref: 6096CDF8

Strings

optimize, xrefs: 6096CBB9
offsets, xrefs: 6096CB53
matchinfo, xrefs: 6096CB75, 6096CB97
fts3, xrefs: 6096CBDF
fts4, xrefs: 6096CC01
snippet, xrefs: 6096CB31
rtree, xrefs: 6096CCF8
rtree_i32, xrefs: 6096CD1E

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_overload_function$sqlite3_create_function$sqlite3_mutex_leave$sqlite3_freesqlite3_mutex_enter$sqlite3_closesqlite3_create_function_v2sqlite3_create_modulesqlite3_errcodesqlite3_logsqlite3_wal_autocheckpoint
String ID: fts3$fts4$matchinfo$offsets$optimize$rtree$rtree_i32$snippet
API String ID: 367481294-2251443531
Opcode ID: 889cd63a18eb1de569d4def527e446fff860d9365202db8337deb3d58a52cfa8
Instruction ID: 575fec8f9053750b29944c660029f81c3341d1e5b95d21102b2eaf444f940887
Opcode Fuzzy Hash: 889cd63a18eb1de569d4def527e446fff860d9365202db8337deb3d58a52cfa8
Instruction Fuzzy Hash: 2B61C7B151C7029BE7119F24D49532ABAE6AFA0758F11CC2CF4D98B345DBB9C8468F82

Function 6096B8FF Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_free.SQLITE3 ref: 6096B97B
sqlite3_snprintf.SQLITE3 ref: 6096B9AC

Part of subcall function 60917354: sqlite3_vsnprintf.SQLITE3 ref: 60917375

sqlite3_free.SQLITE3 ref: 6096B9EF
sqlite3_free.SQLITE3 ref: 6096B9F7
sqlite3_free.SQLITE3 ref: 6096BB2F

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 6096BB4D
sqlite3_snprintf.SQLITE3 ref: 6096BB8C
sqlite3_randomness.SQLITE3 ref: 6096BBA8

Strings

winGetTempname5, xrefs: 6096BB61
etilqs_, xrefs: 6096B90D, 6096BB72
winGetTempname1, xrefs: 6096B98F
winGetTempname2, xrefs: 6096BA11
winGetTempname3, xrefs: 6096BAAD
winGetTempname4, xrefs: 6096BB43

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_snprintf$sqlite3_mutex_entersqlite3_randomnesssqlite3_vsnprintf
String ID: etilqs_$winGetTempname1$winGetTempname2$winGetTempname3$winGetTempname4$winGetTempname5
API String ID: 4138564650-3409217566
Opcode ID: d5c86827daa2af85ef8c0105f170410dfd040fbf42e321896459ed7510188ef4
Instruction ID: 4695190612d0baa7224baff06fb57533ac243ac8fcb723a729aef1344b38de53
Opcode Fuzzy Hash: d5c86827daa2af85ef8c0105f170410dfd040fbf42e321896459ed7510188ef4
Instruction Fuzzy Hash: 23814F70A187048BE7109FB9C4813AEBBF7AFB5308F40C86DE4959B245E778C881DB52

Function 6092642A Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 184
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sqlite3_free.SQLITE3 ref: 609264C9
sqlite3_free.SQLITE3 ref: 60926526
sqlite3_free.SQLITE3 ref: 6092652E
sqlite3_free.SQLITE3 ref: 60926550

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

Part of subcall function 6090AFF5: sqlite3_free.SQLITE3 ref: 6090B09A

sqlite3_free.SQLITE3 ref: 60926626
sqlite3_win32_mbcs_to_utf8.SQLITE3 ref: 6092662E
sqlite3_free.SQLITE3 ref: 60926638
sqlite3_snprintf.SQLITE3 ref: 6092666B
sqlite3_free.SQLITE3 ref: 60926673
sqlite3_snprintf.SQLITE3 ref: 609266B8

Strings

winFullPathname2, xrefs: 60926543
winFullPathname3, xrefs: 609265A1
winFullPathname1, xrefs: 609264DE
\, xrefs: 6092668B
winFullPathname4, xrefs: 6092660B

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_snprintf$sqlite3_mutex_entersqlite3_win32_mbcs_to_utf8
String ID: \$winFullPathname1$winFullPathname2$winFullPathname3$winFullPathname4
API String ID: 937752868-2111127023
Opcode ID: 76700054f020c8d7fe753577c30eef17e659d67ca67044e42639e839992701d7
Instruction ID: 28f04709130b2e8b140c84fcd32bad5e17fba194e1ccee1aab8ced89c5ccf9cf
Opcode Fuzzy Hash: 76700054f020c8d7fe753577c30eef17e659d67ca67044e42639e839992701d7
Instruction Fuzzy Hash: EA712E706183058FE700AF69D88465DBFF6AFA5748F00C82DE8999B314E778C845DF92

Function 6092A6C1 Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 352COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 6092A712
sqlite3_malloc.SQLITE3 ref: 6092A738
memcmp.MSVCRT ref: 6092A7A9
sqlite3_mprintf.SQLITE3 ref: 6092A7C7
memcmp.MSVCRT ref: 6092A96E
memcmp.MSVCRT ref: 6092A998
memcmp.MSVCRT ref: 6092A9C6
memcmp.MSVCRT ref: 6092AA18
sqlite3_mprintf.SQLITE3 ref: 6092AA48
sqlite3_mprintf.SQLITE3 ref: 6092AA73
sqlite3_malloc.SQLITE3 ref: 6092AAB4
sqlite3_vfs_find.SQLITE3 ref: 6092AAE5
sqlite3_mprintf.SQLITE3 ref: 6092AB02
sqlite3_free.SQLITE3 ref: 6092AB17

Strings

cache, xrefs: 6092A991, 6092AB3D
access, xrefs: 6092A9E6
@, xrefs: 6092A6E0

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: memcmp$sqlite3_mprintf$sqlite3_malloc$sqlite3_freesqlite3_vfs_find
String ID: @$access$cache
API String ID: 4158134138-1361544076
Opcode ID: 19065094f7a61ae5fa0f118773a69bd69932ab9bc71fb499c0e2e31449818374
Instruction ID: 35071b2ec389daa84eb338d99e29a1052eb2425681bc363379ff67fe3f9a0dd7
Opcode Fuzzy Hash: 19065094f7a61ae5fa0f118773a69bd69932ab9bc71fb499c0e2e31449818374
Instruction Fuzzy Hash: 27D19E75D183458BDB11CF69E58039EBBF7AFAA304F20846ED4949B349D339D882CB52

Function 6096BF68 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 309COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 6096BFBD

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_snprintf.SQLITE3 ref: 6096BFE6
sqlite3_mutex_enter.SQLITE3 ref: 6096C187
sqlite3_mutex_leave.SQLITE3 ref: 6096C396
sqlite3_mutex_alloc.SQLITE3 ref: 6096C3BC

Strings

winOpenShm, xrefs: 6096C0B6
winShmMap1, xrefs: 6096C1CF
winShmMap2, xrefs: 6096C23A
winShmMap3, xrefs: 6096C30C

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_enter$sqlite3_freesqlite3_mutex_allocsqlite3_mutex_leavesqlite3_snprintf
String ID: winOpenShm$winShmMap1$winShmMap2$winShmMap3
API String ID: 3461448743-1629717226
Opcode ID: 39c64fcddea28b0aa031e37879247f80070ab2ba549b1bdf0d19ec5b858bae1f
Instruction ID: 203fbf89df4ef33620c4f1409a4d4e36eac378587df7250c1d15e225276e355b
Opcode Fuzzy Hash: 39c64fcddea28b0aa031e37879247f80070ab2ba549b1bdf0d19ec5b858bae1f
Instruction Fuzzy Hash: B5D128B0A19305DFEB04DF68C48466ABBF6FFA9304F018969F8859B355E734D881CB81

Function 60929FE9 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 60929FFE
sqlite3_mprintf.SQLITE3 ref: 6092A03E
sqlite3_strnicmp.SQLITE3 ref: 6092A1CD
sqlite3_malloc.SQLITE3 ref: 6092A272
sqlite3_snprintf.SQLITE3 ref: 6092A2A3
sqlite3_free.SQLITE3 ref: 6092A2D6
sqlite3_free.SQLITE3 ref: 6092A0A8

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 6092A2E3
sqlite3_mprintf.SQLITE3 ref: 6092A085

Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA

sqlite3_malloc.SQLITE3 ref: 6092A0E0
sqlite3_snprintf.SQLITE3 ref: 6092A10E
sqlite3_malloc.SQLITE3 ref: 6092A16D
sqlite3_mprintf.SQLITE3 ref: 6092A315
sqlite3_free.SQLITE3 ref: 6092A322
sqlite3_mutex_leave.SQLITE3 ref: 6092A3B4

Strings

te3_, xrefs: 6092A193

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mallocsqlite3_mprintf$sqlite3_mutex_entersqlite3_snprintf$sqlite3_initializesqlite3_mutex_leavesqlite3_strnicmpsqlite3_vmprintf
String ID: te3_
API String ID: 1158832363-2226833481
Opcode ID: 1f19671ca5012a46ca16e9cb138c2cc5bc97e87583330c53ab7feab0a065a7ac
Instruction ID: d188e71a9f3425691720acae73a0a923a88cc8f70bb1a7e44ab3661232cabeef
Opcode Fuzzy Hash: 1f19671ca5012a46ca16e9cb138c2cc5bc97e87583330c53ab7feab0a065a7ac
Instruction Fuzzy Hash: 14D1EFB5A19709DFDB04DF68E58069EBBF2BFA8304F10842DE8999B305D734E842CB41

Function 6094844A Relevance: 24.9, APIs: 3, Strings: 11, Instructions: 374COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

PRAGMA vacuum_db.synchronous=OFF, xrefs: 609485BB
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0, xrefs: 60948728
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %', xrefs: 60948708
ATTACH '' AS vacuum_db;, xrefs: 60948529
BEGIN;, xrefs: 609485DB
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';, xrefs: 60948768
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %' , xrefs: 609486E8
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0), xrefs: 60948788
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0, xrefs: 609486C8
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' , xrefs: 60948748
ATTACH ':memory:' AS vacuum_db;, xrefs: 60948534

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_log
String ID: ATTACH '' AS vacuum_db;$ATTACH ':memory:' AS vacuum_db;$BEGIN;$INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)$PRAGMA vacuum_db.synchronous=OFF$SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %' $SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0$SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'$SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' $SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';$SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
API String ID: 632333372-52344843
Opcode ID: d52540ff3cd5a889f8fcb2175177c5c293f6bf3e96b3409faf11301466b535e5
Instruction ID: 17dae18cb22bd420f764556e48f7e631e7f528851c991f2db59136dec61311d4
Opcode Fuzzy Hash: d52540ff3cd5a889f8fcb2175177c5c293f6bf3e96b3409faf11301466b535e5
Instruction Fuzzy Hash: 1202F6B0A046299BDB2ACF18C88179EB7FABF65304F1081D9E858AB355D771DE81CF41

Function 005633A3 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 005633E7

Part of subcall function 0056254A: _free.LIBCMT ref: 00562567
Part of subcall function 0056254A: _free.LIBCMT ref: 00562579
Part of subcall function 0056254A: _free.LIBCMT ref: 0056258B
Part of subcall function 0056254A: _free.LIBCMT ref: 0056259D
Part of subcall function 0056254A: _free.LIBCMT ref: 005625AF
Part of subcall function 0056254A: _free.LIBCMT ref: 005625C1
Part of subcall function 0056254A: _free.LIBCMT ref: 005625D3
Part of subcall function 0056254A: _free.LIBCMT ref: 005625E5
Part of subcall function 0056254A: _free.LIBCMT ref: 005625F7
Part of subcall function 0056254A: _free.LIBCMT ref: 00562609
Part of subcall function 0056254A: _free.LIBCMT ref: 0056261B
Part of subcall function 0056254A: _free.LIBCMT ref: 0056262D
Part of subcall function 0056254A: _free.LIBCMT ref: 0056263F

_free.LIBCMT ref: 005633DC

Part of subcall function 0055E0A1: RtlFreeHeap.NTDLL(00000000,00000000,?,00559E30), ref: 0055E0B7
Part of subcall function 0055E0A1: GetLastError.KERNEL32(?,?,00559E30), ref: 0055E0C9

_free.LIBCMT ref: 005633FE
_free.LIBCMT ref: 00563413
_free.LIBCMT ref: 0056341E
_free.LIBCMT ref: 00563440
_free.LIBCMT ref: 00563453
_free.LIBCMT ref: 00563461
_free.LIBCMT ref: 0056346C
_free.LIBCMT ref: 005634A4
_free.LIBCMT ref: 005634AB
_free.LIBCMT ref: 005634C8
_free.LIBCMT ref: 005634E0

Strings

^, xrefs: 005633B9

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: ^
API String ID: 161543041-4142473408
Opcode ID: ecd4763e84c6d9c69cb448465263fbaa8a95d529790cc37039f16705e2ef9675
Instruction ID: baa090f3c7eb8003e008749c6bb9079478f931a0973866000a613d5a37fc7b46
Opcode Fuzzy Hash: ecd4763e84c6d9c69cb448465263fbaa8a95d529790cc37039f16705e2ef9675
Instruction Fuzzy Hash: C3317C716007059FEF36AA39D84EB56BBE9BF80312F50442AF849D75A1DE71AE84C710

Function 609602C8 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 266COMMON

Download Yara Rule

APIs

Part of subcall function 609296D1: sqlite3_value_bytes.SQLITE3 ref: 609296F3
Part of subcall function 609296D1: sqlite3_mprintf.SQLITE3 ref: 60929708
Part of subcall function 609296D1: sqlite3_free.SQLITE3 ref: 6092971B

Part of subcall function 6095FFB2: sqlite3_bind_int64.SQLITE3 ref: 6095FFFA
Part of subcall function 6095FFB2: sqlite3_step.SQLITE3 ref: 60960009
Part of subcall function 6095FFB2: sqlite3_reset.SQLITE3 ref: 60960019
Part of subcall function 6095FFB2: sqlite3_result_error_code.SQLITE3 ref: 60960043

sqlite3_malloc.SQLITE3 ref: 60960384
sqlite3_free.SQLITE3 ref: 609605EA
sqlite3_result_error_code.SQLITE3 ref: 6096060D
sqlite3_free.SQLITE3 ref: 60960618
sqlite3_result_text.SQLITE3 ref: 6096063C

Strings

offsets, xrefs: 609602DF

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_result_error_code$sqlite3_bind_int64sqlite3_mallocsqlite3_mprintfsqlite3_resetsqlite3_result_textsqlite3_stepsqlite3_value_bytes
String ID: offsets
API String ID: 463808202-2642679573
Opcode ID: 496dcd0dbd0e24e84f3ae9a4f9495b5d667a7098f4014ef95464c797b1727b83
Instruction ID: 1101d6838161b799219a4b3d5732631e197d31251dd2d8b91c34f261bd2faa79
Opcode Fuzzy Hash: 496dcd0dbd0e24e84f3ae9a4f9495b5d667a7098f4014ef95464c797b1727b83
Instruction Fuzzy Hash: 72C1D374A183198FDB14CF59C580B8EBBF2BFA8314F2085A9E849AB354D734D985CF52

Function 6096BC05 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 6096BC75

Part of subcall function 6096B8FF: sqlite3_free.SQLITE3 ref: 6096B97B

sqlite3_free.SQLITE3 ref: 6096BE1D
sqlite3_free.SQLITE3 ref: 6096BE28
sqlite3_log.SQLITE3 ref: 6096BE87

Part of subcall function 60911D8D: sqlite3_win32_sleep.SQLITE3 ref: 60911DC5

sqlite3_free.SQLITE3 ref: 6096BEAD
sqlite3_free.SQLITE3 ref: 6096BEB8
sqlite3_uri_boolean.SQLITE3 ref: 6096BEEF
sqlite3_free.SQLITE3(?), ref: 6096BF51
sqlite3_free.SQLITE3(?), ref: 6096BF5C

Strings

winOpen, xrefs: 6096BE0B

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_logsqlite3_uri_booleansqlite3_win32_sleep
String ID: winOpen
API String ID: 4181154385-2556188131
Opcode ID: d56f987dd6ce57c172b32bfd77da225bc3a416693088262773fe964e71aacad6
Instruction ID: 1871b765817c94bf9c951fae99441c80e4ef295ecfe201fce199e216666f0e02
Opcode Fuzzy Hash: d56f987dd6ce57c172b32bfd77da225bc3a416693088262773fe964e71aacad6
Instruction Fuzzy Hash: EEA138B09143098BEB00DF68C59479EBBF6FF65318F10851DE8949B294E779C985CF82

Function 6091AE0B Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

sqlite3_snprintf.SQLITE3 ref: 6091AE79
sqlite3_snprintf.SQLITE3 ref: 6091AEBF
sqlite3_result_value.SQLITE3 ref: 6091AEE7
sqlite3_value_blob.SQLITE3 ref: 6091AEF4
sqlite3_value_bytes.SQLITE3 ref: 6091AF00
sqlite3_result_text.SQLITE3 ref: 6091AF7F
sqlite3_free.SQLITE3 ref: 6091AF8A
sqlite3_result_text.SQLITE3 ref: 6091B04A

Strings

NULL, xrefs: 6091B03F

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_result_textsqlite3_snprintf$sqlite3_freesqlite3_result_valuesqlite3_value_blobsqlite3_value_bytes
String ID: NULL
API String ID: 3102899305-324932091
Opcode ID: 83ac041a0e68b97dee30516a51bbd0a891366b2dfda61051478900d21d89c9bf
Instruction ID: dd0be92f63d5743d69c6692f62ca29b922372c689904e6017245f7cdb56ae0db
Opcode Fuzzy Hash: 83ac041a0e68b97dee30516a51bbd0a891366b2dfda61051478900d21d89c9bf
Instruction Fuzzy Hash: E561AFB0A0C3498AD7129F28C88476EBFF7AB65314F14C99CE4E54B386D739C889CB41

Function 6094CBB8 Relevance: 16.7, APIs: 11, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 60925208: sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6094A57F), ref: 6092522A

sqlite3_log.SQLITE3 ref: 6094CBF8
sqlite3_mutex_enter.SQLITE3 ref: 6094CC18
sqlite3_errcode.SQLITE3 ref: 6094CE4C
sqlite3_errmsg.SQLITE3 ref: 6094CE5F
sqlite3_errmsg.SQLITE3 ref: 6094CE81
sqlite3_mutex_leave.SQLITE3 ref: 6094CECC

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_errmsgsqlite3_log$sqlite3_errcodesqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 72737711-0
Opcode ID: 60137a77ce0da90ed30f7555daaf3c6726869cff5cf2490db101f8694374fa92
Instruction ID: 85db5f63d422662da2aeb93eb2abfcb5e1e3c7726958bd31af284bbdf427f4de
Opcode Fuzzy Hash: 60137a77ce0da90ed30f7555daaf3c6726869cff5cf2490db101f8694374fa92
Instruction Fuzzy Hash: EC9106B0D08319CFDB41DF69C48078EBBF6BF65358F108829E894AB250D778D889CB91

Function 60969F6F Relevance: 16.7, APIs: 11, Instructions: 195COMMON

Download Yara Rule

APIs

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_step.SQLITE3 ref: 60969FAF
sqlite3_column_text.SQLITE3 ref: 6096A05F

Part of subcall function 6091D54F: sqlite3_value_text.SQLITE3 ref: 6091D567

sqlite3_column_bytes.SQLITE3 ref: 6096A09D

Part of subcall function 6091D5DC: sqlite3_value_bytes.SQLITE3 ref: 6091D5F4

sqlite3_reset.SQLITE3 ref: 6096A0CB
sqlite3_column_int.SQLITE3 ref: 60969FD3

Part of subcall function 6091D4F4: sqlite3_value_int.SQLITE3 ref: 6091D50C

sqlite3_column_int64.SQLITE3 ref: 60969FE8
sqlite3_reset.SQLITE3 ref: 6096A0E1
sqlite3_reset.SQLITE3 ref: 6096A0ED
sqlite3_step.SQLITE3 ref: 6096A134
sqlite3_column_int.SQLITE3 ref: 6096A14E
sqlite3_reset.SQLITE3 ref: 6096A15B

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_reset$sqlite3_column_intsqlite3_step$sqlite3_column_bytessqlite3_column_int64sqlite3_column_textsqlite3_freesqlite3_mprintfsqlite3_prepare_v2sqlite3_value_bytessqlite3_value_intsqlite3_value_text
String ID:
API String ID: 1488107833-0
Opcode ID: 4e1e56c576e79b87256dd73d99566eda44e01e7fed606fefc30cc25f7ff9bf6f
Instruction ID: 3c74c7164f455ea0dc2a87a9e0b319004076a33a0c810c2d0a33c58363518d60
Opcode Fuzzy Hash: 4e1e56c576e79b87256dd73d99566eda44e01e7fed606fefc30cc25f7ff9bf6f
Instruction Fuzzy Hash: 3F812370A182198FDB05DF69C480B9EB7F6EFA9304F118469E888AB345EB35DC85CF50

Function 6091A3AA Relevance: 16.7, APIs: 11, Instructions: 175COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6091A3C1
sqlite3_value_bytes.SQLITE3 ref: 6091A3D6
sqlite3_value_text.SQLITE3 ref: 6091A3E4
sqlite3_value_bytes.SQLITE3 ref: 6091A416
sqlite3_value_text.SQLITE3 ref: 6091A424
sqlite3_value_bytes.SQLITE3 ref: 6091A43A
sqlite3_result_text.SQLITE3 ref: 6091A5A2

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_result_text
String ID:
API String ID: 2903785150-0
Opcode ID: 408a6008a3f19a662094ad197d730d6af4ceeedc2d56196c0f88669f9a2ea12f
Instruction ID: 050d84d3da0bd462ad4a4a15df4a38950001fc66f1de33c81d7c2c3a6f7146e7
Opcode Fuzzy Hash: 408a6008a3f19a662094ad197d730d6af4ceeedc2d56196c0f88669f9a2ea12f
Instruction Fuzzy Hash: 8971D074E086599FCF00DFA8C88069DBBF2BF59314F1485AAE855AB304E734EC85CB91

Function 00547410 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 168COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00547447
___except_validate_context_record.LIBVCRUNTIME ref: 0054744F
_ValidateLocalCookies.LIBCMT ref: 005474D8
__IsNonwritableInCurrentImage.LIBCMT ref: 00547503
_ValidateLocalCookies.LIBCMT ref: 00547558

Strings

nuT, xrefs: 005474F5, 005474FE, 0054750F
csm, xrefs: 005474ED
PB, xrefs: 0054751C, 005475F7
csm, xrefs: 00547581

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: PB$csm$csm$nuT
API String ID: 1170836740-1473954010
Opcode ID: bc66051301f3d45b1e58c69ebf19ad264fe4550762e8d649841a08add888e374
Instruction ID: 2202adc666d81e918d1e2d77da6d3b48e433ccde8622867fb6398ae4c9aff415
Opcode Fuzzy Hash: bc66051301f3d45b1e58c69ebf19ad264fe4550762e8d649841a08add888e374
Instruction Fuzzy Hash: A651A334A042499FCF24DF68D844AEE7FB5BF49328F148199E8155F2A2D771DE01CB91

Function 60929DC3 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 79COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 60929DE6
sqlite3_value_bytes.SQLITE3 ref: 60929DF5
sqlite3_value_bytes.SQLITE3 ref: 60929E0F
sqlite3_value_blob.SQLITE3 ref: 60929E2F
sqlite3_mprintf.SQLITE3 ref: 60929E76
sqlite3_free.SQLITE3 ref: 60929E89
sqlite3_result_blob.SQLITE3 ref: 60929EAA

Strings

argument type mismatch, xrefs: 60929E1F
out of memory, xrefs: 60929E4D

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_value_bytes$sqlite3_freesqlite3_mprintfsqlite3_result_blobsqlite3_value_blobsqlite3_value_text
String ID: argument type mismatch$out of memory
API String ID: 894939291-2444857804
Opcode ID: 4d5afa9001fc9eb1ee8a6817ef62039e5a2ec1b906c6f59d77063a9a1fe8bff8
Instruction ID: d61ee3b5cf6886c44fc01d21c94ecbd124a442ca5ac3c7aacfe31d258e755ac0
Opcode Fuzzy Hash: 4d5afa9001fc9eb1ee8a6817ef62039e5a2ec1b906c6f59d77063a9a1fe8bff8
Instruction Fuzzy Hash: 0A3107B0A18208DFC710EF68D481A6EBBF2FBA9214F11C969E4549B314D735D841CF82

Function 6092854D Relevance: 15.4, APIs: 10, Instructions: 432COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 6092861F
sqlite3_free.SQLITE3 ref: 6092878D

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_malloc
String ID:
API String ID: 423083942-0
Opcode ID: 039a1925b88827ab71129b12bf0a0cfd7bb9a75e2f5fb5313a60c0869b9e4a18
Instruction ID: dba10035f3c017a022ff92dc0406edc4c972eb6647695f7afdbed5011b3e14eb
Opcode Fuzzy Hash: 039a1925b88827ab71129b12bf0a0cfd7bb9a75e2f5fb5313a60c0869b9e4a18
Instruction Fuzzy Hash: 9112E3B4A15218CFCB18CF98D480A9EBBF6BF98304F24855AD855AB319D774EC42CF90

Function 60912453 Relevance: 15.2, APIs: 10, Instructions: 247COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091264D
sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912662
sqlite3_malloc.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091273E
sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912753
sqlite3_os_init.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912758
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912803
sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091280E
sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091282A
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091283F

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_freesqlite3_mallocsqlite3_mutex_freesqlite3_os_init
String ID:
API String ID: 3556715608-0
Opcode ID: 7a5b012c4fe40a1866ea25e0c9ef8651b072e840c3be51a8f23ca71a75eb633f
Instruction ID: 37d7613b282c24208f37f95ee69ae3eaf9c0527d79975c213f2f38643f7f707f
Opcode Fuzzy Hash: 7a5b012c4fe40a1866ea25e0c9ef8651b072e840c3be51a8f23ca71a75eb633f
Instruction Fuzzy Hash: FEA14A71A2C215CBEB009F69CC843257FE7B7A7318F10816DD415AB2A0E7B9DC95EB11

Function 6095F5D9 Relevance: 15.1, APIs: 10, Instructions: 121COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 6095F645
sqlite3_exec.SQLITE3 ref: 6095F686

Part of subcall function 6094CBB8: sqlite3_log.SQLITE3 ref: 6094CBF8

sqlite3_free_table.SQLITE3 ref: 6095F6A0
sqlite3_mprintf.SQLITE3 ref: 6095F6C7

Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA

sqlite3_free.SQLITE3 ref: 6095F6B4

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 6095F6D4
sqlite3_free.SQLITE3 ref: 6095F6ED
sqlite3_free_table.SQLITE3 ref: 6095F6FF
sqlite3_realloc.SQLITE3 ref: 6095F71B
sqlite3_free_table.SQLITE3 ref: 6095F72D

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_free_table$sqlite3_execsqlite3_initializesqlite3_logsqlite3_mallocsqlite3_mprintfsqlite3_mutex_entersqlite3_reallocsqlite3_vmprintf
String ID:
API String ID: 1866449048-0
Opcode ID: 2addae8d4502475aa330d0fbe12d9077f3fed0f055932ab6dac269a256a03500
Instruction ID: 9ac78cbffd0e0cf27e5d0fdbf17c3a3d034f00011a14f89e76d08e502163788c
Opcode Fuzzy Hash: 2addae8d4502475aa330d0fbe12d9077f3fed0f055932ab6dac269a256a03500
Instruction Fuzzy Hash: 8751F1B49467099FDB01DF69D59178EBBF6FF68318F104429E884AB300D379D894CB91

Function 6094078D Relevance: 15.0, APIs: 10, Instructions: 43COMMON

Download Yara Rule

APIs

sqlite3_finalize.SQLITE3 ref: 609407B4

Part of subcall function 6094064B: sqlite3_log.SQLITE3 ref: 60940672
Part of subcall function 6094064B: sqlite3_log.SQLITE3 ref: 60940696

sqlite3_finalize.SQLITE3 ref: 609407C2

Part of subcall function 6094064B: sqlite3_mutex_enter.SQLITE3 ref: 609406A7

sqlite3_finalize.SQLITE3 ref: 609407D0
sqlite3_finalize.SQLITE3 ref: 609407DE
sqlite3_finalize.SQLITE3 ref: 609407EC
sqlite3_finalize.SQLITE3 ref: 609407FA
sqlite3_finalize.SQLITE3 ref: 60940808
sqlite3_finalize.SQLITE3 ref: 60940816
sqlite3_finalize.SQLITE3 ref: 60940824
sqlite3_free.SQLITE3 ref: 6094082C

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_finalize$sqlite3_logsqlite3_mutex_enter$sqlite3_free
String ID:
API String ID: 14011187-0
Opcode ID: d36625bd4fa8924ea0abcbec615d2e266582c2e39b3be902bd1f9101c01d6c45
Instruction ID: 14c977e837db455c9c1ce3b69ce7d4e0fb0da6313972e550a4586d0eb1b189ee
Opcode Fuzzy Hash: d36625bd4fa8924ea0abcbec615d2e266582c2e39b3be902bd1f9101c01d6c45
Instruction Fuzzy Hash: F7116774504B008BCB50BF78C9C965877E9AFB5308F061978EC8A8F306EB34D4918B15

Function 60962DAF Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117COMMON

Download Yara Rule

APIs

sqlite3_step.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,00000004,?,?,60962F9B), ref: 60962DD5
sqlite3_finalize.SQLITE3 ref: 60962E44
sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,00000004,?,?,60962F9B), ref: 60962E8F
sqlite3_finalize.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,00000004,?,?,60962F9B), ref: 60962EBD
sqlite3_errmsg.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,00000004,?,?,60962F9B), ref: 60962EFB

Strings

null, xrefs: 60962E07
real, xrefs: 60962E1A
integer, xrefs: 60962E10

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_finalize$sqlite3_errmsgsqlite3_freesqlite3_step
String ID: integer$null$real
API String ID: 791348188-2769304496
Opcode ID: 8dd8ac7c02dc1a2e44d86f811f485161781e6e11f05d9fcd20a387f66adb3769
Instruction ID: 4bda7a4bce58bea9d3aac568db2213ca3bd4299bb27663cb41171ee5cf62a7d1
Opcode Fuzzy Hash: 8dd8ac7c02dc1a2e44d86f811f485161781e6e11f05d9fcd20a387f66adb3769
Instruction Fuzzy Hash: 715105B5A047148FDB14DF69C18168ABBF6EFA8314F1188A9E849EB314D735EC50CBA1

Function 6091C159 Relevance: 14.0, Strings: 11, Instructions: 290COMMON

Download Yara Rule

Strings

AND , xrefs: 6091C363
%s USING %sINDEX %s%s, xrefs: 6091C460
ANY(, xrefs: 6091C375
%s USING AUTOMATIC %sINDEX%.0s%s, xrefs: 6091C46E
COVERING , xrefs: 6091C45B
, xrefs: 6091C4F8
0, xrefs: 6091C4E4
)><, xrefs: 6091C392, 6091C434
rowid, xrefs: 6091C317, 6091C3C1, 6091C400
SEARCH, xrefs: 6091C1A7, 6091C1D1
SCAN, xrefs: 6091C1C7

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: $ AND $%s USING %sINDEX %s%s$%s USING AUTOMATIC %sINDEX%.0s%s$)><$0$ANY($COVERING $SCAN$SEARCH$rowid
API String ID: 0-780898
Opcode ID: d1d17e5dd7c74eae3224551f6f3ab351f201226dcaab78a09df61ec6b72ac00d
Instruction ID: 1b008e11d07f16b9462ef115b46fd1892196ed4c5360d6a6f9a636b6bab85f9b
Opcode Fuzzy Hash: d1d17e5dd7c74eae3224551f6f3ab351f201226dcaab78a09df61ec6b72ac00d
Instruction Fuzzy Hash: 46D109B0A087099FD714CF99C19079DBBF2BFA8308F10886AE495AB355D774D982CF81

Function 609061F1 Relevance: 13.9, Strings: 11, Instructions: 114COMMON

Download Yara Rule

Strings

laer, xrefs: 609062A7
bolb, xrefs: 6090623F
bolc, xrefs: 6090622F
aolf, xrefs: 6090626D
aolf, xrefs: 609062B0
rahc, xrefs: 60906227
tni, xrefs: 6090628D
txet, xrefs: 60906237
buod, xrefs: 609062B9
laer, xrefs: 60906261
buod, xrefs: 60906279

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: aolf$aolf$bolb$bolc$buod$buod$laer$laer$rahc$tni$txet
API String ID: 0-2604012851
Opcode ID: b472df4709d2161ac4da3e6dd873a69b8789eadb7617e1432b7f17fad04b9ea6
Instruction ID: a78f5df49eecf700eafad7d6eadd6707640e608d2d263d021760269e78388884
Opcode Fuzzy Hash: b472df4709d2161ac4da3e6dd873a69b8789eadb7617e1432b7f17fad04b9ea6
Instruction Fuzzy Hash: 2D31B171A891458ADB21891C85503EE7FBB9BE3344F28902EC8B2DB246C735CCD0C3A2

Function 60965CC5 Relevance: 13.7, APIs: 9, Instructions: 151COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 60965D5C
sqlite3_free.SQLITE3 ref: 60965D67
sqlite3_value_text.SQLITE3 ref: 60965D99
sqlite3_mprintf.SQLITE3 ref: 60965DAD
sqlite3_value_bytes.SQLITE3 ref: 60965DBA
sqlite3_value_text.SQLITE3 ref: 60965DDD
sqlite3_mprintf.SQLITE3 ref: 60965DED
sqlite3_value_bytes.SQLITE3 ref: 60965DFA
sqlite3_value_int.SQLITE3 ref: 60965E1D

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_value_bytessqlite3_value_text$sqlite3_value_int
String ID:
API String ID: 3633565668-0
Opcode ID: 39a2d715b94049957d11fbcefb34dcecdbc31a5cdef394177a2d8d1333388b5a
Instruction ID: 0c43e51f5b8b38b395d8e4ca0cc7dcc06dd1e2730a312d69ecf9d596bf7fc980
Opcode Fuzzy Hash: 39a2d715b94049957d11fbcefb34dcecdbc31a5cdef394177a2d8d1333388b5a
Instruction Fuzzy Hash: 1B5147B4A143048FDB04DF68C48469DBBF6FFA9324F108A69E8A4AB395E335D941CF51

Function 60939559 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 426COMMON

Download Yara Rule

APIs

Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8

memcmp.MSVCRT ref: 60939694
memcmp.MSVCRT ref: 609396CA
memcmp.MSVCRT ref: 6093973E
sqlite3_log.SQLITE3 ref: 60939807
memcmp.MSVCRT ref: 609399B9

Strings

SQLite format 3, xrefs: 609396BF
0, xrefs: 609399AA

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: memcmp$sqlite3_logsqlite3_mutex_try
String ID: 0$SQLite format 3
API String ID: 3174206576-3388949527
Opcode ID: e2a376b1a29b79c4f9f51ec04e7584e9c4e5062bfe0a82991cc629df80cc0a0f
Instruction ID: d3cc03899c2fb96d27ccc41cf7ad58ff30b38a29db2c3208110d6cb2c70dce50
Opcode Fuzzy Hash: e2a376b1a29b79c4f9f51ec04e7584e9c4e5062bfe0a82991cc629df80cc0a0f
Instruction Fuzzy Hash: A3028BB0A082659BDB09CF68D48178ABBF7FFA5308F148269E8459B345DB74DC85CF81

Function 6092698F Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 345COMMON

Download Yara Rule

APIs

Part of subcall function 609129FB: sqlite3_realloc.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,609269AD), ref: 60912A23

Part of subcall function 6090F0B6: memcmp.MSVCRT ref: 6090F117
Part of subcall function 6090F0B6: memcmp.MSVCRT ref: 6090F183

sqlite3_log.SQLITE3 ref: 60926BCA
sqlite3_malloc.SQLITE3 ref: 60926BE5

Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4

memcmp.MSVCRT ref: 60926CA9
sqlite3_free.SQLITE3 ref: 60926DCF
sqlite3_log.SQLITE3 ref: 60926E4D
sqlite3_log.SQLITE3 ref: 60926EBB

Strings

, xrefs: 60926AA8

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: memcmpsqlite3_log$sqlite3_freesqlite3_initializesqlite3_mallocsqlite3_realloc
String ID:
API String ID: 4185366609-3916222277
Opcode ID: 42961192432c8147f25bff629da204cb6720ad877da4877ff411524eff18939d
Instruction ID: e4391d18e33d520be8f5afdf4a81f2d65d06b163732449de625c138a60184bee
Opcode Fuzzy Hash: 42961192432c8147f25bff629da204cb6720ad877da4877ff411524eff18939d
Instruction Fuzzy Hash: 16E13674A043198BDB14DF69D88078DBBF6BFA8304F1185AAD859AB349EB34DC85CF41

Function 60959E6B Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 334COMMON

Download Yara Rule

APIs

Part of subcall function 609201E7: sqlite3_strnicmp.SQLITE3 ref: 60920220

sqlite3_strnicmp.SQLITE3 ref: 6095A168

Strings

trigger, xrefs: 6095A016
sqlite_master, xrefs: 6095A2A1
BEFORE, xrefs: 6095A1B9
AFTER, xrefs: 6095A1AB
#, xrefs: 6095A342
sqlite_temp_master, xrefs: 6095A2AF

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_strnicmp
String ID: #$AFTER$BEFORE$sqlite_master$sqlite_temp_master$trigger
API String ID: 1961171630-4092740143
Opcode ID: c7660a4e8c42efaf15515ba663746a8fabd4b20fb5ae1d0cd76e2254000f2285
Instruction ID: 7fb7fb870bfc8ccb8674613a317599df72f9f6290c37969d30796f1701c09282
Opcode Fuzzy Hash: c7660a4e8c42efaf15515ba663746a8fabd4b20fb5ae1d0cd76e2254000f2285
Instruction Fuzzy Hash: 04F1D274A04329CFEB21CF69C880B89BBB2BF69308F108599D858AB355D774DE85CF51

Function 6095F004 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6095F030
sqlite3_value_text.SQLITE3 ref: 6095F03E
sqlite3_stricmp.SQLITE3 ref: 6095F0B3
sqlite3_free.SQLITE3 ref: 6095F180

Part of subcall function 6092E279: strcmp.MSVCRT ref: 6092E2AE
Part of subcall function 6092E279: sqlite3_free.SQLITE3 ref: 6092E3A8

sqlite3_free.SQLITE3 ref: 6095F1BD

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_result_error_code.SQLITE3 ref: 6095F34E

Strings

|, xrefs: 6095F2F5

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_value_text$sqlite3_mutex_entersqlite3_result_error_codesqlite3_stricmpstrcmp
String ID: |
API String ID: 1576672187-2343686810
Opcode ID: 45796efa6547682f16092b9fa288c01422e20de86ab54653b6df12e990b05c38
Instruction ID: c4017fd8acd983bc841f22cdb0f4132ffe50c361176833da1127552c957ad2bb
Opcode Fuzzy Hash: 45796efa6547682f16092b9fa288c01422e20de86ab54653b6df12e990b05c38
Instruction Fuzzy Hash: B2B189B4A08308CBDB01CF69C491B9EBBF2BF68358F148968E854AB355D734EC55CB81

Function 60953679 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

sqlite3_file_control.SQLITE3 ref: 609537BD
sqlite3_free.SQLITE3 ref: 60953842
sqlite3_free.SQLITE3 ref: 6095387C

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_stricmp.SQLITE3 ref: 609538D4

Strings

6, xrefs: 6095388C
timeout, xrefs: 609561A2

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_file_controlsqlite3_mutex_entersqlite3_stricmp
String ID: 6$timeout
API String ID: 2671017102-3660802998
Opcode ID: 8cffcba2199636318c40f61931f0f453c1b4c4e8a0677f5b7de6569c291e0b77
Instruction ID: da3e9078838fdf1f068eeacc94130b5fe058058c2a53432068b0843c8cdd1fdd
Opcode Fuzzy Hash: 8cffcba2199636318c40f61931f0f453c1b4c4e8a0677f5b7de6569c291e0b77
Instruction Fuzzy Hash: 6CA11270A083198BDB15CF6AC88079EBBF6BFA9304F10846DE8589B354D774D885CF41

Function 6095D3BB Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_snprintf.SQLITE3 ref: 6095D450

Part of subcall function 60917354: sqlite3_vsnprintf.SQLITE3 ref: 60917375

sqlite3_snprintf.SQLITE3 ref: 6095D4A1
sqlite3_snprintf.SQLITE3 ref: 6095D525

Strings

, xrefs: 6095D410
)><, xrefs: 6095D3ED
sqlite_master, xrefs: 6095D57F
sqlite_temp_master, xrefs: 6095D58A

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_vsnprintf
String ID: $)><$sqlite_master$sqlite_temp_master
API String ID: 652164897-1572359634
Opcode ID: 7664a015b2dc01db37cf12657f922778db359f6c70a1ba93bfebbfbe3581116b
Instruction ID: a98725bc65f6cff0ffebef66634980575a39ba2d787d432de3c608a01e11e389
Opcode Fuzzy Hash: 7664a015b2dc01db37cf12657f922778db359f6c70a1ba93bfebbfbe3581116b
Instruction Fuzzy Hash: 5991F275E05219CFCB15CF98C48169DBBF2BFA9308F14845AE859AB314DB34ED46CB81

Function 6091B05A Relevance: 12.3, APIs: 8, Instructions: 349COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6091B06E
sqlite3_result_error_toobig.SQLITE3 ref: 6091B178
sqlite3_result_error_nomem.SQLITE3 ref: 6091B197
sqlite3_result_text.SQLITE3 ref: 6091B5A3

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_result_error_nomemsqlite3_result_error_toobigsqlite3_result_textsqlite3_value_text
String ID:
API String ID: 2352520524-0
Opcode ID: bf61c68f4ce88464188c3b4ec21cbec410585f797eaf5b0aff599f1fc01aebfc
Instruction ID: 99f21b63ad5c9672efebb0dd762c853f70c7e366ddc85f9db9da2d733c13ec0c
Opcode Fuzzy Hash: bf61c68f4ce88464188c3b4ec21cbec410585f797eaf5b0aff599f1fc01aebfc
Instruction Fuzzy Hash: F9E16B71E4C2199BDB208F18C89039EBBF7AB65314F1584DAE8A857351D738DCC19F82

Function 6096A481 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 609296D1: sqlite3_value_bytes.SQLITE3 ref: 609296F3
Part of subcall function 609296D1: sqlite3_mprintf.SQLITE3 ref: 60929708
Part of subcall function 609296D1: sqlite3_free.SQLITE3 ref: 6092971B

sqlite3_exec.SQLITE3 ref: 6096A4D7

Part of subcall function 6094CBB8: sqlite3_log.SQLITE3 ref: 6094CBF8

sqlite3_result_text.SQLITE3 ref: 6096A5D3

Part of subcall function 6096A38C: sqlite3_bind_int.SQLITE3 ref: 6096A3DE
Part of subcall function 6096A38C: sqlite3_step.SQLITE3 ref: 6096A435
Part of subcall function 6096A38C: sqlite3_reset.SQLITE3 ref: 6096A445

sqlite3_exec.SQLITE3 ref: 6096A523
sqlite3_exec.SQLITE3 ref: 6096A554
sqlite3_exec.SQLITE3 ref: 6096A57F
sqlite3_result_error_code.SQLITE3 ref: 6096A5E1

Strings

optimize, xrefs: 6096A498

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_exec$sqlite3_bind_intsqlite3_freesqlite3_logsqlite3_mprintfsqlite3_resetsqlite3_result_error_codesqlite3_result_textsqlite3_stepsqlite3_value_bytes
String ID: optimize
API String ID: 3659050757-3797040228
Opcode ID: c770602c58b8b739d860714e2a7cbb539b0686760bc80d510edb2603001de118
Instruction ID: 653702cfcd2f061f0588c77de086fc27204f9fc351fc8b4992cba684a546c14d
Opcode Fuzzy Hash: c770602c58b8b739d860714e2a7cbb539b0686760bc80d510edb2603001de118
Instruction Fuzzy Hash: E831C3B11187119FE310DF24C49570FBBE6ABA1368F10C91DF9968B350E7B9D8459F82

Function 6096544A Relevance: 12.3, APIs: 8, Instructions: 317COMMON

Download Yara Rule

APIs

sqlite3_column_blob.SQLITE3 ref: 609654FB
sqlite3_column_bytes.SQLITE3 ref: 60965510
sqlite3_reset.SQLITE3 ref: 60965556
sqlite3_reset.SQLITE3 ref: 609655B8

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

sqlite3_malloc.SQLITE3 ref: 60965655
sqlite3_free.SQLITE3 ref: 60965714
sqlite3_free.SQLITE3 ref: 6096574B

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 609657AA

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_entersqlite3_reset$sqlite3_column_blobsqlite3_column_bytessqlite3_mallocsqlite3_mutex_leave
String ID:
API String ID: 2722129401-0
Opcode ID: 718344d9776843f9d3d0f11354c3fb96bdbf3732bae6ebd8df48c35682458f02
Instruction ID: e3a8cc565ee031670952cbbbf81914cbe75110044a29491daaf6513bdc913a85
Opcode Fuzzy Hash: 718344d9776843f9d3d0f11354c3fb96bdbf3732bae6ebd8df48c35682458f02
Instruction Fuzzy Hash: BBD1D270E14219CFEB14CFA9C48469DBBF2BF68304F20856AD899AB346D774E845CF81

Function 609644FC Relevance: 12.2, APIs: 8, Instructions: 204COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 609645D9

Part of subcall function 60928099: sqlite3_malloc.SQLITE3 ref: 609280ED

sqlite3_free.SQLITE3 ref: 609647C5

Part of subcall function 60963D35: memcmp.MSVCRT ref: 60963E74

sqlite3_free.SQLITE3 ref: 6096476B

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 6096477B
sqlite3_free.SQLITE3 ref: 60964783

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_malloc$memcmpsqlite3_mutex_enter
String ID:
API String ID: 571598680-0
Opcode ID: d604abe0313f10411a0f234c71df8e29ee85eaf68e2bcebad1bf05c151ae1b53
Instruction ID: 53ad94a03898eae12f4127695087571842428d6fdffc19c65fee49adcf86f1ae
Opcode Fuzzy Hash: d604abe0313f10411a0f234c71df8e29ee85eaf68e2bcebad1bf05c151ae1b53
Instruction Fuzzy Hash: 5E91F674E14228CFEB14CFA9D890B9EBBB6BB99304F1085AAD849A7344D734DD81CF51

Function 60929740 Relevance: 12.1, APIs: 8, Instructions: 122COMMON

Download Yara Rule

APIs

sqlite3_mprintf.SQLITE3 ref: 60929761

Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA

sqlite3_mprintf.SQLITE3 ref: 609297C8
sqlite3_mprintf.SQLITE3 ref: 6092988B
sqlite3_free.SQLITE3 ref: 609298A4
sqlite3_free.SQLITE3 ref: 609298AC

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mprintf$sqlite3_free$sqlite3_initializesqlite3_vmprintf
String ID:
API String ID: 251866411-0
Opcode ID: a3bf00685530be514bf65e4252527f4a7bfa11b3ac4fddf1f02e32dfe1b6d316
Instruction ID: c0caaa5c89e6f65941469514643da9571fc5146b16edc1869e8ccb0497590022
Opcode Fuzzy Hash: a3bf00685530be514bf65e4252527f4a7bfa11b3ac4fddf1f02e32dfe1b6d316
Instruction Fuzzy Hash: 4C417970E142098FCB00DF68D48069EFBF6FFAA314F15852AE855AB344DB34D842CB81

Function 60929A9E Relevance: 12.1, APIs: 8, Instructions: 108COMMON

Download Yara Rule

APIs

sqlite3_value_int.SQLITE3 ref: 60929AD2
sqlite3_value_blob.SQLITE3 ref: 60929AF0
sqlite3_snprintf.SQLITE3 ref: 60929B4A
sqlite3_mprintf.SQLITE3 ref: 60929BBD
sqlite3_free.SQLITE3 ref: 60929BC7
sqlite3_result_text.SQLITE3 ref: 60929C19

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_textsqlite3_snprintfsqlite3_value_blobsqlite3_value_int
String ID:
API String ID: 3395562609-0
Opcode ID: cd97ca22b347d9b0461a7b933a8f10d2f7853b858b12504dee76b7a90ceec84b
Instruction ID: 76e9ea40035ab0e82da8fa4046e073449f194e7b46253af422b96645975f4339
Opcode Fuzzy Hash: cd97ca22b347d9b0461a7b933a8f10d2f7853b858b12504dee76b7a90ceec84b
Instruction Fuzzy Hash: 59416BB09087189FCB20DF68D48168DBBF2FFA9314F1086AEE49897254D734C985CF41

Function 6091A74D Relevance: 10.7, APIs: 7, Instructions: 246COMMON

Download Yara Rule

APIs

sqlite3_value_int.SQLITE3 ref: 6091A7A9
sqlite3_value_bytes.SQLITE3 ref: 6091A7C3
sqlite3_value_blob.SQLITE3 ref: 6091A7D0
sqlite3_value_text.SQLITE3 ref: 6091A7E3
sqlite3_value_int.SQLITE3 ref: 6091A842
sqlite3_result_text.SQLITE3 ref: 6091A973
sqlite3_result_blob.SQLITE3 ref: 6091AA08

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_value_int$sqlite3_result_blobsqlite3_result_textsqlite3_value_blobsqlite3_value_bytessqlite3_value_text
String ID:
API String ID: 1854132711-0
Opcode ID: 784825b838f169ca3662fcccfed6716ebcc1b6a8caffef0423c1b1d1c55abeb3
Instruction ID: 5a39f3de11663d91415d6d961256fd3a5a8574b0eada45011bd6777fd74d0884
Opcode Fuzzy Hash: 784825b838f169ca3662fcccfed6716ebcc1b6a8caffef0423c1b1d1c55abeb3
Instruction Fuzzy Hash: 6CA15C71E0862D8BDB05CFA9C88069DB7B2BF69324F148299E865A7391D734DC86CF50

Function 6092ACCB Relevance: 10.7, APIs: 7, Instructions: 246COMMON

Download Yara Rule

APIs

sqlite3_randomness.SQLITE3 ref: 6092AD1E
sqlite3_malloc.SQLITE3 ref: 6092AD55
sqlite3_free.SQLITE3 ref: 6092AEF3
sqlite3_free.SQLITE3 ref: 6092AEFB
sqlite3_mutex_enter.SQLITE3 ref: 6092AF5D
sqlite3_mutex_leave.SQLITE3 ref: 6092AF7E

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mallocsqlite3_mutex_entersqlite3_mutex_leavesqlite3_randomness
String ID:
API String ID: 834212701-0
Opcode ID: d4caf643db04253125fe23e598913b4264008d2e75d68f1a6fd045f28a2a971c
Instruction ID: 742754cd148a59deaa0d3ffdddf238278de39abc35f65d0442a8c7621edc7a55
Opcode Fuzzy Hash: d4caf643db04253125fe23e598913b4264008d2e75d68f1a6fd045f28a2a971c
Instruction Fuzzy Hash: 509178B2A146098FCB00DF68E8C0A9DBBB3FF6A314F158568E4159B358D778E842DB50

Function 6090AC7B Relevance: 10.7, APIs: 7, Instructions: 213COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 6090AC8E
sqlite3_mutex_leave.SQLITE3 ref: 6090AD32
sqlite3_mutex_enter.SQLITE3 ref: 6090AD63
sqlite3_free.SQLITE3 ref: 6090ADBD
sqlite3_mutex_leave.SQLITE3 ref: 6090AE45
sqlite3_mutex_enter.SQLITE3 ref: 6090AE68
sqlite3_mutex_leave.SQLITE3 ref: 6090AEEC

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_free
String ID:
API String ID: 251237202-0
Opcode ID: 5c94d9e5907a494954f95e85a28d12d3ee7e0fa868f5871d21c2b2919de5243c
Instruction ID: 8417c3128706898eb1fce1df082841b17c17cd4c2f963429d27d6bf7c3666c4c
Opcode Fuzzy Hash: 5c94d9e5907a494954f95e85a28d12d3ee7e0fa868f5871d21c2b2919de5243c
Instruction Fuzzy Hash: 5C911070A00615CFCB15CF28C084A99BBF6BF29318F1186ADE85A9B759D734EC81CF91

Function 60907E5C Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

trigger, xrefs: 60907FEE

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: trigger
API String ID: 0-443223901
Opcode ID: 349b01a4865d7d7f45d072b187895bebc5d15c93c0fad1fa534bd3ae010ad7b0
Instruction ID: 18345cfcb5a158583c783243482c5c91850ffab8a778169ccdecb89e3553134d
Opcode Fuzzy Hash: 349b01a4865d7d7f45d072b187895bebc5d15c93c0fad1fa534bd3ae010ad7b0
Instruction Fuzzy Hash: CD51086598C28659EB250E24C8823D7BBBFAB32324F54485ED5D787152C3BFCC8DA613

Function 6091ABCB Relevance: 10.7, APIs: 7, Instructions: 175COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6091ABF0
sqlite3_value_bytes.SQLITE3 ref: 6091AC05
sqlite3_value_text.SQLITE3 ref: 6091AC1C
memcmp.MSVCRT ref: 6091AD14
memcmp.MSVCRT ref: 6091AD70
sqlite3_free.SQLITE3 ref: 6091AD97
sqlite3_result_text.SQLITE3 ref: 6091ADB5

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: memcmpsqlite3_value_text$sqlite3_freesqlite3_result_textsqlite3_value_bytes
String ID:
API String ID: 3386002893-0
Opcode ID: edca57933d294e66e482d9f5e582282a6bc4959b8bc265b3522f854f5672a3fa
Instruction ID: 2a8b12c450011f29242cf52cc4b1f01aa082faac7b0a96c013d5e5d709acfeb1
Opcode Fuzzy Hash: edca57933d294e66e482d9f5e582282a6bc4959b8bc265b3522f854f5672a3fa
Instruction Fuzzy Hash: 3D619FB4F08A198FDB05CF69D4802ADBBF7AF6A311F1481A9D4949B390D734DC85CB81

Function 6095BAB7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

sqlite3_declare_vtab.SQLITE3 ref: 6095BAD8

Part of subcall function 6095B7D1: sqlite3_mutex_enter.SQLITE3 ref: 6095B7EA
Part of subcall function 6095B7D1: sqlite3_mutex_leave.SQLITE3 ref: 6095B81E
Part of subcall function 6095B7D1: sqlite3_log.SQLITE3 ref: 6095B842

sqlite3_malloc.SQLITE3 ref: 6095BB22
sqlite3_mprintf.SQLITE3 ref: 6095BBAE
sqlite3_malloc.SQLITE3 ref: 6095BBE9
sqlite3_free.SQLITE3 ref: 6095BC0B

Strings

simple, xrefs: 6095BB6A, 6095BB83

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_malloc$sqlite3_declare_vtabsqlite3_freesqlite3_logsqlite3_mprintfsqlite3_mutex_entersqlite3_mutex_leave
String ID: simple
API String ID: 2442034244-3246079234
Opcode ID: 6d693e4394b5bdd9b6b37bcfbec852a7bbe67c4513b126d53aeb3926b0457952
Instruction ID: ca4319e132a4062d660f96563ca765a97c675265a6841844c4d649eba51eccba
Opcode Fuzzy Hash: 6d693e4394b5bdd9b6b37bcfbec852a7bbe67c4513b126d53aeb3926b0457952
Instruction Fuzzy Hash: 47516C75E0421A8BDB01CFAAD88069EB7F2EFA5354F11C529E850AB344DB74DC568B90

Function 6091CAC5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6091CADF
sqlite3_value_text.SQLITE3 ref: 6091CAEC
sqlite3_value_text.SQLITE3 ref: 6091CAFA
sqlite3_stricmp.SQLITE3 ref: 6091CB5F
sqlite3_result_text.SQLITE3 ref: 6091CC0A

Strings

i, xrefs: 6091CB18

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_result_textsqlite3_stricmp
String ID: i
API String ID: 1123068111-3865851505
Opcode ID: 19def1c79c01a7bd20e841b92e383ba65301bbfc5237a3674863de0b6cd85910
Instruction ID: e4926c858df6062ba5810f9de82f17a4ccd1304c89a1321de7bebb4cae573fdb
Opcode Fuzzy Hash: 19def1c79c01a7bd20e841b92e383ba65301bbfc5237a3674863de0b6cd85910
Instruction Fuzzy Hash: 4741E9B5E483089FCB00DF68D48169EBBF6AF69254F10886DE899E7310E770D841CB51

Function 609634F0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

sqlite3_blob_reopen.SQLITE3 ref: 60963510

Part of subcall function 60962F28: sqlite3_log.SQLITE3 ref: 60962F5D

sqlite3_mprintf.SQLITE3 ref: 60963534
sqlite3_blob_open.SQLITE3 ref: 6096358B
sqlite3_blob_bytes.SQLITE3 ref: 609635A3
sqlite3_malloc.SQLITE3 ref: 609635BB
sqlite3_blob_read.SQLITE3 ref: 60963602
sqlite3_free.SQLITE3 ref: 60963621

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_blob_bytessqlite3_blob_opensqlite3_blob_readsqlite3_blob_reopensqlite3_freesqlite3_logsqlite3_mallocsqlite3_mprintf
String ID:
API String ID: 4276469440-0
Opcode ID: 81f80890dbec9a3991ff68d8cfcbb164f6b4d7f09a97d6cb6c54cb11191f3d09
Instruction ID: 177081cd506585250240414a33056f89eeda992db91a315aff795e5fc91eaf1e
Opcode Fuzzy Hash: 81f80890dbec9a3991ff68d8cfcbb164f6b4d7f09a97d6cb6c54cb11191f3d09
Instruction Fuzzy Hash: C641E5B09087059FDB40DF29C48179EBBE6AF98354F01C87AE898DB354E734D841DB92

Function 6091AA15 Relevance: 10.6, APIs: 7, Instructions: 89COMMON

Download Yara Rule

APIs

sqlite3_value_bytes.SQLITE3 ref: 6091AA57
sqlite3_value_bytes.SQLITE3 ref: 6091AA65
sqlite3_value_blob.SQLITE3 ref: 6091AA7C
sqlite3_value_blob.SQLITE3 ref: 6091AA89
sqlite3_value_text.SQLITE3 ref: 6091AA9F
sqlite3_value_text.SQLITE3 ref: 6091AAAC
memcmp.MSVCRT ref: 6091AAE9

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_value_blobsqlite3_value_bytessqlite3_value_text$memcmp
String ID:
API String ID: 2264764126-0
Opcode ID: d721c883a1374ca034cbd8028c6218342dc74fbbfc130f353a5f2a8c6ee1abc1
Instruction ID: d532a3ec59921de5b273c5560862273c88171bc57ee7437d0cf05ffb600e2491
Opcode Fuzzy Hash: d721c883a1374ca034cbd8028c6218342dc74fbbfc130f353a5f2a8c6ee1abc1
Instruction Fuzzy Hash: DF318871F086588BCB019F69C98066EBBF3EF69314F1148AAE4958B301D338DCC1CB81

Function 6091A226 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6091A240
sqlite3_value_text.SQLITE3 ref: 6091A24E
sqlite3_value_bytes.SQLITE3 ref: 6091A25A
sqlite3_value_text.SQLITE3 ref: 6091A27C

Strings

ESCAPE expression must be a single character, xrefs: 6091A293
LIKE or GLOB pattern too complex, xrefs: 6091A267

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_bytes
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 4080917175-264706735
Opcode ID: e5bda90e0e0ba1860c41bc069fb20e3a267b2c9271c0a370806f06164fd47fa4
Instruction ID: 7e7232241edcba55bc41816b79a09feadaac9d75cc2fb544db44a2248cbef301
Opcode Fuzzy Hash: e5bda90e0e0ba1860c41bc069fb20e3a267b2c9271c0a370806f06164fd47fa4
Instruction Fuzzy Hash: A4214C74A182198BCB00DF79C88165EBBF6FF64354B108AA9E864DB344E734DCC6CB95

Function 00562F2B Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00562C77: _free.LIBCMT ref: 00562C9C

_free.LIBCMT ref: 00562F79

Part of subcall function 0055E0A1: RtlFreeHeap.NTDLL(00000000,00000000,?,00559E30), ref: 0055E0B7
Part of subcall function 0055E0A1: GetLastError.KERNEL32(?,?,00559E30), ref: 0055E0C9

_free.LIBCMT ref: 00562F84
_free.LIBCMT ref: 00562F8F
_free.LIBCMT ref: 00562FE3
_free.LIBCMT ref: 00562FEE
_free.LIBCMT ref: 00562FF9
_free.LIBCMT ref: 00563004

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f822696a6842fdb531ade29e4e08d539aa822c2e8f098e00fb3b9312cf5b28a6
Instruction ID: eea121ec4dc3992f74fd43dc6d8c056a6bfcb60aaff4a1ccc12f03936c7ba4b6
Opcode Fuzzy Hash: f822696a6842fdb531ade29e4e08d539aa822c2e8f098e00fb3b9312cf5b28a6
Instruction Fuzzy Hash: 97110071541B09FAE930B770CC4FFCB7F9CBF84700F804829B6996B4A2D675A9489650

Function 609250BB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 6092506E: sqlite3_log.SQLITE3 ref: 609250AB

sqlite3_mutex_enter.SQLITE3 ref: 609250E7
sqlite3_value_text16.SQLITE3 ref: 60925100
sqlite3_value_text16.SQLITE3 ref: 6092512C
sqlite3_mutex_leave.SQLITE3 ref: 6092513E

Strings

library routine called out of sequence, xrefs: 609250D8
out of memory, xrefs: 609250C6, 609250EC

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_logsqlite3_mutex_entersqlite3_mutex_leave
String ID: library routine called out of sequence$out of memory
API String ID: 2019783549-3029887290
Opcode ID: bf8b25fefa583efc99e02b0fe9019e927645d1a19242a42ec125398c6bed8d9e
Instruction ID: f6310061860eb79c45c0a7b6efb00bde58ba827c5a391e7df96a4cb3fbc4cfa9
Opcode Fuzzy Hash: bf8b25fefa583efc99e02b0fe9019e927645d1a19242a42ec125398c6bed8d9e
Instruction Fuzzy Hash: 81014C70A083049BDB14AF69C9C170EBBE6BF64248F0488A9EC958F30EE775D8818B51

Function 609406CF Relevance: 10.5, APIs: 7, Instructions: 40COMMON

Download Yara Rule

APIs

sqlite3_finalize.SQLITE3 ref: 609406E3

Part of subcall function 6094064B: sqlite3_log.SQLITE3 ref: 60940672
Part of subcall function 6094064B: sqlite3_log.SQLITE3 ref: 60940696

sqlite3_free.SQLITE3 ref: 609406F7
sqlite3_free.SQLITE3 ref: 60940705
sqlite3_free.SQLITE3 ref: 60940713
sqlite3_free.SQLITE3 ref: 6094071E
sqlite3_free.SQLITE3 ref: 60940729
sqlite3_free.SQLITE3 ref: 6094073C

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_log$sqlite3_finalize
String ID:
API String ID: 1159759059-0
Opcode ID: 19269ae46022e444f8470c890b78f38089a522c4155da373e534dfec766a18bc
Instruction ID: 8ceab58ab7f3fb7faec85fb80e78016d1f3d655de586deaf1cb04ee1bc4e3406
Opcode Fuzzy Hash: 19269ae46022e444f8470c890b78f38089a522c4155da373e534dfec766a18bc
Instruction Fuzzy Hash: C801E8B45447108BDB00AF78C4C5A59BBE5EF79B18F06096DECCA8B305D734D8809B91

Function 00556F66 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00556F5B,?,?,00556F23,?,?,?), ref: 00556F7B
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00556F8E
FreeLibrary.KERNEL32(00000000,?,?,00556F5B,?,?,00556F23,?,?,?), ref: 00556FB1

Strings

mscoree.dll, xrefs: 00556F74
CorExitProcess, xrefs: 00556F86
PB, xrefs: 00556F9F

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$PB$mscoree.dll
API String ID: 4061214504-3220120048
Opcode ID: f0ab4a3ec26235c9ac3e2b596a5a9efff3bf85183f3a7fd240f206ae1139a2d6
Instruction ID: e96ca2a75f5a74c6b27f6013a01ee90c0737d49fd9add180fef6952baa693996
Opcode Fuzzy Hash: f0ab4a3ec26235c9ac3e2b596a5a9efff3bf85183f3a7fd240f206ae1139a2d6
Instruction Fuzzy Hash: EAF08C34A01218FBDB119B91FD0AB9EBF69FF10756F100069E805E21A0CBB08E48FB90

Function 00560B71 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000020,?,00000000), ref: 00560BB9
__fassign.LIBCMT ref: 00560D98
__fassign.LIBCMT ref: 00560DB5
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00560DFD
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00560E3D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00560EE9

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 7c5abc33257eeabca470f2389b10d861ffe8a97781ecb0cbc48345ffb4eb441b
Instruction ID: df4817edfe290b364efa370fb1ee56ad21e3ce17696684edd4008cf9238141f4
Opcode Fuzzy Hash: 7c5abc33257eeabca470f2389b10d861ffe8a97781ecb0cbc48345ffb4eb441b
Instruction Fuzzy Hash: B8D17B71D002999FCF15CFA8C8809EEBFB5BF48314F28556AE855EB282D731AD46CB50

Function 6095BE10 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 370COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3 ref: 6095BF79
sqlite3_strnicmp.SQLITE3 ref: 6095BF98

Strings

sqlite_master, xrefs: 6095BE99, 6095C1A6
tbl, xrefs: 6095C00E
sqlite_temp_master, xrefs: 6095BEA4, 6095C1B1

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_strnicmp
String ID: sqlite_master$sqlite_temp_master$tbl
API String ID: 1961171630-736783009
Opcode ID: 3effaab7e969fca164d8d07e9cefabdd15d70ebc4c42b76b56b625ccd3ec62e5
Instruction ID: 4b50f3209fb78631394abfce6bb8836e85f75c1250a05c1c1d7c53e2f72d7e51
Opcode Fuzzy Hash: 3effaab7e969fca164d8d07e9cefabdd15d70ebc4c42b76b56b625ccd3ec62e5
Instruction Fuzzy Hash: 70F14FB0A086148FDB06CF69C48079EBBF2BF68308F148459E895AB355D778DC89CF85

Function 60947378 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 292COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(?), ref: 609476DD

Part of subcall function 60904423: sqlite3_mutex_leave.SQLITE3(6090449D,?,?,?,60908270), ref: 60904446

sqlite3_log.SQLITE3 ref: 609498F5

Strings

d, xrefs: 609474ED
|, xrefs: 609499CF
List of tree roots: , xrefs: 60947599

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_logsqlite3_mutex_leave
String ID: List of tree roots: $d$|
API String ID: 3709608969-1164703836
Opcode ID: 316fa83f4dc1e403b3b617744d66ff6f9af545e53e2752a9ff9486d467efffaf
Instruction ID: c91562837ba2d96ae21b52ab8334c840e7cbe23d8154f1acff92b465618a0bd4
Opcode Fuzzy Hash: 316fa83f4dc1e403b3b617744d66ff6f9af545e53e2752a9ff9486d467efffaf
Instruction Fuzzy Hash: 3FE10570A043698BDB22CF18C88179DFBBABF65304F1185D9E858AB251D775DE81CF81

Function 60941BD1 Relevance: 9.0, APIs: 6, Instructions: 39COMMON

Download Yara Rule

APIs

sqlite3_finalize.SQLITE3 ref: 60941BE3

Part of subcall function 6094064B: sqlite3_log.SQLITE3 ref: 60940672
Part of subcall function 6094064B: sqlite3_log.SQLITE3 ref: 60940696

sqlite3_free.SQLITE3 ref: 60941BFE
sqlite3_free.SQLITE3 ref: 60941C06
sqlite3_free.SQLITE3 ref: 60941C1E
sqlite3_free.SQLITE3 ref: 60941C29
sqlite3_free.SQLITE3 ref: 60941C31

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_log$sqlite3_finalize
String ID:
API String ID: 1159759059-0
Opcode ID: 3f583470b204b1da642d0e4ea7ab8f9e32a345052cadd4df2d6b2a742f171e42
Instruction ID: 9709a32afd64414ac750869b90273176c1e255bad47196dcdf77f53583eb2260
Opcode Fuzzy Hash: 3f583470b204b1da642d0e4ea7ab8f9e32a345052cadd4df2d6b2a742f171e42
Instruction Fuzzy Hash: 5B0119715447108BDB10AF68C4C6A0ABBE5EFB6B69F09495CECC58B305D734E890CB91

Function 6094CF89 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8

Part of subcall function 60939559: memcmp.MSVCRT ref: 60939694
Part of subcall function 60939559: memcmp.MSVCRT ref: 609396CA

sqlite3_exec.SQLITE3 ref: 6094D1FC

Strings

CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text), xrefs: 6094CFA0
CREATE TEMP TABLE sqlite_temp_master( type text, name text, tbl_name text, rootpage integer, sql text), xrefs: 6094CFAE
sqlite_master, xrefs: 6094CFA5
sqlite_temp_master, xrefs: 6094CFB3

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: memcmp$sqlite3_execsqlite3_mutex_try
String ID: CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)$CREATE TEMP TABLE sqlite_temp_master( type text, name text, tbl_name text, rootpage integer, sql text)$sqlite_master$sqlite_temp_master
API String ID: 1504143485-2685329186
Opcode ID: 928f19428b495060232cf5c0ac031b7f7650000be7fc4ce62faf42110051e525
Instruction ID: 3f07e2629315f7646207d546f37a6452aa6d59963006dfed45c0593794fe0206
Opcode Fuzzy Hash: 928f19428b495060232cf5c0ac031b7f7650000be7fc4ce62faf42110051e525
Instruction Fuzzy Hash: 57A14A78A093088FDB14CFA9C48178EBBF6BFA9314F108569D868AB345D774E885CF51

Function 60960052 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

APIs

Part of subcall function 6095FFB2: sqlite3_bind_int64.SQLITE3 ref: 6095FFFA
Part of subcall function 6095FFB2: sqlite3_step.SQLITE3 ref: 60960009
Part of subcall function 6095FFB2: sqlite3_reset.SQLITE3 ref: 60960019
Part of subcall function 6095FFB2: sqlite3_result_error_code.SQLITE3 ref: 60960043

sqlite3_column_int64.SQLITE3 ref: 609600BA
sqlite3_column_text.SQLITE3 ref: 609600EF
sqlite3_free.SQLITE3 ref: 6096029A

Strings

e, xrefs: 60960227

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_column_int64sqlite3_column_textsqlite3_freesqlite3_resetsqlite3_result_error_codesqlite3_step
String ID: e
API String ID: 786425071-4024072794
Opcode ID: 373422d03c3c71c2ddc35291c61dfb2213fd8f263c0b9a30c36f02d650250dc2
Instruction ID: e80500568aa73e744b5c90812a7938b6c4ac38b40afb48beb036dafaf3e7d002
Opcode Fuzzy Hash: 373422d03c3c71c2ddc35291c61dfb2213fd8f263c0b9a30c36f02d650250dc2
Instruction Fuzzy Hash: 6291E270A18609CFDB04CF99C494B9EBBF2BF98314F108529E869AB354D774E885CF91

Function 609470DE Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

sqlite3_exec.SQLITE3 ref: 6094716D

Strings

sqlite_master, xrefs: 609470E7
|, xrefs: 609499CF
sqlite_temp_master, xrefs: 609470F1

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_exec
String ID: sqlite_master$sqlite_temp_master$|
API String ID: 2141490097-2247242311
Opcode ID: 0e32379bf9c90bcee3e658b343db186d73978ee403121efd96d42beb4ff38922
Instruction ID: 9143400cfb6dc20a8edc2ca7c04099347fc9d468871a1d2187ae3123f936d49a
Opcode Fuzzy Hash: 0e32379bf9c90bcee3e658b343db186d73978ee403121efd96d42beb4ff38922
Instruction Fuzzy Hash: C551B6B09083289BDB26CF18C885799BBFABF59304F108599E498A7351D775DA84CF41

Function 6095CEFA Relevance: 8.0, Strings: 6, Instructions: 465COMMON

Download Yara Rule

Strings

BINARY, xrefs: 6095D1F9
TABLE, xrefs: 6095D2C3
, xrefs: 6095CF5B
sqlite_master, xrefs: 6095D57F
VIEW, xrefs: 6095D2D1
sqlite_temp_master, xrefs: 6095D58A

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: $BINARY$TABLE$VIEW$sqlite_master$sqlite_temp_master
API String ID: 0-2407382664
Opcode ID: b0107a726b8fb37f7fae1980a21521c1b577fdc0f154ec6a0eefc915386bc530
Instruction ID: 886bb110d7bb056bda1dcbb07c1a36b757a5330bf09d203bf1c367f15e791f1b
Opcode Fuzzy Hash: b0107a726b8fb37f7fae1980a21521c1b577fdc0f154ec6a0eefc915386bc530
Instruction Fuzzy Hash: CF226A70A09204CFDB25CFA9C48079EBBF2BF69304F148569E899AB355D734EC56CB81

Function 60963637 Relevance: 7.8, APIs: 5, Instructions: 258COMMON

Download Yara Rule

APIs

sqlite3_realloc.SQLITE3(?,?), ref: 6096373B
memcmp.MSVCRT(?,?), ref: 60963782
sqlite3_free.SQLITE3 ref: 60963843
sqlite3_free.SQLITE3 ref: 609638D9
sqlite3_free.SQLITE3 ref: 60963953

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$memcmpsqlite3_realloc
String ID:
API String ID: 3422960571-0
Opcode ID: 50eda45380483794e32bdd730fc6b6b580c41d30328003452ec2c22d7d846426
Instruction ID: 3b390e38dde49c5924589a602beaf2ee173d98914be71c714148da16d267e2cf
Opcode Fuzzy Hash: 50eda45380483794e32bdd730fc6b6b580c41d30328003452ec2c22d7d846426
Instruction Fuzzy Hash: 42B1D0B4E142189BEB05CFA9C5807DDBBF6BFA8304F148429E858A7344D374E946CF91

Function 6094B137 Relevance: 7.7, APIs: 5, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 6090A0D5: sqlite3_free.SQLITE3 ref: 6090A118

sqlite3_malloc.SQLITE3 ref: 6094B1D1
sqlite3_value_bytes.SQLITE3 ref: 6094B24C
sqlite3_malloc.SQLITE3 ref: 6094B272
sqlite3_value_blob.SQLITE3 ref: 6094B298
sqlite3_free.SQLITE3 ref: 6094B2C8

Part of subcall function 6094A894: sqlite3_bind_int64.SQLITE3 ref: 6094A8C0
Part of subcall function 6094A894: sqlite3_step.SQLITE3 ref: 6094A8CE
Part of subcall function 6094A894: sqlite3_column_int64.SQLITE3 ref: 6094A8E9
Part of subcall function 6094A894: sqlite3_reset.SQLITE3 ref: 6094A90F

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_malloc$sqlite3_bind_int64sqlite3_column_int64sqlite3_resetsqlite3_stepsqlite3_value_blobsqlite3_value_bytes
String ID:
API String ID: 683514883-0
Opcode ID: 3036fcfce1ee653ed62d56f61367963e4d2afc4bfe1ca560103df060be3b8356
Instruction ID: 83940ce9cf0a2bab7a741171fc95cc3a005d2848f59039768723a80715f2adcb
Opcode Fuzzy Hash: 3036fcfce1ee653ed62d56f61367963e4d2afc4bfe1ca560103df060be3b8356
Instruction Fuzzy Hash: E19133B1A052099FCB04CFA9D490B9EBBF6FF68314F108569E855AB341DB34ED81CB91

Function 6093A1DD Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A200
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A391
sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A3A3
sqlite3_free.SQLITE3 ref: 6093A3BA
sqlite3_free.SQLITE3 ref: 6093A3C2

Part of subcall function 6093A0C5: sqlite3_mutex_enter.SQLITE3 ref: 6093A114
Part of subcall function 6093A0C5: sqlite3_mutex_free.SQLITE3 ref: 6093A152
Part of subcall function 6093A0C5: sqlite3_mutex_leave.SQLITE3 ref: 6093A162
Part of subcall function 6093A0C5: sqlite3_free.SQLITE3 ref: 6093A1A4
Part of subcall function 6093A0C5: sqlite3_free.SQLITE3 ref: 6093A1C3

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_leave$sqlite3_mutex_free$sqlite3_mutex_enter
String ID:
API String ID: 1903298374-0
Opcode ID: 8530df85f137a660efabd51ca86f4821d2fdcc6d7a3fd2cfb4f5547b241dda56
Instruction ID: f6c450fbbadf2e04ab128defb7df19fdb2a161b4e6cf4e71623f80625393026f
Opcode Fuzzy Hash: 8530df85f137a660efabd51ca86f4821d2fdcc6d7a3fd2cfb4f5547b241dda56
Instruction Fuzzy Hash: EB513870A047218BDB58DF69C8C074AB7A6BF65318F05896CECA69B305D735EC41CF91

Function 60929C62 Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

sqlite3_value_int.SQLITE3 ref: 60929C93
sqlite3_mprintf.SQLITE3 ref: 60929D77
sqlite3_result_error_nomem.SQLITE3 ref: 60929D85
sqlite3_free.SQLITE3 ref: 60929DA7

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_result_double.SQLITE3 ref: 60929DB6

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_mutex_entersqlite3_result_doublesqlite3_result_error_nomemsqlite3_value_int
String ID:
API String ID: 3223668129-0
Opcode ID: d851793c2ab1a5945ed73a83f0f22a2c8a0e6d9fcd667d31604bb22c6e7540ef
Instruction ID: cdfe2a8baa321ef6fba23c5b67493ddb4ee3b1bf737bf16b18af6cd9c2d27096
Opcode Fuzzy Hash: d851793c2ab1a5945ed73a83f0f22a2c8a0e6d9fcd667d31604bb22c6e7540ef
Instruction Fuzzy Hash: FD41B275D18219DADF01AFA4E8842CDBFF6FFA9300F104458F89176298E736C891DB55

Function 60929EB7 Relevance: 7.6, APIs: 5, Instructions: 108COMMON

Download Yara Rule

APIs

sqlite3_realloc.SQLITE3(?), ref: 60929EFF
sqlite3_mprintf.SQLITE3(?), ref: 60929F2C
sqlite3_free.SQLITE3(?), ref: 60929F5B
sqlite3_mprintf.SQLITE3(?), ref: 60929F67
sqlite3_malloc.SQLITE3(?), ref: 60929F9F

Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mprintf$sqlite3_freesqlite3_initializesqlite3_mallocsqlite3_realloc
String ID:
API String ID: 4083147203-0
Opcode ID: fe1f7a002b5325b67ee87995c070210f0f001551018c8b6e5a3b832f72016dcf
Instruction ID: 1df7357a72b9f0325fc8da2f0ad80e5d4942d19aabd3a5e57e3c01e1d1edd0f0
Opcode Fuzzy Hash: fe1f7a002b5325b67ee87995c070210f0f001551018c8b6e5a3b832f72016dcf
Instruction Fuzzy Hash: 8D414870614219CFCB44DF24E28069ABBE7FFAA314F1484A9EC458B309D734ED51CBA1

Function 6093A0C5 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8

sqlite3_mutex_enter.SQLITE3 ref: 6093A114
sqlite3_mutex_free.SQLITE3 ref: 6093A152
sqlite3_mutex_leave.SQLITE3 ref: 6093A162
sqlite3_free.SQLITE3 ref: 6093A1A4
sqlite3_free.SQLITE3 ref: 6093A1C3

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_entersqlite3_mutex_freesqlite3_mutex_leavesqlite3_mutex_try
String ID:
API String ID: 1894464702-0
Opcode ID: 7188b9a67afd66d207271078c150a83da37f36a2752b1b5804700c826a798ba9
Instruction ID: 8ebadd1dc7ee404a0f141fd21885e91e0aa1156a5a6df10951b92a0b718128ce
Opcode Fuzzy Hash: 7188b9a67afd66d207271078c150a83da37f36a2752b1b5804700c826a798ba9
Instruction Fuzzy Hash: CF313C70B086118BDB18DF79C8C1A1A7BFBBFB2704F148468E8418B219EB35DC419F91

Function 6092535E Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 60925326: sqlite3_log.SQLITE3 ref: 60925352

sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,609254CC), ref: 6092538E
sqlite3_mutex_leave.SQLITE3 ref: 609253C4
sqlite3_log.SQLITE3 ref: 609253E2
sqlite3_log.SQLITE3 ref: 60925406
sqlite3_mutex_leave.SQLITE3 ref: 60925443

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_log$sqlite3_mutex_leave$sqlite3_mutex_enter
String ID:
API String ID: 3336957480-0
Opcode ID: 1198911827aa14b9fab328e6e7c73bc961b2278be0ca20fe6461460b1b30ceeb
Instruction ID: a100dd02d465b32589d57b5b9efe4db3cd483c3b5de54de748c9b161d5d001e2
Opcode Fuzzy Hash: 1198911827aa14b9fab328e6e7c73bc961b2278be0ca20fe6461460b1b30ceeb
Instruction Fuzzy Hash: D3315A70228704DBDB00EF28D49575ABBE6AFA1358F00886DE9948F36DD778C885DB02

Function 60961389 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

sqlite3_result_blob.SQLITE3 ref: 609613D0
sqlite3_column_int.SQLITE3 ref: 6096143A
sqlite3_data_count.SQLITE3 ref: 60961465
sqlite3_column_value.SQLITE3 ref: 60961476
sqlite3_result_value.SQLITE3 ref: 60961482

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_column_intsqlite3_column_valuesqlite3_data_countsqlite3_result_blobsqlite3_result_value
String ID:
API String ID: 3091402450-0
Opcode ID: 15f5c91e7d752206cb5be57281081ebbda5684d1dfb7c3b21a78c03d1c189b87
Instruction ID: 8b12398a3b1f37ca0d2e1a8d549e1f0529ecbd38da511dd0edd3444da8e5cc4d
Opcode Fuzzy Hash: 15f5c91e7d752206cb5be57281081ebbda5684d1dfb7c3b21a78c03d1c189b87
Instruction Fuzzy Hash: 72314DB19082058FDB00DF29C48064EB7F6FF65354F19856AE8999B361EB34E886CF81

Function 60939097 Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 609390AC
sqlite3_mutex_enter.SQLITE3 ref: 609390B7
sqlite3_free.SQLITE3 ref: 60939120
sqlite3_mutex_leave.SQLITE3 ref: 6093912D
sqlite3_mutex_leave.SQLITE3 ref: 60939138

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_free
String ID:
API String ID: 251237202-0
Opcode ID: ee0aefbaff40cad113deb2524f723b57adfc4224f15c8691f87345bc20e459c1
Instruction ID: 8e14962182cb4ba31828fc05f1b37fa5954e33605a362b2e641de35f96add61e
Opcode Fuzzy Hash: ee0aefbaff40cad113deb2524f723b57adfc4224f15c8691f87345bc20e459c1
Instruction Fuzzy Hash: 022137B46087158BC709AF68C48570ABBF6FFA5318F10895DEC958B345DB74E940CB82

Function 6091A2E8 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 6091A31E
sqlite3_value_text.SQLITE3 ref: 6091A349
sqlite3_value_bytes.SQLITE3 ref: 6091A356
sqlite3_value_text.SQLITE3 ref: 6091A37B
sqlite3_value_bytes.SQLITE3 ref: 6091A387

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_aggregate_context
String ID:
API String ID: 4225432645-0
Opcode ID: e7dd5294350f58c57afd4f2551108a775ab72f2657aaaf635efeb712e258985e
Instruction ID: 24a20a1669ecabf1c8c9e0f75de4e20f6480f0c3e20d7f4799920e66bb4c3c2a
Opcode Fuzzy Hash: e7dd5294350f58c57afd4f2551108a775ab72f2657aaaf635efeb712e258985e
Instruction Fuzzy Hash: 3F21CF71B086588FDB009F29C48075E7BE7AFA4254F0484A8E894CF305EB34DC86CB91

Function 60903571 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3(?,-00000200,?), ref: 6090359D
sqlite3_mutex_leave.SQLITE3(?,-00000200,?), ref: 609035E0
sqlite3_mutex_enter.SQLITE3(?,-00000200,?), ref: 609035F9
sqlite3_mutex_leave.SQLITE3(?,-00000200,?), ref: 60903614
sqlite3_free.SQLITE3(?,-00000200,?), ref: 6090361C

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_free
String ID:
API String ID: 251237202-0
Opcode ID: d176fa110bd2286076a254f1a84b89a7a2b75649dc4a807f2bdee778eef171d4
Instruction ID: 98a7ce7f1ce2ff6a0e5ca4ca87ec4bf20a5c319c62b2fc6798152503390b0136
Opcode Fuzzy Hash: d176fa110bd2286076a254f1a84b89a7a2b75649dc4a807f2bdee778eef171d4
Instruction Fuzzy Hash: B211FE725186218BCB00EF7DC8C16197FE7FB66358F01491DE866D7362D73AD480AB42

Function 005629FF Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00562A17

Part of subcall function 0055E0A1: RtlFreeHeap.NTDLL(00000000,00000000,?,00559E30), ref: 0055E0B7
Part of subcall function 0055E0A1: GetLastError.KERNEL32(?,?,00559E30), ref: 0055E0C9

_free.LIBCMT ref: 00562A29
_free.LIBCMT ref: 00562A3B
_free.LIBCMT ref: 00562A4D
_free.LIBCMT ref: 00562A5F

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 22d51ac32772443b8eaa580d2d81201a2ddf0d32f11fd2ae116dcca2e5e6e9fd
Instruction ID: 9a706c016aeb1c217b758985b99905ac7365854f94aff6e9482d7841bf5b6284
Opcode Fuzzy Hash: 22d51ac32772443b8eaa580d2d81201a2ddf0d32f11fd2ae116dcca2e5e6e9fd
Instruction Fuzzy Hash: 4DF06272515744A78638DB94E4CBC167FDDBB94711B94080AF448DB961CBF1FDC48A50

Function 609441F6 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

string or blob too big, xrefs: 60949978
(, xrefs: 6094449C
|, xrefs: 609499CF

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_log
String ID: ($string or blob too big$|
API String ID: 632333372-2398534278
Opcode ID: 03236f3895d5fd10e60d1ff1eefb6ed02231b27a1c47450c0fb49d2dd58edd91
Instruction ID: 3c3a64a58f66130c0c9aec06ea77be0954bd7b4098f3428da06b6372deec6608
Opcode Fuzzy Hash: 03236f3895d5fd10e60d1ff1eefb6ed02231b27a1c47450c0fb49d2dd58edd91
Instruction Fuzzy Hash: 5DC10CB5A043288FCB66CF28C981789B7BABB59304F1085D9E958A7345C775EF81CF40

Function 60942FBD Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 60943142
sqlite3_log.SQLITE3 ref: 609498F5

Strings

string or blob too big, xrefs: 60949978
|, xrefs: 609499CF

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_logsqlite3_value_text
String ID: string or blob too big$|
API String ID: 2320820228-330586046
Opcode ID: ada73e0a137eb04777799e4f036ed76b90dd9f278f5425474658b89d8575ec09
Instruction ID: 69971f75fd49ffa5340abb494278c934bd16b846b58f9b00f9b27cb248effe65
Opcode Fuzzy Hash: ada73e0a137eb04777799e4f036ed76b90dd9f278f5425474658b89d8575ec09
Instruction Fuzzy Hash: 4C91B2B49083289BCB26CF28C980799BBBABF59304F1185D9E89C67341C775AF81CF45

Function 6092362D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 60923675

Strings

BINARY, xrefs: 6092372C

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: BINARY
API String ID: 912767213-907554435
Opcode ID: dd54eeba7b99beb4c129e1ce0ebb3c97c4d31291de79a9977aa1c0a9ff3222ee
Instruction ID: 142a1e9d4f1e8552d2c1f4074703eb5ae9f1e70d76b7ded3e689f9c37387bea1
Opcode Fuzzy Hash: dd54eeba7b99beb4c129e1ce0ebb3c97c4d31291de79a9977aa1c0a9ff3222ee
Instruction Fuzzy Hash: 11512AB8A142159FCF05CF68D580A9EBBFBBFA9314F208569D855AB318D335EC41CB90

Function 60949DAC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

sqlite3_sql.SQLITE3 ref: 6094A552
sqlite3_reset.SQLITE3 ref: 6094A61D
sqlite3_value_text.SQLITE3 ref: 6094A63A
sqlite3_mutex_leave.SQLITE3 ref: 6094A69C

Strings

2, xrefs: 6094A542

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_leavesqlite3_resetsqlite3_sqlsqlite3_value_text
String ID: 2
API String ID: 1785132425-450215437
Opcode ID: db8f166ddc0cfbdcbd5f32980f2b1f99f1bd1244978a7152732ee1cc2c628839
Instruction ID: 597764216a692ebc28d62b3e9b959cbcaae2fc1a8fb9b26673869d076dcf5979
Opcode Fuzzy Hash: db8f166ddc0cfbdcbd5f32980f2b1f99f1bd1244978a7152732ee1cc2c628839
Instruction Fuzzy Hash: 8E517770A042148FCB15CF28C58179DBBF2BF69314F1585A9E899AB364D774EC81CF92

Function 60913BA4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 60913CB2
localtime.MSVCRT ref: 60913CBD
sqlite3_mutex_leave.SQLITE3 ref: 60913CEA

Strings

local time unavailable, xrefs: 60913CF3

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: localtimesqlite3_mutex_entersqlite3_mutex_leave
String ID: local time unavailable
API String ID: 3476490258-3313036412
Opcode ID: 6acada5134e00415429bcc5b4b183e079ecdceb595db9bca5a080064bd69524b
Instruction ID: f84507306b972a4d36fbc7e5567743b03a4ac0d251de853d72eadedefc010ba3
Opcode Fuzzy Hash: 6acada5134e00415429bcc5b4b183e079ecdceb595db9bca5a080064bd69524b
Instruction Fuzzy Hash: 5651F674E08368CFEB20DFA9C88478DBBF2BF55304F1080A9D848AB245D7799985CF52

Function 6095EEAF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

sqlite3_prepare.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6095EF5D
sqlite3_finalize.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6095EFA9

Part of subcall function 609240C2: sqlite3_log.SQLITE3 ref: 60924156

Strings

invalid rootpage, xrefs: 6095EFEB

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_finalizesqlite3_logsqlite3_prepare
String ID: invalid rootpage
API String ID: 2900056705-1762523506
Opcode ID: 27974c77d9d18cc263508586b2ee327a9c51ed772766951440f8d4a8582445ed
Instruction ID: c606602b2a8dd8c48966cea09a4a84baaf8c15842cd2594d75ee5774f0f5fe0f
Opcode Fuzzy Hash: 27974c77d9d18cc263508586b2ee327a9c51ed772766951440f8d4a8582445ed
Instruction Fuzzy Hash: 5441CF70A043408BDB1ACF2AC48079DBBA7BFA8304F14852DEDA58B345EB36D859CB51

Function 60953B8B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 60953BA2
sqlite3_stricmp.SQLITE3 ref: 60953BBE

Strings

normal, xrefs: 60953BB0, 60953C3C
exclusive, xrefs: 60953B94, 60953C34

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: exclusive$normal
API String ID: 912767213-1147136348
Opcode ID: b677569eb024c818d032dcffb5339059163919a8b940340d1f74598058a7ff29
Instruction ID: afff064df9092237d667739194245f70067dde0200fe6a82340cdbbf07815e86
Opcode Fuzzy Hash: b677569eb024c818d032dcffb5339059163919a8b940340d1f74598058a7ff29
Instruction Fuzzy Hash: 6F314631B083088BD715CB29C491B5EB7B3AFA1308F10C559E8969B395CB79DC86CB42

Function 6096D170 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6096D1A1
VirtualProtect.KERNEL32 ref: 6096D1E3
VirtualProtect.KERNEL32 ref: 6096D21E

Strings

@, xrefs: 6096D1C8

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: Virtual$Protect$Query
String ID: @
API String ID: 3618607426-2766056989
Opcode ID: a11a59528d98c4ff7ad69dfbc7d520f68a8f714e9ef4c31244658d91e7757f1c
Instruction ID: 11fd3fd6c91f2e29dbdaed7331fdf7a08ef8f1da01c53322037319a40d79a89e
Opcode Fuzzy Hash: a11a59528d98c4ff7ad69dfbc7d520f68a8f714e9ef4c31244658d91e7757f1c
Instruction Fuzzy Hash: 003141B5E15208AFEB14DFA9D48158EFFF5EF99254F10852AE868E3310E371D940CB52

Function 60953DF8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 60953E2F
sqlite3_stricmp.SQLITE3 ref: 60953E45
sqlite3_stricmp.SQLITE3 ref: 60953E5B

Strings

auto_vacuum, xrefs: 60953E17

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: auto_vacuum
API String ID: 912767213-4168080761
Opcode ID: c9792687c8f072a45e327cf87f40ef5f8653179bc3aa885cbb195d77568d42d8
Instruction ID: cadb00feac8342adb2c7966629847957083903c142478eabd80c02f3003c15f5
Opcode Fuzzy Hash: c9792687c8f072a45e327cf87f40ef5f8653179bc3aa885cbb195d77568d42d8
Instruction Fuzzy Hash: 98313874B043548BCB11DFA9C9926ADB7B3AFB5308F508029E85A9F305DB74DD4ACB42

Function 60949B66 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 60925326: sqlite3_log.SQLITE3 ref: 60925352

sqlite3_mutex_enter.SQLITE3 ref: 60949BBC

Strings

2, xrefs: 6094A542

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_enter
String ID: 2
API String ID: 1972683386-450215437
Opcode ID: 3cdf509036881d6e23f4e681c98427409d8a02be068252426abf5cf55e228d7e
Instruction ID: 98b1dcaeacbbce05804e7cd5a920ea2345662c9674881741d0d4c5bf3761d90d
Opcode Fuzzy Hash: 3cdf509036881d6e23f4e681c98427409d8a02be068252426abf5cf55e228d7e
Instruction Fuzzy Hash: 19416775A002288FCB10CF28C8807D8BBB6BF69314F0085E9E899AB345D770ED85CF81

Function 60928335 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 60928353

Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4

sqlite3_realloc.SQLITE3 ref: 609283A0
sqlite3_free.SQLITE3 ref: 609283B6

Strings

d, xrefs: 6092836D

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_mallocsqlite3_realloc
String ID: d
API String ID: 211589378-2564639436
Opcode ID: 4c34ce46e3d0a3d1d3def0d8ad382c8948c40f702370fc4fcdce263753dde11a
Instruction ID: 0830c2115c9ea807631a831f7f1165b0ee40d8a8a94356aa67113494a68d5982
Opcode Fuzzy Hash: 4c34ce46e3d0a3d1d3def0d8ad382c8948c40f702370fc4fcdce263753dde11a
Instruction Fuzzy Hash: 222137B0A04205CFDB14DF59D4C078ABBF6FF69314F158469D8889B309E3B8E841CBA1

Function 60905D76 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 60905D8B
sqlite3_stricmp.SQLITE3 ref: 60905DA4
sqlite3_stricmp.SQLITE3 ref: 60905DB8

Strings

ROWID, xrefs: 60905D99

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: ROWID
API String ID: 912767213-2122279469
Opcode ID: 2270d3836856cffccbcabf7cd9364952b7ff82ae52fb0f1d692500485a3b5371
Instruction ID: 933a171be27827f1855ecfee19b391cf04a11f0d0f929a034feeb7484ce1243a
Opcode Fuzzy Hash: 2270d3836856cffccbcabf7cd9364952b7ff82ae52fb0f1d692500485a3b5371
Instruction Fuzzy Hash: E2F06D722193105AF7106F359A4235ABEE9DB602ACF40483DE886C7381EB76CC00CB92

Function 60901184 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6090119B
GetProcAddress.KERNEL32 ref: 609011B0

Strings

libgcj-11.dll, xrefs: 60901194
_Jv_RegisterClasses, xrefs: 609011A5

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-11.dll
API String ID: 1646373207-2713375476
Opcode ID: 84d528d321f1eea6d8a1b68cb749bb1a2441192a5c5952381cf667fabd413772
Instruction ID: e6822cb61b404b68644b44a252d8259deade1a358cfa59fcc717d95409d4d83a
Opcode Fuzzy Hash: 84d528d321f1eea6d8a1b68cb749bb1a2441192a5c5952381cf667fabd413772
Instruction Fuzzy Hash: 0DE04F7062D30586FB443F794D923297AEB5F72549F00081CD9929B240EBB4D440D753

Function 60933BC3 Relevance: 6.5, Strings: 5, Instructions: 229COMMON

Download Yara Rule

Strings

LIST, xrefs: 60933BE6
K, xrefs: 60933BE1
CORRELATED , xrefs: 60933BEB
SCALAR, xrefs: 60933BDC
b, xrefs: 60933D48

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: CORRELATED $K$LIST$SCALAR$b
API String ID: 0-4060810509
Opcode ID: 8db36e59fcae7ffd5547493e445a80e01b6f1cf8fd078554880dde4a15d80523
Instruction ID: 819a91b1e44c81f2bf7f2ac24405052a58089a4cbbf3b5a01338e4ff208ba3b4
Opcode Fuzzy Hash: 8db36e59fcae7ffd5547493e445a80e01b6f1cf8fd078554880dde4a15d80523
Instruction Fuzzy Hash: 2AA107B4A04258CFDB15DFA8C48079EBBF2BF68308F148559E8959B394D739D982CF42

Function 6090A882 Relevance: 6.4, Strings: 5, Instructions: 149COMMON

Download Yara Rule

Strings

:, xrefs: 6090A8F6
;, xrefs: 6090AA15
;, xrefs: 6090A912
., xrefs: 6090A944
:, xrefs: 6090AA34

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: .$:$:$;$;
API String ID: 0-3979609778
Opcode ID: 50b9d7b53ff024c5b5e5e467dd09a5a86a30f3212454febefa11a70b635a06cf
Instruction ID: 88cbeff3cb36a4107b9ab761e04ae617a78179eaf1b2646578849985a96e8386
Opcode Fuzzy Hash: 50b9d7b53ff024c5b5e5e467dd09a5a86a30f3212454febefa11a70b635a06cf
Instruction Fuzzy Hash: 9D519DB1A083419ED701CF15C58438ABFF6FB55348F24891DD8959B291E3B9CA89CFD2

Function 6092BAF1 Relevance: 6.4, APIs: 4, Instructions: 355stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6090EF7E: memcmp.MSVCRT ref: 6090F050

strcmp.MSVCRT ref: 6092BEE3
sqlite3_free.SQLITE3 ref: 6092BF4F
sqlite3_free.SQLITE3 ref: 6092BF68
sqlite3_log.SQLITE3 ref: 6092BF99

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$memcmpsqlite3_logstrcmp
String ID:
API String ID: 3787749158-0
Opcode ID: 29281061d15e26e231fc497de0719ba5697b5ef50d0ffa53d5b2a88354eec6f6
Instruction ID: 2b4fff383e6e406c0ee57b36291d8f76e70734d650f3f2eec571b8b49700bc93
Opcode Fuzzy Hash: 29281061d15e26e231fc497de0719ba5697b5ef50d0ffa53d5b2a88354eec6f6
Instruction Fuzzy Hash: D8E12774E142058FDB04DFA9D98078DBBF6BFA8304F148569E858AB358E734D845CF81

Function 60922538 Relevance: 6.3, APIs: 4, Instructions: 317COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 609225EA
sqlite3_free.SQLITE3 ref: 60922697
sqlite3_free.SQLITE3 ref: 609228D2
sqlite3_free.SQLITE3 ref: 60922905

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free
String ID:
API String ID: 2313487548-0
Opcode ID: 17c4197e66eccf8e4e539c70c01e6b2d08fb8491bcf73b2b2b780fd64eb57762
Instruction ID: 4e09bb13dd5a3c3c1d339de95b14bc5918580ae4e3dbdcf066e72e084d482625
Opcode Fuzzy Hash: 17c4197e66eccf8e4e539c70c01e6b2d08fb8491bcf73b2b2b780fd64eb57762
Instruction Fuzzy Hash: 15E14674928209EFDB04CF94D184B9EBBB2FF69304F208558D8956B259D774EC86CF81

Function 6094D584 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 285COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6094D630
sqlite_sequence, xrefs: 6094D77D
sqlite_temp_master, xrefs: 6094D63B

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: sqlite_master$sqlite_sequence$sqlite_temp_master
API String ID: 0-1177837799
Opcode ID: b45b6970ebe54efa46efcb65f0e1138f7cff2b55d537d73117a3441f01693427
Instruction ID: e5240d50caebec33bd4ce83d4b9fb982fe545a794019e3d400788b6e3ec19482
Opcode Fuzzy Hash: b45b6970ebe54efa46efcb65f0e1138f7cff2b55d537d73117a3441f01693427
Instruction Fuzzy Hash: F7C13974B062089BDB05DF68D49179EBBF3AFA8308F14C42DE8899B345DB39D841CB41

Function 6095B7D1 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 6095B7EA
sqlite3_mutex_leave.SQLITE3 ref: 6095B81E
sqlite3_log.SQLITE3 ref: 6095B842
sqlite3_mutex_leave.SQLITE3 ref: 6095B95D

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_leave$sqlite3_logsqlite3_mutex_enter
String ID:
API String ID: 4249760608-0
Opcode ID: 55775a197f9aa81981a6c1824e65e5643dd82e92c35c8cbf90f4756fe2761598
Instruction ID: 2374180173898b37ca3bb3ba1fa7e33799c7e45bceefb220d1965ad168ba1add
Opcode Fuzzy Hash: 55775a197f9aa81981a6c1824e65e5643dd82e92c35c8cbf90f4756fe2761598
Instruction Fuzzy Hash: 7F412970A083048BE701DF6AC495B8ABBF6FFA5308F04C46DE8598B355D779D849CB91

Function 6095B96D Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3 ref: 6095B9BB
sqlite3_declare_vtab.SQLITE3 ref: 6095BA05
sqlite3_malloc.SQLITE3 ref: 6095BA25
sqlite3_mprintf.SQLITE3 ref: 6095BA92

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_declare_vtabsqlite3_mallocsqlite3_mprintfsqlite3_strnicmp
String ID:
API String ID: 2845923074-0
Opcode ID: adcb5081bc0a0f0b70e076eaaa5e72b615df4102035740f205e84ca3e9491abd
Instruction ID: 55e525e07a984a73799687ce87dfffb994e8842983bd9a561e9639f6c9bc7d39
Opcode Fuzzy Hash: adcb5081bc0a0f0b70e076eaaa5e72b615df4102035740f205e84ca3e9491abd
Instruction Fuzzy Hash: B7417B749042098FDB04CF69C08069EBBF2FF98324F158269E815AB381DB75EC42CFA0

Function 609292DA Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 60929311
sqlite3_value_text.SQLITE3 ref: 60929358
sqlite3_value_bytes.SQLITE3 ref: 60929364
sqlite3_malloc.SQLITE3 ref: 60929374

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_mallocsqlite3_value_bytessqlite3_value_text
String ID:
API String ID: 1648232842-0
Opcode ID: 6f401334500cf3ce8937f97dce09bc9131fc1f686c7391f4db805f1c2cabf22c
Instruction ID: a01add595a6c287de5924383f0ed77e5cc34082cd65fcd393cbe5beac3228527
Opcode Fuzzy Hash: 6f401334500cf3ce8937f97dce09bc9131fc1f686c7391f4db805f1c2cabf22c
Instruction Fuzzy Hash: 4531C0B4A042058FDB04DF29C094B5ABBE2FF98354F1484A9EC498F349D779E846CBA0

Function 6091B8A2 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

sqlite3_value_blob.SQLITE3 ref: 6091B8B9
sqlite3_snprintf.SQLITE3 ref: 6091B902
sqlite3_result_text.SQLITE3 ref: 6091B99A

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_result_textsqlite3_snprintfsqlite3_value_blob
String ID:
API String ID: 3020506458-0
Opcode ID: a061760bccdcc5ee377f69cfb9053f3ef30041d9a69f1f6df420abce8e2a1161
Instruction ID: 3699dfc10e09231e02f70cd15f5876ce020411a3ceaa937295c2f1b175ba3545
Opcode Fuzzy Hash: a061760bccdcc5ee377f69cfb9053f3ef30041d9a69f1f6df420abce8e2a1161
Instruction Fuzzy Hash: 9A3106B1A083099FDB00DF69C48168EBBF2BFA9324F10896DE4A997350D734D841CF52

Function 60961492 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

sqlite3_step.SQLITE3 ref: 609614AB
sqlite3_reset.SQLITE3 ref: 609614BF

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

sqlite3_column_int64.SQLITE3 ref: 609614D4

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_column_int64sqlite3_mutex_entersqlite3_mutex_leavesqlite3_resetsqlite3_step
String ID:
API String ID: 3429445273-0
Opcode ID: 44b7ea0f60ccad0bdb665534712f35195a3185c30aa33eaed9220a178cd48643
Instruction ID: 62863439de2fabb71fd3664abc4fbfc11ff04353a6e6e3e42574d1c19fb7889d
Opcode Fuzzy Hash: 44b7ea0f60ccad0bdb665534712f35195a3185c30aa33eaed9220a178cd48643
Instruction Fuzzy Hash: AE316470A183408BEF15CF69C1C5749FBA6AFA7348F188599DC864F30AD375D884C752

Function 6093A57B Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6093A58F
sqlite3_stricmp.SQLITE3 ref: 6093A5C6
sqlite3_snprintf.SQLITE3 ref: 6093A60B
sqlite3_snprintf.SQLITE3 ref: 6093A631

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_stricmpsqlite3_value_text
String ID:
API String ID: 1035992805-0
Opcode ID: 213593095aed0ecc64844f89ed1f3878beaaf7633e295caa013ed5846923251b
Instruction ID: 84d28b158f1a11e063f70be148de9c7b2eff514b3bcf7808f17aa895500be78a
Opcode Fuzzy Hash: 213593095aed0ecc64844f89ed1f3878beaaf7633e295caa013ed5846923251b
Instruction Fuzzy Hash: 8C3178B0A08324DFEB24CF28C481B4ABBF6FBA5318F04C499E4888B251C775D885DF42

Function 6091B9A7 Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_win32_mbcs_to_utf8.SQLITE3 ref: 6091BA73
sqlite3_snprintf.SQLITE3 ref: 6091BA9F
sqlite3_free.SQLITE3 ref: 6091BAA7
sqlite3_snprintf.SQLITE3 ref: 6091BACD

Part of subcall function 6090AFF5: sqlite3_free.SQLITE3 ref: 6090B09A

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_snprintf$sqlite3_win32_mbcs_to_utf8
String ID:
API String ID: 3650497268-0
Opcode ID: c56e1887777235a87b3b81818d88f3c03774c2a2e94957963948397bf0aefdc4
Instruction ID: 88a442c9769e64811666b67fab91393c2e05f7ab825d2ee78241f143d938fda4
Opcode Fuzzy Hash: c56e1887777235a87b3b81818d88f3c03774c2a2e94957963948397bf0aefdc4
Instruction Fuzzy Hash: D131D4B09083059BEB00EF69C58579EFFF6BFA4748F00886DE49997250E7B8C5448B92

Function 0055E73B Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0054EBAD,005E7890,0000000C), ref: 0055E740
_free.LIBCMT ref: 0055E79D
_free.LIBCMT ref: 0055E7D3
SetLastError.KERNEL32(00000000,00000007,000000FF,?,?,0054EBAD,005E7890,0000000C), ref: 0055E7DE

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: cce88cc401fa2d46800ec2770214fd790217e9d1f6e9373b969d9f3ba6c2e792
Instruction ID: 19b789b4ce81e50c31c3476307befae6f4cde3e926227188d9176d393af719a5
Opcode Fuzzy Hash: cce88cc401fa2d46800ec2770214fd790217e9d1f6e9373b969d9f3ba6c2e792
Instruction Fuzzy Hash: 0F113A762242C66AD61837749DEBD2E2D0BFBC53777200636FE248A1E1EE214E0D5210

Function 0055E892 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0054E9A7,0055E0C7,?,?,00559E30), ref: 0055E897
_free.LIBCMT ref: 0055E8F4
_free.LIBCMT ref: 0055E92A
SetLastError.KERNEL32(00000000,00000007,000000FF,?,?,0054E9A7,0055E0C7,?,?,00559E30), ref: 0055E935

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 56e699576d641c6f10dff72fb541c16dbaf28ea830781e682b7e2d2304f31d73
Instruction ID: 7486b741044cedc08fce2103309015e08e06a08fe86d136fec795227e6f12895
Opcode Fuzzy Hash: 56e699576d641c6f10dff72fb541c16dbaf28ea830781e682b7e2d2304f31d73
Instruction Fuzzy Hash: 82114C722042466AD71827745CEBD2F2E5BBBC1777B200637FD348A2E6EE218D0D9210

Function 609034B2 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3(-00000200,?,?,6090B22B), ref: 609034D8
sqlite3_mutex_leave.SQLITE3(-00000200,?,?,6090B22B), ref: 60903521
sqlite3_mutex_enter.SQLITE3(-00000200,?,?,6090B22B), ref: 6090354A
sqlite3_mutex_leave.SQLITE3(-00000200,?,?,6090B22B), ref: 60903563

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: cc0b0c4414a91b2c8747a1fff16426ed14613a144e31e5ae299e51467139190c
Instruction ID: 848dca46e936c6e01d33e08870ae11aa620bd8b24bdb606da7ea596206f2e213
Opcode Fuzzy Hash: cc0b0c4414a91b2c8747a1fff16426ed14613a144e31e5ae299e51467139190c
Instruction Fuzzy Hash: 44111F726186218FDB00EF7DC8817597FEAFB66308F00842DE865E7362E779D8819741

Function 60916F2E Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 60916F3A

Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1

sqlite3_mutex_enter.SQLITE3 ref: 60916F54
sqlite3_realloc.SQLITE3 ref: 60916F83
sqlite3_mutex_leave.SQLITE3 ref: 60916FAB

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_enter$sqlite3_initializesqlite3_mutex_leavesqlite3_realloc
String ID:
API String ID: 1115209729-0
Opcode ID: 6333fd2be36cfa00eef78f4f3b314f62df22bc03826ab8cb307c02da7fc89b69
Instruction ID: 3d5f3e78c94f4068b4ec4adf7bb8587320b7e13a1a65577ceb0f2260a1c213fd
Opcode Fuzzy Hash: 6333fd2be36cfa00eef78f4f3b314f62df22bc03826ab8cb307c02da7fc89b69
Instruction Fuzzy Hash: 4B019A71B0C2198BCB00AF28A8456197FEBEBEA358F4044A9E854C7351E736D8C2D780

Function 6092A43E Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6092A450

Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1

sqlite3_mutex_enter.SQLITE3 ref: 6092A466
sqlite3_mutex_leave.SQLITE3 ref: 6092A47F
sqlite3_memory_used.SQLITE3 ref: 6092A4BA

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_enter$sqlite3_initializesqlite3_memory_usedsqlite3_mutex_leave
String ID:
API String ID: 2673540737-0
Opcode ID: 58333c90df1895ca2798dafcbab41657529afc007f85020e925d8580cfdcdfcb
Instruction ID: c4988029ba64cfb2248a7cf0c790324acf4c13eb0f9cd3f15fdedc175ef3c91a
Opcode Fuzzy Hash: 58333c90df1895ca2798dafcbab41657529afc007f85020e925d8580cfdcdfcb
Instruction Fuzzy Hash: F9019276E143148BCB00EF79D88561ABFE7FBA5324F008528EC9497364E735DC408B81

Function 6092A3C4 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6092A3D8
sqlite3_value_text.SQLITE3 ref: 6092A3FA
sqlite3_load_extension.SQLITE3 ref: 6092A418
sqlite3_free.SQLITE3 ref: 6092A431

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_freesqlite3_load_extension
String ID:
API String ID: 3526213481-0
Opcode ID: e69664dddad2286ff6ed0cb1f1c7a121e5262b7aa8061cf10291ac83704fea4b
Instruction ID: 98199466554994e62e20ad809be6129e3c08b78dd6d8c38fc18f61524e73aad2
Opcode Fuzzy Hash: e69664dddad2286ff6ed0cb1f1c7a121e5262b7aa8061cf10291ac83704fea4b
Instruction Fuzzy Hash: 4101E9B5A043059BCB00EF69D485AAFBBF5EF68654F10C529EC9497304E774D841CF91

Function 609298BB Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

sqlite3_vmprintf.SQLITE3 ref: 609298DC

Part of subcall function 60929643: sqlite3_initialize.SQLITE3 ref: 6092964D

sqlite3_mprintf.SQLITE3 ref: 609298FC

Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA

sqlite3_free.SQLITE3 ref: 60929907

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 60929922

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_vmprintf$sqlite3_mprintfsqlite3_mutex_enter
String ID:
API String ID: 2126213637-0
Opcode ID: 9cd505cc25204affe1a8d25f1b99f2f22cb65db7dde897ba5d76927de8a4b480
Instruction ID: 13efba25bfc7911c5b295ff1541eb6c31128a22c7405fe94ccab49b9f850283e
Opcode Fuzzy Hash: 9cd505cc25204affe1a8d25f1b99f2f22cb65db7dde897ba5d76927de8a4b480
Instruction Fuzzy Hash: E5012CB4A143069FDB109F69D48164ABBF9FF68768F10442DE8D8C7304E774D980CB52

Function 609258A8 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6092506E: sqlite3_log.SQLITE3 ref: 609250AB

sqlite3_log.SQLITE3 ref: 609258E5
sqlite3_mutex_enter.SQLITE3 ref: 609258FF
sqlite3_value_text.SQLITE3 ref: 60925918
sqlite3_mutex_leave.SQLITE3 ref: 60925932

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_log$sqlite3_mutex_entersqlite3_mutex_leavesqlite3_value_text
String ID:
API String ID: 645246966-0
Opcode ID: 003c7d729514850cd2670d5ff0a501923a7c05c01e7ee08f7af9080d29ed2bfd
Instruction ID: 8b3d20099653fcf7515df79f2a12a915b58be957357f5192ef5f37aead3f1b7c
Opcode Fuzzy Hash: 003c7d729514850cd2670d5ff0a501923a7c05c01e7ee08f7af9080d29ed2bfd
Instruction Fuzzy Hash: A3015274A18344CBDB149F69E4C13097BE6EF65358F049869EC898F309E774D8C0CB41

Function 60969133 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

sqlite3_prepare.SQLITE3 ref: 60969166
sqlite3_errmsg.SQLITE3 ref: 60969172

Part of subcall function 609258A8: sqlite3_log.SQLITE3 ref: 609258E5

sqlite3_errcode.SQLITE3 ref: 6096918A

Part of subcall function 609251AA: sqlite3_log.SQLITE3 ref: 609251E8

sqlite3_step.SQLITE3 ref: 60969197

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_log$sqlite3_errcodesqlite3_errmsgsqlite3_preparesqlite3_step
String ID:
API String ID: 2877408194-0
Opcode ID: 06185e76a961c89383dca1620ea17d5683e825aa4cba78efc797247d66345ea8
Instruction ID: d4ebd4c9a05a553e526e78eaaf80584f3afcfe73b3175c4c6dada352db343273
Opcode Fuzzy Hash: 06185e76a961c89383dca1620ea17d5683e825aa4cba78efc797247d66345ea8
Instruction Fuzzy Hash: 9F0186B091C3059BE700EF29C88525DFBE9EFA5314F11892DA89987384E734C940CB86

Function 609296D1 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

sqlite3_value_bytes.SQLITE3 ref: 609296F3
sqlite3_mprintf.SQLITE3 ref: 60929708
sqlite3_free.SQLITE3 ref: 6092971B
sqlite3_value_blob.SQLITE3 ref: 6092972A

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_value_blobsqlite3_value_bytes
String ID:
API String ID: 1163609955-0
Opcode ID: c446836a4840d302dbdc97fcf3f25a19881b43244be54ce00609cbc101420811
Instruction ID: 8e0d1a1b7fe9adeaf330fda5a565ce202833de3a42fcd494fa905fee92021967
Opcode Fuzzy Hash: c446836a4840d302dbdc97fcf3f25a19881b43244be54ce00609cbc101420811
Instruction Fuzzy Hash: F6F0C8716282145FC3106F3994816697BE6DFA6758F0144A9F584CB314DB75CC82C742

Function 60961580 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

sqlite3_prepare_v2.SQLITE3 ref: 609615BA
sqlite3_step.SQLITE3 ref: 609615C9
sqlite3_column_int.SQLITE3 ref: 609615E1

Part of subcall function 6091D4F4: sqlite3_value_int.SQLITE3 ref: 6091D50C

sqlite3_finalize.SQLITE3 ref: 609615EE

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_column_intsqlite3_finalizesqlite3_prepare_v2sqlite3_stepsqlite3_value_int
String ID:
API String ID: 4265739436-0
Opcode ID: edb1a347b7ee41d63e69a54b369763b34702b79c0c254a7699785c0090147395
Instruction ID: 970f7a8085286b868af170b9ae73916577c28f03d50975cfa6e3c5bd991c66ad
Opcode Fuzzy Hash: edb1a347b7ee41d63e69a54b369763b34702b79c0c254a7699785c0090147395
Instruction Fuzzy Hash: BE01E4B0D083049BEB10EF69C58575EFBF9EFA5314F00896DE8A997380E775D9408B82

Function 6092A62C Relevance: 6.0, APIs: 4, Instructions: 38stringCOMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6092A638

Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1

sqlite3_mutex_enter.SQLITE3 ref: 6092A64F
strcmp.MSVCRT ref: 6092A66A
sqlite3_mutex_leave.SQLITE3 ref: 6092A67D

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_enter$sqlite3_initializesqlite3_mutex_leavestrcmp
String ID:
API String ID: 1894734062-0
Opcode ID: 1480f87154849f1cdf239baa72c9ff1b5e3c835899009c68b4affe8256d9fce5
Instruction ID: 0dacd04717b96a229033e5bf385d74358d6efc238696297f04088f4a0acd15ee
Opcode Fuzzy Hash: 1480f87154849f1cdf239baa72c9ff1b5e3c835899009c68b4affe8256d9fce5
Instruction Fuzzy Hash: EBF0B4726243044BC7006F799CC164A7FAEEEB1298B05802CEC548B319EB35DC0297A1

Function 609084D1 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 609084E9
sqlite3_mutex_leave.SQLITE3 ref: 60908518
sqlite3_mutex_enter.SQLITE3 ref: 60908528
sqlite3_mutex_leave.SQLITE3 ref: 6090855B

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: dbb0a767127359d75753d9f151f7b9e03affe710ab86404e29d94d971225fba8
Instruction ID: c41a4d3f3efa942db11cbd34a9101edfe28f26dd6f673ba1da0d5803e4a0adbd
Opcode Fuzzy Hash: dbb0a767127359d75753d9f151f7b9e03affe710ab86404e29d94d971225fba8
Instruction Fuzzy Hash: FD01A4B05093048BDB40AF25C5D97CABBA5EF15718F0884BDEC894F34AD7B9D5448BA1

Function 0056D165 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,?,00000000,00000000,?,0056BDF0,00000000,00000001,00000000,?,?,00560F46,00000000,00000020,?), ref: 0056D17C
GetLastError.KERNEL32(?,0056BDF0,00000000,00000001,00000000,?,?,00560F46,00000000,00000020,?,00000000,?,?,0056149A,00000000), ref: 0056D188

Part of subcall function 0056D14E: CloseHandle.KERNEL32(FFFFFFFE,0056D198,?,0056BDF0,00000000,00000001,00000000,?,?,00560F46,00000000,00000020,?,00000000,?), ref: 0056D15E

___initconout.LIBCMT ref: 0056D198

Part of subcall function 0056D110: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0056D13F,0056BDDD,?,?,00560F46,00000000,00000020,?,00000000), ref: 0056D123

WriteConsoleW.KERNEL32(00000000,?,?,00000000,?,0056BDF0,00000000,00000001,00000000,?,?,00560F46,00000000,00000020,?,00000000), ref: 0056D1AD

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: c30adda769a8d1b1b40c8f93f0f63f46683633f0b778d20dffbfd04eae379c08
Instruction ID: 173aa44333f3fec179bc2a776c2cb90d200b72771ffb24651791dc1551286c86
Opcode Fuzzy Hash: c30adda769a8d1b1b40c8f93f0f63f46683633f0b778d20dffbfd04eae379c08
Instruction Fuzzy Hash: 4BF03036901165BFDF221F95EC099993F36FF9A3A1B414824FA18C6131CA728960FBA0

Function 60941B7F Relevance: 6.0, APIs: 4, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 60941B60: sqlite3_blob_close.SQLITE3 ref: 60941B6E

Part of subcall function 6094092D: sqlite3_free.SQLITE3 ref: 60940952
Part of subcall function 6094092D: sqlite3_free.SQLITE3 ref: 6094095D

sqlite3_free.SQLITE3 ref: 60941BA6

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 60941BB1
sqlite3_free.SQLITE3 ref: 60941BBC
sqlite3_free.SQLITE3 ref: 60941BC4

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_blob_closesqlite3_mutex_enter
String ID:
API String ID: 1319845086-0
Opcode ID: 2f595e198f8f19ed35dba4809c81e125244c5bb4d03a5d4affec8e75baeb0482
Instruction ID: 4f7b0afd974331010789e6c7bb3588262b4961d1609b9fbe8ae7e5252045d3bc
Opcode Fuzzy Hash: 2f595e198f8f19ed35dba4809c81e125244c5bb4d03a5d4affec8e75baeb0482
Instruction Fuzzy Hash: 4FF039745106048BDB40FF78C4C2A08B7E5AF75B18F0988ACECC68B306E734E840CB12

Function 60940894 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 609408BE
sqlite3_blob_close.SQLITE3 ref: 609408C9

Part of subcall function 60940849: sqlite3_mutex_enter.SQLITE3 ref: 60940864
Part of subcall function 60940849: sqlite3_finalize.SQLITE3 ref: 6094086F
Part of subcall function 60940849: sqlite3_mutex_leave.SQLITE3 ref: 60940885

sqlite3_free.SQLITE3 ref: 609408AD

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 609408D1

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_enter$sqlite3_blob_closesqlite3_finalizesqlite3_mutex_leave
String ID:
API String ID: 3376080156-0
Opcode ID: 62bba8bded67edb3e7ec5b4190a567f2186f1725189168df9a038347470dbc26
Instruction ID: d915195a03e04bddfc3f3f5b3271b7f2e0ed873b55f11ac5d14163ef78522696
Opcode Fuzzy Hash: 62bba8bded67edb3e7ec5b4190a567f2186f1725189168df9a038347470dbc26
Instruction Fuzzy Hash: F5E039B09087008FDB10AF79C5C57057BE9AB74318F4618ACE8C28B346E735D8C0CB92

Function 60912859 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 60912860

Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1

sqlite3_mutex_enter.SQLITE3 ref: 60912875
sqlite3_free.SQLITE3 ref: 60912882

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_mutex_leave.SQLITE3 ref: 6091289E

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_mutex_enter$sqlite3_freesqlite3_initializesqlite3_mutex_leave
String ID:
API String ID: 1885817404-0
Opcode ID: 32192f4b060c8cdb535655f6391389faadb47ee6b1d02519a96caad349a8157d
Instruction ID: 0031950edb5a23f76dff6891bd2f60160eb1379e28a878b23d24a528d81ad699
Opcode Fuzzy Hash: 32192f4b060c8cdb535655f6391389faadb47ee6b1d02519a96caad349a8157d
Instruction Fuzzy Hash: E6E048F151C3144BD7007F7484867057EE65B7274CF05046CD48247251E776D4C05751

Function 6093E8DE Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 413COMMON

Download Yara Rule

APIs

sqlite3_randomness.SQLITE3 ref: 6093E9A3
sqlite3_randomness.SQLITE3 ref: 6093EAC1

Strings

, xrefs: 6093EC56

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_randomness
String ID:
API String ID: 2799796375-3916222277
Opcode ID: 229229ae701aea0a2e5856c37940d2b5861fd8a773e90e62e8eee996633a259a
Instruction ID: 3887470c8237d86ac67bd2190f6f3690fc73287e72b0d230b9f4df168a81262f
Opcode Fuzzy Hash: 229229ae701aea0a2e5856c37940d2b5861fd8a773e90e62e8eee996633a259a
Instruction Fuzzy Hash: 8712D674A046288BDB24CF69C88079DBBF6BF98314F20856DD499A7391EB34ED85CF41

Function 0055C986 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

Strings

PB, xrefs: 0055CAFE, 0055CB2E

Memory Dump Source

Source File: 00000008.00000002.1490512728.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000008.00000002.1490512728.0000000000600000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_400000_AviDVDCopy.jbxd

Similarity

API ID:
String ID: PB
API String ID: 0-3196168531
Opcode ID: d12983d1465fd5de07cf8e20cda362b342899f474df2f4efc9143ab4b1ee3464
Instruction ID: ed144a99a1b4d1b0c39b0ec84ef84b467cd77e7dca2056cbe3f99f2b5727818e
Opcode Fuzzy Hash: d12983d1465fd5de07cf8e20cda362b342899f474df2f4efc9143ab4b1ee3464
Instruction Fuzzy Hash: B7A1E432E003158FDF25DBA8D8AA6ACBFB1BB55322F14412BEC55AB251D7309C4CCB51

Function 609481BF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

into, xrefs: 60948285
out of, xrefs: 60948277

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_log
String ID: into$out of
API String ID: 632333372-1114767565
Opcode ID: 05e60a680804dc8d75cc30d301a58b6784d3cbcabfb13c7dcba40214300a3b29
Instruction ID: de20b162988cb891a2f8fbcf22309076e3e21d241eadb06c465d82de9f0e8d92
Opcode Fuzzy Hash: 05e60a680804dc8d75cc30d301a58b6784d3cbcabfb13c7dcba40214300a3b29
Instruction Fuzzy Hash: 91910170A043149BDB26CF28C88175EBBBABF65308F0481E9E858AB355D7B5DE85CF41

Function 60945DD4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 6093B0EB: sqlite3_log.SQLITE3 ref: 6093B159

sqlite3_log.SQLITE3 ref: 609498F5

Strings

string or blob too big, xrefs: 60949978
|, xrefs: 609499CF

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_log
String ID: string or blob too big$|
API String ID: 632333372-330586046
Opcode ID: 5752d088b0b22263014ed0ba6ce685e28157b6e9816899db7507f99f97749652
Instruction ID: 3b9f3a35a8f29d6c1851862f8623471688e14d0564ae385a38afaea90b61ba48
Opcode Fuzzy Hash: 5752d088b0b22263014ed0ba6ce685e28157b6e9816899db7507f99f97749652
Instruction Fuzzy Hash: 0281D770A08218DBCB26CF28C581759BBF6BF59308F1085D9E8989B351D775EE81CF41

Function 6095CCF6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 157COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 6095CE18

Strings

INTEGER, xrefs: 6095CE0A

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: INTEGER
API String ID: 912767213-1699370257
Opcode ID: 5265685fbc9a2947adb89e43721e532de8525196ecb8014c9f151128e560c37a
Instruction ID: 665eb2c443cd814dbc75377013e8608e0c1ff525a9f3f547a50761c55c0ec8a2
Opcode Fuzzy Hash: 5265685fbc9a2947adb89e43721e532de8525196ecb8014c9f151128e560c37a
Instruction Fuzzy Hash: 536188B0A086059FCB06CF6AC09179DBFF2BF99314F14892DE859AB341C774E859CB91

Function 60919123 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 60918408: sqlite3_value_text.SQLITE3 ref: 60918426

sqlite3_free.SQLITE3 ref: 609193A3

Strings

(NULL), xrefs: 60919157
NULL, xrefs: 60919165

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_freesqlite3_value_text
String ID: (NULL)$NULL
API String ID: 2175239460-873412390
Opcode ID: 2d639d8f8789be8f4f2115c7e339461789bfa1512606a4b94e85873a15b94a2d
Instruction ID: 63658e955800b40111a930d2026d12727b3b294c4be858d68b3f7c51d7abf176
Opcode Fuzzy Hash: 2d639d8f8789be8f4f2115c7e339461789bfa1512606a4b94e85873a15b94a2d
Instruction Fuzzy Hash: E3514B31F0825A8EEB258A68C89479DBBB6BF66304F1441E9C4A9AB241D7309DC6CF01

Function 6094945C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

-- , xrefs: 60949549
d, xrefs: 609494E6

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_log
String ID: -- $d
API String ID: 632333372-777087308
Opcode ID: 2197877c990d2cc598be623123ad695ba2ed3a88a0fc98749b4c643aad0a3996
Instruction ID: d45f625f7ed72e8bd0cbe86fb5af212c953cff4c7e5ffbb26f6c4a79540968e1
Opcode Fuzzy Hash: 2197877c990d2cc598be623123ad695ba2ed3a88a0fc98749b4c643aad0a3996
Instruction Fuzzy Hash: FB51F674A043689BDB26CF28C980789BBFABF55304F1481D9E89CAB341C7759E85CF40

Function 60942334 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

string or blob too big, xrefs: 60949978
|, xrefs: 609499CF

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_log
String ID: string or blob too big$|
API String ID: 632333372-330586046
Opcode ID: b6301cf988e6664baaa8b4960c9a349f418ad1f33ca54faa928bbeacb0d503e6
Instruction ID: 65a9847582dc10a4f4f17f1c4fc8d82f10366072c52f03016cacc5a11d353e3e
Opcode Fuzzy Hash: b6301cf988e6664baaa8b4960c9a349f418ad1f33ca54faa928bbeacb0d503e6
Instruction Fuzzy Hash: 4D51B9749083689BCB22CF28C985789BBF6BF59314F1086D9E49897351C775EE81CF41

Function 609489F4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8

sqlite3_log.SQLITE3 ref: 60948A75
sqlite3_log.SQLITE3 ref: 609498F5

Strings

e, xrefs: 60948AF5

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_log$sqlite3_mutex_try
String ID: e
API String ID: 3410241545-4024072794
Opcode ID: 7dcf5a6b3958a549e9bb5692158348cf9fc1bd72a1347b550585d41db7032f74
Instruction ID: 71c2a218443f6d5c931cf56e88fc4e10389c515cef33b8fa4308656cc5954750
Opcode Fuzzy Hash: 7dcf5a6b3958a549e9bb5692158348cf9fc1bd72a1347b550585d41db7032f74
Instruction Fuzzy Hash: E551E870A042249FDB25CF28C881759B7F6BF65308F0585DAE858AB315D775EE81CF41

Function 609426B3 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

d, xrefs: 60942791
|, xrefs: 609499CF

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_log
String ID: d$|
API String ID: 632333372-415524447
Opcode ID: b41da94c8e0873fb31ce46b9bf1ec845f2d469f37e36bd2a55cc8f8885e561b5
Instruction ID: dac03e427e93f591f5d1737f90c886445feec93ea56e6f6f32424ebbe55d5cce
Opcode Fuzzy Hash: b41da94c8e0873fb31ce46b9bf1ec845f2d469f37e36bd2a55cc8f8885e561b5
Instruction Fuzzy Hash: 50510970A04329DBDB26CF19C981799BBBABF55308F0481D9E958AB341D735EE81CF41

Function 60925A17 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 60925AE9

Part of subcall function 60911D8D: sqlite3_win32_sleep.SQLITE3 ref: 60911DC5

sqlite3_free.SQLITE3 ref: 60925AB1

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

Part of subcall function 6092597A: sqlite3_log.SQLITE3 ref: 60925A05

Strings

winAccess, xrefs: 60925AC4

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_free$sqlite3_logsqlite3_mutex_entersqlite3_win32_sleep
String ID: winAccess
API String ID: 3558905852-3605117275
Opcode ID: 0cd4045c2cd25fc7e90da7a6a4f1a30eaec4c7ec0ca4266f634ae369b07819e7
Instruction ID: efd05d01cc6547022c3419edb4230398e12592c2b7e177808fd5082ec9b518fe
Opcode Fuzzy Hash: 0cd4045c2cd25fc7e90da7a6a4f1a30eaec4c7ec0ca4266f634ae369b07819e7
Instruction Fuzzy Hash: B431B231924209CFDB109F68E88539EBBF7BF65324F108629E8619729CD778CD45CB91

Function 609480BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 609480E2
sqlite3_log.SQLITE3 ref: 609498F5

Strings

string or blob too big, xrefs: 60949978

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_logsqlite3_value_text
String ID: string or blob too big
API String ID: 2320820228-2803948771
Opcode ID: 4552165c49a92a3f1eebbde7746405f837ee0ef0562a3825501d2540ddfe4a5c
Instruction ID: 1f8da1134a73d261049fdcd83983d84c916c8a3f87851362e697cdb17b1d2bab
Opcode Fuzzy Hash: 4552165c49a92a3f1eebbde7746405f837ee0ef0562a3825501d2540ddfe4a5c
Instruction Fuzzy Hash: F631D9B0A083249BCB25DF28C881799B7FABF69304F0085DAE898A7301D775DE81CF45

Function 6091407D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 60914096
sqlite3_value_numeric_type.SQLITE3 ref: 609140A2

Strings

, xrefs: 60914088

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_aggregate_contextsqlite3_value_numeric_type
String ID:
API String ID: 3265351223-3916222277
Opcode ID: 46809e466d9dc696839b8d734d1d71a7cd961db8d22299a3a9f395bc6b436a6c
Instruction ID: a3c0f903ff645dd1c5a8146eaa2078e963ad6c1b8d1bbf61d5d4caeb1888773d
Opcode Fuzzy Hash: 46809e466d9dc696839b8d734d1d71a7cd961db8d22299a3a9f395bc6b436a6c
Instruction Fuzzy Hash: 19119EB0A0C6589BDF059F69C4D539A7BF6AF39308F0044E8D8D08B205E771CD94CB81

Function 60956040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 60956065
sqlite3_stricmp.SQLITE3 ref: 6095607E

Strings

log, xrefs: 609560C0

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: log
API String ID: 912767213-2403297477
Opcode ID: 32625358f7d37366d1c1d188942de81712d107425b8b720a67b4b84d1adec0cd
Instruction ID: cbf508da25866b0a35bc2ca480d64d7c482f0664b0359b741109bd545b4f9ff5
Opcode Fuzzy Hash: 32625358f7d37366d1c1d188942de81712d107425b8b720a67b4b84d1adec0cd
Instruction Fuzzy Hash: FD11DAB07087048BE725AF66C49535EBBB3ABA1708F10C42CE4854B784C7BAC986DB42

Function 60913FFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 60914015
sqlite3_result_double.SQLITE3 ref: 60914054

Strings

integer overflow, xrefs: 60914032

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_aggregate_contextsqlite3_result_double
String ID: integer overflow
API String ID: 1477370529-1678498654
Opcode ID: c7281fa809861a39fd46e33a454918aa15d65609b79dc8489bcc11e3562a646e
Instruction ID: 65d2a7070e7fb3c81494ecd4d596988a961629944dde0676b842973e9f1d393d
Opcode Fuzzy Hash: c7281fa809861a39fd46e33a454918aa15d65609b79dc8489bcc11e3562a646e
Instruction Fuzzy Hash: 8C01DEB16083489BDB005F19C8897867BEAEF6832CF0540EAD9800F266D776D8C4CB92

Function 60902148 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3 ref: 60902167
sqlite3_strnicmp.SQLITE3 ref: 60902193

Strings

SQLITE_, xrefs: 6090215C

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_strnicmp
String ID: SQLITE_
API String ID: 1961171630-787686576
Opcode ID: 6b56a851e7df47422a7a29131339b4dfcb3302745a705f9abe90012807219487
Instruction ID: 6d5ef3c0fd507030b5e8170497320435726bf3f0db30f2d6f2734bcd7f756fb3
Opcode Fuzzy Hash: 6b56a851e7df47422a7a29131339b4dfcb3302745a705f9abe90012807219487
Instruction Fuzzy Hash: 2501D6B190C3505FD7419F29CC8075BBFFAEBA5258F10486DE89687212D374DC81D781

Function 6091A1B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

sqlite3_value_bytes.SQLITE3 ref: 6091A1DB
sqlite3_value_blob.SQLITE3 ref: 6091A1FA

Strings

Invalid argument to rtreedepth(), xrefs: 6091A1E3

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_value_blobsqlite3_value_bytes
String ID: Invalid argument to rtreedepth()
API String ID: 1063208240-2843521569
Opcode ID: 11a8b631faa983fdd1b04a57150add771201859657fb9a8a7ca9793758d49f10
Instruction ID: c9489564a96cd83e586e3a08c251b8a8c74d553169181c25a19da25ffef599d7
Opcode Fuzzy Hash: 11a8b631faa983fdd1b04a57150add771201859657fb9a8a7ca9793758d49f10
Instruction Fuzzy Hash: 0FF0A4B2A0C2589BDB00AF2CC88255577A6FF24258F1045D9E9858F306EB34DDD5C7D1

Function 609561A9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_soft_heap_limit64.SQLITE3 ref: 609561D7

Part of subcall function 6092A43E: sqlite3_initialize.SQLITE3 ref: 6092A450
Part of subcall function 6092A43E: sqlite3_mutex_enter.SQLITE3 ref: 6092A466
Part of subcall function 6092A43E: sqlite3_mutex_leave.SQLITE3 ref: 6092A47F
Part of subcall function 6092A43E: sqlite3_memory_used.SQLITE3 ref: 6092A4BA

sqlite3_soft_heap_limit64.SQLITE3 ref: 609561EB

Strings

soft_heap_limit, xrefs: 609561F7

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_soft_heap_limit64$sqlite3_initializesqlite3_memory_usedsqlite3_mutex_entersqlite3_mutex_leave
String ID: soft_heap_limit
API String ID: 1251656441-405162809
Opcode ID: 0a3178e3d5348c0d1dba646aca47308acc52713326f376e4eba91e5107f5ba07
Instruction ID: 8891d4bbc0f5aef5547f00e3070395c34840fc2012d087b050684f6162b0ba7d
Opcode Fuzzy Hash: 0a3178e3d5348c0d1dba646aca47308acc52713326f376e4eba91e5107f5ba07
Instruction Fuzzy Hash: C2014B71A083188BC710EF98D8417ADB7F2BFA5318F508629E8A49B394D730DC42CF41

Function 60925208 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6094A57F), ref: 6092522A
sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6094A57F), ref: 60925263

Strings

NULL, xrefs: 60925213

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: sqlite3_log
String ID: NULL
API String ID: 632333372-324932091
Opcode ID: f56f6a0e8a895df1b0101c46b9851dc3af9ce5b0d95800d46be4b721d61d1ab1
Instruction ID: 5a36de60e8574ea04015b231464f09686a41744340efbe7a8a869d8181b3dc96
Opcode Fuzzy Hash: f56f6a0e8a895df1b0101c46b9851dc3af9ce5b0d95800d46be4b721d61d1ab1
Instruction Fuzzy Hash: BAF0A070238301DBD7102FA6E44230E7AEBABB0798F48C43C95A84F289D7B5C844CB63

Function 6096D5A0 Relevance: 5.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6096D5C3
free.MSVCRT ref: 6096D609
LeaveCriticalSection.KERNEL32 ref: 6096D615

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 13d179c58506242de641c1793229aaf6d73ae3266bd26a3d41fb94aeb54caf06
Instruction ID: 980a39aab3b848caec2c27f45d5308e77b440585e3cd6ccd446b63c63d51e1b6
Opcode Fuzzy Hash: 13d179c58506242de641c1793229aaf6d73ae3266bd26a3d41fb94aeb54caf06
Instruction Fuzzy Hash: 2D018070B293058BDB10DF28C985919BBFBABB6308B20855CE499D7355D770DC80EB62

Function 6096D4C0 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4DF
TlsGetValue.KERNEL32(?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4F5
GetLastError.KERNEL32(?,?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4FD
LeaveCriticalSection.KERNEL32(?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D520

Memory Dump Source

Source File: 00000008.00000002.1492369468.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000008.00000002.1492347873.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492421485.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492440681.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492463137.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492485921.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000008.00000002.1492504991.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_60900000_AviDVDCopy.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 79e4c3a08b5363d98cc33068bb7bbdcd271105d9d9d9c252471cf05fac27a945
Instruction ID: 6dd43474153c21470d2d90641e64b96ed0da30414b2d41baa8b5e8831fa3fcb2
Opcode Fuzzy Hash: 79e4c3a08b5363d98cc33068bb7bbdcd271105d9d9d9c252471cf05fac27a945
Instruction Fuzzy Hash: 9AF0F972A163104BEB10AF659CC1A5A7BFDEFB1218F100048FC6197354E770DC40D6A2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report NkMMNoILv9.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\YCI Copy\ASPI.DLL (copy)

C:\Program Files (x86)\YCI Copy\AviDVDCopy.exe (copy)

C:\Program Files (x86)\YCI Copy\Core.dll (copy)

C:\Program Files (x86)\YCI Copy\DVD2one.DLL (copy)

C:\Program Files (x86)\YCI Copy\DVDCopy.dll (copy)

C:\Program Files (x86)\YCI Copy\FileIO.DLL (copy)

C:\Program Files (x86)\YCI Copy\Help\WinAVI DVD Copy help.chm (copy)

C:\Program Files (x86)\YCI Copy\Help\is-KSBU7.tmp

C:\Program Files (x86)\YCI Copy\Language\English.ini (copy)

C:\Program Files (x86)\YCI Copy\Language\is-T33OF.tmp

C:\Program Files (x86)\YCI Copy\MPEG2VideoTranslator.DLL (copy)

C:\Program Files (x86)\YCI Copy\Skins\0\CopyNow.bmp (copy)

C:\Program Files (x86)\YCI Copy\Skins\0\Down.bmp (copy)

C:\Program Files (x86)\YCI Copy\Skins\0\Setting.bmp (copy)

C:\Program Files (x86)\YCI Copy\Skins\0\Splash.bmp (copy)

C:\Program Files (x86)\YCI Copy\Skins\0\Web.bmp (copy)

C:\Program Files (x86)\YCI Copy\Skins\0\animation.gif (copy)

C:\Program Files (x86)\YCI Copy\Skins\0\background.bmp (copy)

C:\Program Files (x86)\YCI Copy\Skins\0\buynow.bmp (copy)

Windows Analysis Report
NkMMNoILv9.exe